X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fbus-proxyd%2Fbus-policy.c;h=227742ba745a7b1266201b8232249dafd676b0c3;hp=d2eace940512645089192da8ae460fcddb197c6f;hb=080edb3484dc3ecf8d914526fdd3090b40fdf5b6;hpb=d5099efc47d4e6ac60816b5381a5f607ab03f06e

diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c
index d2eace940..227742ba7 100644
--- a/src/bus-proxyd/bus-policy.c
+++ b/src/bus-proxyd/bus-policy.c
@@ -39,6 +39,14 @@ static void policy_item_free(PolicyItem *i) {
 
 DEFINE_TRIVIAL_CLEANUP_FUNC(PolicyItem*, policy_item_free);
 
+static void item_append(PolicyItem *i, PolicyItem **list) {
+
+        PolicyItem *tail;
+
+        LIST_FIND_TAIL(items, *list, tail);
+        LIST_INSERT_AFTER(items, *list, tail, i);
+}
+
 static int file_load(Policy *p, const char *path) {
 
         _cleanup_free_ char *c = NULL, *policy_user = NULL, *policy_group = NULL;
@@ -330,9 +338,9 @@ static int file_load(Policy *p, const char *path) {
                                 }
 
                                 if (policy_category == POLICY_CATEGORY_DEFAULT)
-                                        LIST_PREPEND(items, p->default_items, i);
+                                        item_append(i, &p->default_items);
                                 else if (policy_category == POLICY_CATEGORY_MANDATORY)
-                                        LIST_PREPEND(items, p->default_items, i);
+                                        item_append(i, &p->mandatory_items);
                                 else if (policy_category == POLICY_CATEGORY_USER) {
                                         const char *u = policy_user;
 
@@ -355,7 +363,8 @@ static int file_load(Policy *p, const char *path) {
                                                 PolicyItem *first;
 
                                                 first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid));
-                                                LIST_PREPEND(items, first, i);
+                                                item_append(i, &first);
+                                                i->uid_valid = true;
 
                                                 r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first);
                                                 if (r < 0) {
@@ -386,7 +395,8 @@ static int file_load(Policy *p, const char *path) {
                                                 PolicyItem *first;
 
                                                 first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid));
-                                                LIST_PREPEND(items, first, i);
+                                                item_append(i, &first);
+                                                i->gid_valid = true;
 
                                                 r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first);
                                                 if (r < 0) {
@@ -515,8 +525,36 @@ static int file_load(Policy *p, const char *path) {
                                         return -EINVAL;
                                 }
 
+                                switch (i->class) {
+                                case POLICY_ITEM_USER:
+                                        if (!streq(name, "*")) {
+                                                const char *u = name;
+
+                                                r = get_user_creds(&u, &i->uid, NULL, NULL, NULL);
+                                                if (r < 0)
+                                                        log_error("Failed to resolve user %s: %s", name, strerror(-r));
+                                                else
+                                                        i->uid_valid = true;
+                                        }
+                                        break;
+                                case POLICY_ITEM_GROUP:
+                                        if (!streq(name, "*")) {
+                                                const char *g = name;
+
+                                                r = get_group_creds(&g, &i->gid);
+                                                if (r < 0)
+                                                        log_error("Failed to resolve group %s: %s", name, strerror(-r));
+                                                else
+                                                        i->gid_valid = true;
+                                        }
+                                        break;
+                                default:
+                                        break;
+                                }
+
                                 i->name = name;
                                 name = NULL;
+
                                 state = STATE_ALLOW_DENY;
                         } else {
                                 log_error("Unexpected token (14) in %s:%u.", path, line);
@@ -620,64 +658,64 @@ void policy_free(Policy *p) {
         p->user_items = p->group_items = NULL;
 }
 
-static void dump_items(PolicyItem *i, const char *prefix) {
+static void dump_items(PolicyItem *items, const char *prefix) {
 
-        if (!i)
+        PolicyItem *i;
+
+        if (!items)
                 return;
 
         if (!prefix)
                 prefix = "";
 
-        printf("%sType: %s\n"
-               "%sClass: %s\n",
-               prefix, policy_item_type_to_string(i->type),
-               prefix, policy_item_class_to_string(i->class));
+        LIST_FOREACH(items, i, items) {
 
-        if (i->interface)
-                printf("%sInterface: %s\n",
-                       prefix, i->interface);
+                printf("%sType: %s\n"
+                       "%sClass: %s\n",
+                       prefix, policy_item_type_to_string(i->type),
+                       prefix, policy_item_class_to_string(i->class));
 
-        if (i->member)
-                printf("%sMember: %s\n",
-                       prefix, i->member);
+                if (i->interface)
+                        printf("%sInterface: %s\n",
+                               prefix, i->interface);
 
-        if (i->error)
-                printf("%sError: %s\n",
-                       prefix, i->error);
+                if (i->member)
+                        printf("%sMember: %s\n",
+                               prefix, i->member);
 
-        if (i->path)
-                printf("%sPath: %s\n",
-                       prefix, i->path);
+                if (i->error)
+                        printf("%sError: %s\n",
+                               prefix, i->error);
 
-        if (i->name)
-                printf("%sName: %s\n",
-                       prefix, i->name);
+                if (i->path)
+                        printf("%sPath: %s\n",
+                               prefix, i->path);
 
-        if (i->message_type != 0)
-                printf("%sMessage Type: %s\n",
-                       prefix, bus_message_type_to_string(i->message_type));
+                if (i->name)
+                        printf("%sName: %s\n",
+                               prefix, i->name);
 
-        if (i->uid_valid) {
-                _cleanup_free_ char *user;
+                if (i->message_type != 0)
+                        printf("%sMessage Type: %s\n",
+                               prefix, bus_message_type_to_string(i->message_type));
 
-                user = uid_to_name(i->uid);
+                if (i->uid_valid) {
+                        _cleanup_free_ char *user;
 
-                printf("%sUser: %s\n",
-                       prefix, strna(user));
-        }
+                        user = uid_to_name(i->uid);
 
-        if (i->gid_valid) {
-                _cleanup_free_ char *group;
+                        printf("%sUser: %s\n",
+                               prefix, strna(user));
+                }
 
-                group = gid_to_name(i->gid);
+                if (i->gid_valid) {
+                        _cleanup_free_ char *group;
 
-                printf("%sGroup: %s\n",
-                       prefix, strna(group));
-        }
+                        group = gid_to_name(i->gid);
 
-        if (i->items_next) {
-                printf("%s%s\n", prefix, draw_special_char(DRAW_DASH));
-                dump_items(i->items_next, prefix);
+                        printf("%sGroup: %s\n",
+                               prefix, strna(group));
+                }
         }
 }