X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fbus-proxyd%2Fbus-policy.c;h=4bc575f3ab93b380d63276da2ac6c261d77c1cdd;hp=c23d394cb2c74d86d94cb961613cd5b70c409457;hb=e42bb8d4ed7c81abbe416ef30436f7b4b9e07bad;hpb=13f8b8cbb466affdaeba2294ee7ab0f33015f356 diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c index c23d394cb..4bc575f3a 100644 --- a/src/bus-proxyd/bus-policy.c +++ b/src/bus-proxyd/bus-policy.c @@ -39,6 +39,14 @@ static void policy_item_free(PolicyItem *i) { DEFINE_TRIVIAL_CLEANUP_FUNC(PolicyItem*, policy_item_free); +static void item_append(PolicyItem *i, PolicyItem **list) { + + PolicyItem *tail; + + LIST_FIND_TAIL(items, *list, tail); + LIST_INSERT_AFTER(items, *list, tail, i); +} + static int file_load(Policy *p, const char *path) { _cleanup_free_ char *c = NULL, *policy_user = NULL, *policy_group = NULL; @@ -155,7 +163,10 @@ static int file_load(Policy *p, const char *path) { else if (streq(name, "group")) state = STATE_POLICY_GROUP; else { - log_warning("Attribute %s of tag unknown at %s:%u, ignoring.", name, path, line); + if (streq(name, "at_console")) + log_debug("Attribute %s of tag unsupported at %s:%u, ignoring.", name, path, line); + else + log_warning("Attribute %s of tag unknown at %s:%u, ignoring.", name, path, line); state = STATE_POLICY_OTHER_ATTRIBUTE; } } else if (t == XML_TAG_CLOSE_EMPTY || @@ -268,7 +279,12 @@ static int file_load(Policy *p, const char *path) { ic = POLICY_ITEM_USER; else if (streq(name, "group")) ic = POLICY_ITEM_GROUP; - else { + else if (streq(name, "eavesdrop")) { + log_debug("Unsupported attribute %s= at %s:%u, ignoring.", name, path, line); + i->class = POLICY_ITEM_IGNORE; + state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; + break; + } else { log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; break; @@ -303,7 +319,10 @@ static int file_load(Policy *p, const char *path) { (streq(u, "sender") && ic == POLICY_ITEM_RECV)) state = STATE_ALLOW_DENY_NAME; else { - log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); + if (streq(u, "requested_reply")) + log_debug("Unsupported attribute %s= at %s:%u, ignoring.", name, path, line); + else + log_error("Unknown attribute %s= at %s:%u, ignoring.", name, path, line); state = STATE_ALLOW_DENY_OTHER_ATTRIBUTE; break; } @@ -319,15 +338,15 @@ static int file_load(Policy *p, const char *path) { } if (policy_category == POLICY_CATEGORY_DEFAULT) - LIST_PREPEND(items, p->default_items, i); + item_append(i, &p->default_items); else if (policy_category == POLICY_CATEGORY_MANDATORY) - LIST_PREPEND(items, p->default_items, i); + item_append(i, &p->mandatory_items); else if (policy_category == POLICY_CATEGORY_USER) { const char *u = policy_user; assert_cc(sizeof(uid_t) == sizeof(uint32_t)); - r = hashmap_ensure_allocated(&p->user_items, trivial_hash_func, trivial_compare_func); + r = hashmap_ensure_allocated(&p->user_items, NULL); if (r < 0) return log_oom(); @@ -344,7 +363,8 @@ static int file_load(Policy *p, const char *path) { PolicyItem *first; first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid)); - LIST_PREPEND(items, first, i); + item_append(i, &first); + i->uid_valid = true; r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first); if (r < 0) { @@ -358,7 +378,7 @@ static int file_load(Policy *p, const char *path) { assert_cc(sizeof(gid_t) == sizeof(uint32_t)); - r = hashmap_ensure_allocated(&p->group_items, trivial_hash_func, trivial_compare_func); + r = hashmap_ensure_allocated(&p->group_items, NULL); if (r < 0) return log_oom(); @@ -375,7 +395,8 @@ static int file_load(Policy *p, const char *path) { PolicyItem *first; first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid)); - LIST_PREPEND(items, first, i); + item_append(i, &first); + i->gid_valid = true; r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first); if (r < 0) { @@ -504,8 +525,36 @@ static int file_load(Policy *p, const char *path) { return -EINVAL; } + switch (i->class) { + case POLICY_ITEM_USER: + if (!streq(name, "*")) { + const char *u = name; + + r = get_user_creds(&u, &i->uid, NULL, NULL, NULL); + if (r < 0) + log_error("Failed to resolve user %s: %s", name, strerror(-r)); + else + i->uid_valid = true; + } + break; + case POLICY_ITEM_GROUP: + if (!streq(name, "*")) { + const char *g = name; + + r = get_group_creds(&g, &i->gid); + if (r < 0) + log_error("Failed to resolve group %s: %s", name, strerror(-r)); + else + i->gid_valid = true; + } + break; + default: + break; + } + i->name = name; name = NULL; + state = STATE_ALLOW_DENY; } else { log_error("Unexpected token (14) in %s:%u.", path, line); @@ -609,64 +658,64 @@ void policy_free(Policy *p) { p->user_items = p->group_items = NULL; } -static void dump_items(PolicyItem *i, const char *prefix) { +static void dump_items(PolicyItem *items, const char *prefix) { + + PolicyItem *i; - if (!i) + if (!items) return; if (!prefix) prefix = ""; - printf("%sType: %s\n" - "%sClass: %s\n", - prefix, policy_item_type_to_string(i->type), - prefix, policy_item_class_to_string(i->class)); + LIST_FOREACH(items, i, items) { - if (i->interface) - printf("%sInterface: %s\n", - prefix, i->interface); + printf("%sType: %s\n" + "%sClass: %s\n", + prefix, policy_item_type_to_string(i->type), + prefix, policy_item_class_to_string(i->class)); - if (i->member) - printf("%sMember: %s\n", - prefix, i->member); + if (i->interface) + printf("%sInterface: %s\n", + prefix, i->interface); - if (i->error) - printf("%sError: %s\n", - prefix, i->error); + if (i->member) + printf("%sMember: %s\n", + prefix, i->member); - if (i->path) - printf("%sPath: %s\n", - prefix, i->path); + if (i->error) + printf("%sError: %s\n", + prefix, i->error); - if (i->name) - printf("%sName: %s\n", - prefix, i->name); + if (i->path) + printf("%sPath: %s\n", + prefix, i->path); - if (i->message_type != 0) - printf("%sMessage Type: %s\n", - prefix, bus_message_type_to_string(i->message_type)); + if (i->name) + printf("%sName: %s\n", + prefix, i->name); - if (i->uid_valid) { - _cleanup_free_ char *user; + if (i->message_type != 0) + printf("%sMessage Type: %s\n", + prefix, bus_message_type_to_string(i->message_type)); - user = uid_to_name(i->uid); + if (i->uid_valid) { + _cleanup_free_ char *user; - printf("%sUser: %s\n", - prefix, strna(user)); - } + user = uid_to_name(i->uid); - if (i->gid_valid) { - _cleanup_free_ char *group; + printf("%sUser: %s\n", + prefix, strna(user)); + } - group = gid_to_name(i->gid); + if (i->gid_valid) { + _cleanup_free_ char *group; - printf("%sGroup: %s\n", - prefix, strna(group)); - } + group = gid_to_name(i->gid); - if (i->items_next) { - printf("%s%s\n", prefix, draw_special_char(DRAW_DASH)); - dump_items(i->items_next, prefix); + printf("%sGroup: %s\n", + prefix, strna(group)); + } } } @@ -681,7 +730,7 @@ static void dump_hashmap_items(Hashmap *h) { } } -noreturn void policy_dump(Policy *p) { +void policy_dump(Policy *p) { printf("%s Default Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->default_items, "\t"); @@ -694,8 +743,6 @@ noreturn void policy_dump(Policy *p) { printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW)); dump_items(p->mandatory_items, "\t"); - - exit(0); } static const char* const policy_item_type_table[_POLICY_ITEM_TYPE_MAX] = { @@ -713,5 +760,6 @@ static const char* const policy_item_class_table[_POLICY_ITEM_CLASS_MAX] = { [POLICY_ITEM_OWN_PREFIX] = "own-prefix", [POLICY_ITEM_USER] = "user", [POLICY_ITEM_GROUP] = "group", + [POLICY_ITEM_IGNORE] = "ignore", }; DEFINE_STRING_TABLE_LOOKUP(policy_item_class, PolicyItemClass);