X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fcore%2Fdbus-scope.c;h=651c163be0f16be7e7a17cb8e85960a430e9f8c3;hb=c43b2132f37264600cc26e07c8d85dfdd6c969f0;hp=fbb4ff5646cdc31174836d140d1f1f29cea8f57e;hpb=de0671ee7fe465e108f62dcbbbe9366f81dd9e9a;p=elogind.git

diff --git a/src/core/dbus-scope.c b/src/core/dbus-scope.c
index fbb4ff564..651c163be 100644
--- a/src/core/dbus-scope.c
+++ b/src/core/dbus-scope.c
@@ -19,15 +19,17 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include "selinux-access.h"
 #include "unit.h"
 #include "scope.h"
+#include "dbus.h"
+#include "bus-util.h"
+#include "bus-internal.h"
+#include "bus-common-errors.h"
 #include "dbus-unit.h"
 #include "dbus-cgroup.h"
 #include "dbus-kill.h"
 #include "dbus-scope.h"
-#include "bus-util.h"
-#include "bus-internal.h"
-#include "bus-errors.h"
 
 static int bus_scope_abandon(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Scope *s = userdata;
@@ -37,12 +39,21 @@ static int bus_scope_abandon(sd_bus *bus, sd_bus_message *message, void *userdat
         assert(message);
         assert(s);
 
-        r = scope_abandon(s);
-        if (sd_bus_error_is_set(error))
+        r = mac_selinux_unit_access_check(UNIT(s), message, "stop", error);
+        if (r < 0)
                 return r;
 
+        r = bus_verify_manage_units_async(UNIT(s)->manager, message, error);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+
+        r = scope_abandon(s);
         if (r == -ESTALE)
                 return sd_bus_error_setf(error, BUS_ERROR_SCOPE_NOT_RUNNING, "Scope %s is not running, cannot abandon.", UNIT(s)->id);
+        if (r < 0)
+                return r;
 
         return sd_bus_reply_method_return(message, NULL);
 }
@@ -55,7 +66,7 @@ const sd_bus_vtable bus_scope_vtable[] = {
         SD_BUS_PROPERTY("TimeoutStopUSec", "t", bus_property_get_usec, offsetof(Scope, timeout_stop_usec), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("Result", "s", property_get_result, offsetof(Scope, result), SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
         SD_BUS_SIGNAL("RequestStop", NULL, 0),
-        SD_BUS_METHOD("Abandon", NULL, NULL, bus_scope_abandon, 0),
+        SD_BUS_METHOD("Abandon", NULL, NULL, bus_scope_abandon, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_VTABLE_END
 };