X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fdbus-job.c;h=fa1d1f3389ee9e742c4f495af3e898a837ebfd9c;hb=f5b51ea7fcb0b6380c3ceb4d4f3f22f647c6fd32;hp=eb7257d681368bc2ae21c92b644919550309a351;hpb=283868e1dcd8ea7475850d9c6e7d4722c473dd50;p=elogind.git

diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index eb7257d68..fa1d1f338 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -29,23 +29,6 @@
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType);
 static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState);
 
-static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) {
-        _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL;
-        int r;
-
-        if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message)))
-                return 0; /* One of the job owners is calling us */
-
-        r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN);
-        if (r < 0)
-                return r;
-        if (r == 0)
-                return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action");
-
-        /* Root has called us */
-        return 0;
-}
-
 static int property_get_unit(
                 sd_bus *bus,
                 const char *path,
@@ -77,13 +60,20 @@ int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata,
         assert(message);
         assert(j);
 
-        r = verify_sys_admin_or_owner_sync(message, j, error);
+        r = mac_selinux_unit_access_check(j->unit, message, "stop", error);
         if (r < 0)
                 return r;
 
-        r = selinux_unit_access_check(j->unit, message, "stop", error);
-        if (r < 0)
-                return r;
+        /* Access is granted to the job owner */
+        if (!sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) {
+
+                /* And for everybody else consult PolicyKit */
+                r = bus_verify_manage_units_async(j->unit->manager, message, error);
+                if (r < 0)
+                        return r;
+                if (r == 0)
+                        return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+        }
 
         job_finish_and_invalidate(j, JOB_CANCELED, true);
 
@@ -155,7 +145,7 @@ void bus_job_send_change_signal(Job *j) {
 
         r = bus_foreach_bus(j->manager, j->clients, j->sent_dbus_new_signal ? send_changed_signal : send_new_signal, j);
         if (r < 0)
-                log_debug("Failed to send job change signal for %u: %s", j->id, strerror(-r));
+                log_debug_errno(r, "Failed to send job change signal for %u: %m", j->id);
 
         j->sent_dbus_new_signal = true;
 }
@@ -199,5 +189,5 @@ void bus_job_send_removed_signal(Job *j) {
 
         r = bus_foreach_bus(j->manager, j->clients, send_removed_signal, j);
         if (r < 0)
-                log_debug("Failed to send job remove signal for %u: %s", j->id, strerror(-r));
+                log_debug_errno(r, "Failed to send job remove signal for %u: %m", j->id);
 }