X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Flibelogind%2Fsd-bus%2Fbus-convenience.c;h=dfd82e746d678722f82347236e181b800800bbb8;hb=fe40a936c997fd3c6e8830ab3d9c3665c0c31524;hp=a6317e97857bd7a19eda2e690cf089b8b1d1f4e4;hpb=f48dd74a8d39b6074f820f904953f5cece03b9b0;p=elogind.git

diff --git a/src/libelogind/sd-bus/bus-convenience.c b/src/libelogind/sd-bus/bus-convenience.c
index a6317e978..dfd82e746 100644
--- a/src/libelogind/sd-bus/bus-convenience.c
+++ b/src/libelogind/sd-bus/bus-convenience.c
@@ -58,6 +58,43 @@ _public_ int sd_bus_emit_signal(
         return sd_bus_send(bus, m, NULL);
 }
 
+_public_ int sd_bus_call_method_async(
+                sd_bus *bus,
+                sd_bus_slot **slot,
+                const char *destination,
+                const char *path,
+                const char *interface,
+                const char *member,
+                sd_bus_message_handler_t callback,
+                void *userdata,
+                const char *types, ...) {
+
+        _cleanup_bus_message_unref_ sd_bus_message *m = NULL;
+        int r;
+
+        assert_return(bus, -EINVAL);
+        assert_return(!bus_pid_changed(bus), -ECHILD);
+
+        if (!BUS_IS_OPEN(bus->state))
+                return -ENOTCONN;
+
+        r = sd_bus_message_new_method_call(bus, &m, destination, path, interface, member);
+        if (r < 0)
+                return r;
+
+        if (!isempty(types)) {
+                va_list ap;
+
+                va_start(ap, types);
+                r = bus_message_append_ap(m, types, ap);
+                va_end(ap);
+                if (r < 0)
+                        return r;
+        }
+
+        return sd_bus_call_async(bus, slot, m, callback, userdata, 0);
+}
+
 _public_ int sd_bus_call_method(
                 sd_bus *bus,
                 const char *destination,
@@ -462,11 +499,22 @@ _public_ int sd_bus_query_sender_creds(sd_bus_message *call, uint64_t mask, sd_b
         /* No data passed? Or not enough data passed to retrieve the missing bits? */
         if (!c || !(c->mask & SD_BUS_CREDS_PID)) {
                 /* We couldn't read anything from the call, let's try
-                 * to get it from the sender or peer */
+                 * to get it from the sender or peer. */
 
                 if (call->sender)
+                        /* There's a sender, but the creds are
+                         * missing. This means we are talking via
+                         * dbus1, or are getting a message that was
+                         * sent to us via kdbus, but was converted
+                         * from a dbus1 message by the bus-proxy and
+                         * thus also lacks the creds. */
                         return sd_bus_get_name_creds(call->bus, call->sender, mask, creds);
                 else
+                        /* There's no sender, hence we are on a dbus1
+                         * direct connection. For direct connections
+                         * the credentials of the AF_UNIX peer matter,
+                         * which may be queried via
+                         * sd_bus_get_owner_creds(). */
                         return sd_bus_get_owner_creds(call->bus, mask, creds);
         }
 
@@ -488,10 +536,18 @@ _public_ int sd_bus_query_sender_privilege(sd_bus_message *call, int capability)
                 return -ENOTCONN;
 
         if (capability >= 0) {
+
                 r = sd_bus_query_sender_creds(call, SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_EFFECTIVE_CAPS, &creds);
                 if (r < 0)
                         return r;
 
+                /* We cannot use augmented caps for authorization,
+                 * since then data is acquired raceful from
+                 * /proc. This can never actually happen, but let's
+                 * better be safe than sorry, and do an extra check
+                 * here. */
+                assert_return((sd_bus_creds_get_augmented_mask(creds) & SD_BUS_CREDS_EFFECTIVE_CAPS) == 0, -EPERM);
+
                 /* Note that not even on kdbus we might have the caps
                  * field, due to faked identities, or namespace
                  * translation issues. */
@@ -512,6 +568,13 @@ _public_ int sd_bus_query_sender_privilege(sd_bus_message *call, int capability)
         if (our_uid != 0 || !know_caps || capability < 0) {
                 uid_t sender_uid;
 
+                /* We cannot use augmented uid/euid for authorization,
+                 * since then data is acquired raceful from
+                 * /proc. This can never actually happen, but let's
+                 * better be safe than sorry, and do an extra check
+                 * here. */
+                assert_return((sd_bus_creds_get_augmented_mask(creds) & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID)) == 0, -EPERM);
+
                 /* Try to use the EUID, if we have it. */
                 r = sd_bus_creds_get_euid(creds, &sender_uid);
                 if (r < 0)