sd-bus: when augmenting creds, remember which ones were augmented

[elogind.git] / src / libelogind / sd-bus / bus-util.c

diff --git a/src/libelogind/sd-bus/bus-util.c b/src/libelogind/sd-bus/bus-util.c
index ee002a55f54370e83f86ed080482faa086b0222b..a84d3381cbe91652516830ac06e9127fac223ad7 100644 (file)
--- a/src/libelogind/sd-bus/bus-util.c
+++ b/src/libelogind/sd-bus/bus-util.c
@@ -206,6 +206,9 @@ static int check_good_user(sd_bus_message *m, uid_t good_user) {
         if (r < 0)
                 return r;
 
+        /* Don't trust augmented credentials for authorization */
+        assert_return((sd_bus_creds_get_augmented_mask(creds) & SD_BUS_CREDS_EUID) == 0, -EPERM);
+
         r = sd_bus_creds_get_euid(creds, &sender_uid);
         if (r < 0)
                 return r;
@@ -1745,13 +1748,13 @@ static int bus_job_get_service_result(BusWaitForJobs *d, char **result) {
 static const struct {
         const char *result, *explanation;
 } explanations [] = {
-        { "resources", "configured resource limit was exceeded" },
-        { "timeout", "timeout was exceeded" },
-        { "exit-code", "control process exited with error code" },
-        { "signal", "fatal signal was delivered to the control process" },
-        { "core-dump", "fatal signal was delivered to the control process. Core dumped" },
-        { "watchdog", "service failed to send watchdog ping" },
-        { "start-limit", "start of the service was attempted too often too quickly" }
+        { "resources",   "a configured resource limit was exceeded" },
+        { "timeout",     "a timeout was exceeded" },
+        { "exit-code",   "the control process exited with error code" },
+        { "signal",      "a fatal signal was delivered to the control process" },
+        { "core-dump",   "a fatal signal was delivered causing the control process to dump core" },
+        { "watchdog",    "the service failed to send watchdog ping" },
+        { "start-limit", "start of the service was attempted too often" }
 };
 
 static void log_job_error_with_service_result(const char* service, const char *result) {
@@ -1779,8 +1782,7 @@ static void log_job_error_with_service_result(const char* service, const char *r
 
         /* For some results maybe additional explanation is required */
         if (streq_ptr(result, "start-limit"))
-                log_info("To force a start please invoke \"systemctl reset-failed %s\" followed by \"systemctl start %s\" again.",
-                         strna(service_shell_quoted),
+                log_info("To force a start use \"systemctl reset-failed %1$s\" followed by \"systemctl start %1$s\" again.",
                          strna(service_shell_quoted));
 }