X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fbus-proxyd%2Fbus-policy.c;h=06c16a7eb6d2ca7ee29b9b4540bc22d679a43219;hb=7de12ae764e73730df0658f9fb04bcf42add48e2;hp=af3b3abbf9100053c2a763fab11552dd26963f01;hpb=445743035336bf9691d200b8417685186ef9b5f9;p=elogind.git diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c index af3b3abbf..06c16a7eb 100644 --- a/src/bus-proxyd/bus-policy.c +++ b/src/bus-proxyd/bus-policy.c @@ -83,6 +83,8 @@ static int file_load(Policy *p, const char *path) { if (r < 0) { if (r == -ENOENT) return 0; + if (r == -EISDIR) + return r; log_error("Failed to load %s: %s", path, strerror(-r)); return r; @@ -153,7 +155,10 @@ static int file_load(Policy *p, const char *path) { else if (streq(name, "group")) state = STATE_POLICY_GROUP; else { - log_warning("Attribute %s of tag unknown at %s:%u, ignoring.", name, path, line); + if (streq(name, "at_console")) + log_debug("Attribute %s of tag unsupported at %s:%u, ignoring.", name, path, line); + else + log_warning("Attribute %s of tag unknown at %s:%u, ignoring.", name, path, line); state = STATE_POLICY_OTHER_ATTRIBUTE; } } else if (t == XML_TAG_CLOSE_EMPTY || @@ -266,7 +271,12 @@ static int file_load(Policy *p, const char *path) { ic = POLICY_ITEM_USER; else if (streq(name, "group")) ic = POLICY_ITEM_GROUP; - else { + else if (streq(name, "eavesdrop")) { + log_debug("Unsupported attribute %s= at %s:%u, ignoring.", name, path, line); + i->class = POLICY_ITEM_IGNORE; + state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; + break; + } else { log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; break; @@ -301,7 +311,10 @@ static int file_load(Policy *p, const char *path) { (streq(u, "sender") && ic == POLICY_ITEM_RECV)) state = STATE_ALLOW_DENY_NAME; else { - log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); + if (streq(u, "requested_reply")) + log_debug("Unsupported attribute %s= at %s:%u, ignoring.", name, path, line); + else + log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; break; } @@ -321,7 +334,7 @@ static int file_load(Policy *p, const char *path) { else if (policy_category == POLICY_CATEGORY_MANDATORY) LIST_PREPEND(items, p->default_items, i); else if (policy_category == POLICY_CATEGORY_USER) { - PolicyItem *first; + const char *u = policy_user; assert_cc(sizeof(uid_t) == sizeof(uint32_t)); @@ -329,16 +342,30 @@ static int file_load(Policy *p, const char *path) { if (r < 0) return log_oom(); - first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid)); - LIST_PREPEND(items, first, i); + if (!u) { + log_error("User policy without name"); + return -EINVAL; + } - r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first); + r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); if (r < 0) { - LIST_REMOVE(items, first, i); - return log_oom(); + log_error("Failed to resolve user %s, ignoring policy: %s", u, strerror(-r)); + free(i); + } else { + PolicyItem *first; + + first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid)); + LIST_PREPEND(items, first, i); + + r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first); + if (r < 0) { + LIST_REMOVE(items, first, i); + return log_oom(); + } } + } else if (policy_category == POLICY_CATEGORY_GROUP) { - PolicyItem *first; + const char *g = policy_group; assert_cc(sizeof(gid_t) == sizeof(uint32_t)); @@ -346,13 +373,26 @@ static int file_load(Policy *p, const char *path) { if (r < 0) return log_oom(); - first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid)); - LIST_PREPEND(items, first, i); + if (!g) { + log_error("Group policy without name"); + return -EINVAL; + } - r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first); + r = get_group_creds(&g, &i->gid); if (r < 0) { - LIST_REMOVE(items, first, i); - return log_oom(); + log_error("Failed to resolve group %s, ignoring policy: %s", g, strerror(-r)); + free(i); + } else { + PolicyItem *first; + + first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid)); + LIST_PREPEND(items, first, i); + + r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first); + if (r < 0) { + LIST_REMOVE(items, first, i); + return log_oom(); + } } } @@ -513,24 +553,31 @@ static int file_load(Policy *p, const char *path) { } } -int policy_load(Policy *p) { - _cleanup_strv_free_ char **l = NULL; +int policy_load(Policy *p, char **files) { char **i; int r; assert(p); - file_load(p, "/etc/dbus-1/system.conf"); - file_load(p, "/etc/dbus-1/system-local.conf"); + STRV_FOREACH(i, files) { - r = conf_files_list(&l, ".conf", NULL, "/etc/dbus-1/system.d/", NULL); - if (r < 0) { - log_error("Failed to get configuration file list: %s", strerror(-r)); - return r; - } + r = file_load(p, *i); + if (r == -EISDIR) { + _cleanup_strv_free_ char **l = NULL; + char **j; - STRV_FOREACH(i, l) - file_load(p, *i); + r = conf_files_list(&l, ".conf", NULL, *i, NULL); + if (r < 0) { + log_error("Failed to get configuration file list: %s", strerror(-r)); + return r; + } + + STRV_FOREACH(j, l) + file_load(p, *j); + } + + /* We ignore all errors but EISDIR, and just proceed. */ + } return 0; } @@ -557,8 +604,6 @@ void policy_free(Policy *p) { LIST_REMOVE(items, first, i); policy_item_free(i); } - - policy_item_free(i); } while ((first = hashmap_steal_first(p->group_items))) { @@ -567,8 +612,6 @@ void policy_free(Policy *p) { LIST_REMOVE(items, first, i); policy_item_free(i); } - - policy_item_free(i); } hashmap_free(p->user_items); @@ -577,47 +620,50 @@ void policy_free(Policy *p) { p->user_items = p->group_items = NULL; } -static void dump_items(PolicyItem *i) { +static void dump_items(PolicyItem *i, const char *prefix) { if (!i) return; - printf("Type: %s\n" - "Class: %s\n", - policy_item_type_to_string(i->type), - policy_item_class_to_string(i->class)); + if (!prefix) + prefix = ""; + + printf("%sType: %s\n" + "%sClass: %s\n", + prefix, policy_item_type_to_string(i->type), + prefix, policy_item_class_to_string(i->class)); if (i->interface) - printf("Interface: %s\n", - i->interface); + printf("%sInterface: %s\n", + prefix, i->interface); if (i->member) - printf("Member: %s\n", - i->member); + printf("%sMember: %s\n", + prefix, i->member); if (i->error) - printf("Error: %s\n", - i->error); + printf("%sError: %s\n", + prefix, i->error); if (i->path) - printf("Path: %s\n", - i->path); + printf("%sPath: %s\n", + prefix, i->path); if (i->name) - printf("Name: %s\n", - i->name); + printf("%sName: %s\n", + prefix, i->name); if (i->message_type != 0) - printf("Message Type: %s\n", - bus_message_type_to_string(i->message_type)); + printf("%sMessage Type: %s\n", + prefix, bus_message_type_to_string(i->message_type)); if (i->uid_valid) { _cleanup_free_ char *user; user = uid_to_name(i->uid); - printf("User: %s\n", - strna(user)); + printf("%sUser: %s\n", + prefix, strna(user)); } if (i->gid_valid) { @@ -625,13 +671,13 @@ static void dump_items(PolicyItem *i) { group = gid_to_name(i->gid); - printf("Group: %s\n", - strna(group)); + printf("%sGroup: %s\n", + prefix, strna(group)); } if (i->items_next) { - printf("--\n"); - dump_items(i->items_next); + printf("%s%s\n", prefix, draw_special_char(DRAW_DASH)); + dump_items(i->items_next, prefix); } } @@ -641,24 +687,25 @@ static void dump_hashmap_items(Hashmap *h) { void *k; HASHMAP_FOREACH_KEY(i, k, h, j) { - printf("Item for %u:\n", PTR_TO_UINT(k)); - dump_items(i); + printf("\t%s Item for %u:\n", draw_special_char(DRAW_ARROW), PTR_TO_UINT(k)); + dump_items(i, "\t\t"); } } -void policy_dump(Policy *p) { +noreturn void policy_dump(Policy *p) { - printf("→ Default Items:\n"); - dump_items(p->default_items); + printf("%s Default Items:\n", draw_special_char(DRAW_ARROW)); + dump_items(p->default_items, "\t"); - printf("→ Mandatory Items:\n"); - dump_items(p->mandatory_items); - - printf("→ Group Items:\n"); + printf("%s Group Items:\n", draw_special_char(DRAW_ARROW)); dump_hashmap_items(p->group_items); - printf("→ User Items:\n"); + printf("%s User Items:\n", draw_special_char(DRAW_ARROW)); dump_hashmap_items(p->user_items); + + printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW)); + dump_items(p->mandatory_items, "\t"); + exit(0); } @@ -677,5 +724,6 @@ static const char* const policy_item_class_table[_POLICY_ITEM_CLASS_MAX] = { [POLICY_ITEM_OWN_PREFIX] = "own-prefix", [POLICY_ITEM_USER] = "user", [POLICY_ITEM_GROUP] = "group", + [POLICY_ITEM_IGNORE] = "ignore", }; DEFINE_STRING_TABLE_LOOKUP(policy_item_class, PolicyItemClass);