X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fdbus-manager.c;h=765d376820be3461fed35268ae82967cdecddf2a;hp=2e4de2e4316bbe71dcd65b12e4ec781037d0b497;hb=0a1beeb64207eaa88ab9236787b1cbc2f704ae14;hpb=718db96199eb307751264e4163555662c9a389fa diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c index 2e4de2e43..765d37682 100644 --- a/src/core/dbus-manager.c +++ b/src/core/dbus-manager.c @@ -28,15 +28,16 @@ #include "install.h" #include "selinux-access.h" #include "watchdog.h" -#include "hwclock.h" +#include "clock-util.h" #include "path-util.h" #include "virt.h" +#include "architecture.h" #include "env-util.h" #include "dbus.h" +#include "dbus-job.h" #include "dbus-manager.h" #include "dbus-unit.h" #include "dbus-snapshot.h" -#include "dbus-client-track.h" #include "dbus-execute.h" #include "bus-errors.h" @@ -46,8 +47,8 @@ static int property_get_version( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { assert(bus); assert(reply); @@ -61,8 +62,8 @@ static int property_get_features( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { assert(bus); assert(reply); @@ -76,8 +77,8 @@ static int property_get_virtualization( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { const char *id = NULL; @@ -89,16 +90,31 @@ static int property_get_virtualization( return sd_bus_message_append(reply, "s", id); } +static int property_get_architecture( + sd_bus *bus, + const char *path, + const char *interface, + const char *property, + sd_bus_message *reply, + void *userdata, + sd_bus_error *error) { + + assert(bus); + assert(reply); + + return sd_bus_message_append(reply, "s", architecture_to_string(uname_architecture())); +} + static int property_get_tainted( sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { - char buf[LINE_MAX] = "", *e = buf; + char buf[sizeof("split-usr:mtab-not-symlink:cgroups-missing:local-hwclock:")] = "", *e = buf; _cleanup_free_ char *p = NULL; Manager *m = userdata; @@ -115,7 +131,7 @@ static int property_get_tainted( if (access("/proc/cgroups", F_OK) < 0) e = stpcpy(e, "cgroups-missing:"); - if (hwclock_is_localtime() > 0) + if (clock_is_localtime() > 0) e = stpcpy(e, "local-hwclock:"); /* remove the last ':' */ @@ -131,8 +147,8 @@ static int property_get_log_target( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { assert(bus); assert(reply); @@ -146,8 +162,8 @@ static int property_set_log_target( const char *interface, const char *property, sd_bus_message *value, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { const char *t; int r; @@ -168,8 +184,8 @@ static int property_get_log_level( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { _cleanup_free_ char *t = NULL; int r; @@ -190,8 +206,8 @@ static int property_set_log_level( const char *interface, const char *property, sd_bus_message *value, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { const char *t; int r; @@ -212,8 +228,8 @@ static int property_get_n_names( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { Manager *m = userdata; @@ -224,14 +240,32 @@ static int property_get_n_names( return sd_bus_message_append(reply, "u", (uint32_t) hashmap_size(m->units)); } +static int property_get_n_failed_units( + sd_bus *bus, + const char *path, + const char *interface, + const char *property, + sd_bus_message *reply, + void *userdata, + sd_bus_error *error) { + + Manager *m = userdata; + + assert(bus); + assert(reply); + assert(m); + + return sd_bus_message_append(reply, "u", (uint32_t) set_size(m->failed_units)); +} + static int property_get_n_jobs( sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { Manager *m = userdata; @@ -248,8 +282,8 @@ static int property_get_progress( const char *interface, const char *property, sd_bus_message *reply, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { Manager *m = userdata; double d; @@ -266,14 +300,32 @@ static int property_get_progress( return sd_bus_message_append(reply, "d", d); } +static int property_get_system_state( + sd_bus *bus, + const char *path, + const char *interface, + const char *property, + sd_bus_message *reply, + void *userdata, + sd_bus_error *error) { + + Manager *m = userdata; + + assert(bus); + assert(reply); + assert(m); + + return sd_bus_message_append(reply, "s", manager_state_to_string(manager_state(m))); +} + static int property_set_runtime_watchdog( sd_bus *bus, const char *path, const char *interface, const char *property, sd_bus_message *value, - sd_bus_error *error, - void *userdata) { + void *userdata, + sd_bus_error *error) { usec_t *t = userdata; int r; @@ -290,7 +342,7 @@ static int property_set_runtime_watchdog( return watchdog_set_timeout(t); } -static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *path = NULL; Manager *m = userdata; const char *name; @@ -301,24 +353,28 @@ static int method_get_unit(sd_bus *bus, sd_bus_message *message, void *userdata) assert(message); assert(m); + /* Anyone can call this method */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, name); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s not loaded.", name); - SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status"); + r = mac_selinux_unit_access_check(u, message, "status", error); + if (r < 0) + return r; path = unit_dbus_path(u); if (!path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "o", path); + return sd_bus_reply_method_return(message, "o", path); } -static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *path = NULL; Manager *m = userdata; pid_t pid; @@ -331,31 +387,40 @@ static int method_get_unit_by_pid(sd_bus *bus, sd_bus_message *message, void *us assert_cc(sizeof(pid_t) == sizeof(uint32_t)); + /* Anyone can call this method */ + r = sd_bus_message_read(message, "u", &pid); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; if (pid == 0) { - r = sd_bus_get_owner_pid(bus, sd_bus_message_get_sender(message), &pid); + _cleanup_bus_creds_unref_ sd_bus_creds *creds = NULL; + + r = sd_bus_query_sender_creds(message, SD_BUS_CREDS_PID, &creds); + if (r < 0) + return r; + + r = sd_bus_creds_get_pid(creds, &pid); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; } u = manager_get_unit_by_pid(m, pid); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_UNIT_FOR_PID, "PID %u does not belong to any loaded unit.", pid); + return sd_bus_error_setf(error, BUS_ERROR_NO_UNIT_FOR_PID, "PID %u does not belong to any loaded unit.", pid); - SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status"); + r = mac_selinux_unit_access_check(u, message, "status", error); + if (r < 0) + return r; path = unit_dbus_path(u); if (!path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "o", path); + return sd_bus_reply_method_return(message, "o", path); } -static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; +static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *path = NULL; Manager *m = userdata; const char *name; @@ -366,25 +431,28 @@ static int method_load_unit(sd_bus *bus, sd_bus_message *message, void *userdata assert(message); assert(m); + /* Anyone can call this method */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - r = manager_load_unit(m, name, NULL, &error, &u); + r = manager_load_unit(m, name, NULL, error, &u); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; - SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "status"); + r = mac_selinux_unit_access_check(u, message, "status", error); + if (r < 0) + return r; path = unit_dbus_path(u); if (!path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "o", path); + return sd_bus_reply_method_return(message, "o", path); } -static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manager *m, JobType job_type, bool reload_if_possible) { - _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; +static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manager *m, JobType job_type, bool reload_if_possible, sd_bus_error *error) { const char *name; Unit *u; int r; @@ -393,46 +461,52 @@ static int method_start_unit_generic(sd_bus *bus, sd_bus_message *message, Manag assert(message); assert(m); + r = bus_verify_manage_unit_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - r = manager_load_unit(m, name, NULL, &error, &u); + r = manager_load_unit(m, name, NULL, error, &u); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; - return bus_unit_method_start_generic(bus, message, u, job_type, reload_if_possible); + return bus_unit_method_start_generic(bus, message, u, job_type, reload_if_possible, error); } -static int method_start_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_START, false); +static int method_start_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_START, false, error); } -static int method_stop_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_STOP, false); +static int method_stop_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_STOP, false, error); } -static int method_reload_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_RELOAD, false); +static int method_reload_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_RELOAD, false, error); } -static int method_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_RESTART, false); +static int method_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_RESTART, false, error); } -static int method_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, false); +static int method_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, false, error); } -static int method_reload_or_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_RESTART, true); +static int method_reload_or_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_RESTART, true, error); } -static int method_reload_or_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, true); +static int method_reload_or_try_restart_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_start_unit_generic(bus, message, userdata, JOB_TRY_RESTART, true, error); } -static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *old_name; Unit *u; @@ -442,18 +516,24 @@ static int method_start_unit_replace(sd_bus *bus, sd_bus_message *message, void assert(message); assert(m); + r = bus_verify_manage_unit_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "s", &old_name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, old_name); if (!u || !u->job || u->job->type != JOB_START) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_JOB, "No job queued for unit %s", old_name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "No job queued for unit %s", old_name); - return method_start_unit_generic(bus, message, m, JOB_START, false); + return method_start_unit_generic(bus, message, m, JOB_START, false, error); } -static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *name; Unit *u; @@ -463,18 +543,25 @@ static int method_kill_unit(sd_bus *bus, sd_bus_message *message, void *userdata assert(message); assert(m); + /* Like bus_verify_manage_unit_async(), but uses CAP_SYS_KILL */ + r = bus_verify_manage_unit_async_for_kill(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, name); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); - return bus_unit_method_kill(bus, message, u); + return bus_unit_method_kill(bus, message, u, error); } -static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *name; Unit *u; @@ -484,18 +571,24 @@ static int method_reset_failed_unit(sd_bus *bus, sd_bus_message *message, void * assert(message); assert(m); + r = bus_verify_manage_unit_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, name); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); - return bus_unit_method_reset_failed(bus, message, u); + return bus_unit_method_reset_failed(bus, message, u, error); } -static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *name; Unit *u; @@ -505,19 +598,24 @@ static int method_set_unit_properties(sd_bus *bus, sd_bus_message *message, void assert(message); assert(m); + r = bus_verify_manage_unit_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, name); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not loaded.", name); - return bus_unit_method_set_properties(bus, message, u); + return bus_unit_method_set_properties(bus, message, u, error); } -static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, void *userdata) { - _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; +static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { const char *name, *smode; Manager *m = userdata; JobMode mode; @@ -529,53 +627,61 @@ static int method_start_transient_unit(sd_bus *bus, sd_bus_message *message, voi assert(message); assert(m); + r = bus_verify_manage_unit_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + r = sd_bus_message_read(message, "ss", &name, &smode); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; t = unit_name_to_type(name); if (t < 0) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid unit type."); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid unit type."); if (!unit_vtable[t]->can_transient) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Unit type %s does not support transient units."); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Unit type %s does not support transient units.", unit_type_to_string(t)); mode = job_mode_from_string(smode); if (mode < 0) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode); - r = manager_load_unit(m, name, NULL, &error, &u); + r = mac_selinux_access_check(message, "start", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; - SELINUX_UNIT_ACCESS_CHECK(u, bus, message, "start"); + r = manager_load_unit(m, name, NULL, error, &u); + if (r < 0) + return r; if (u->load_state != UNIT_NOT_FOUND || set_size(u->dependencies[UNIT_REFERENCED_BY]) > 0) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_UNIT_EXISTS, "Unit %s already exists.", name); + return sd_bus_error_setf(error, BUS_ERROR_UNIT_EXISTS, "Unit %s already exists.", name); /* OK, the unit failed to load and is unreferenced, now let's * fill in the transient data instead */ r = unit_make_transient(u); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; /* Set our properties */ - r = bus_unit_set_properties(u, message, UNIT_RUNTIME, false, &error); + r = bus_unit_set_properties(u, message, UNIT_RUNTIME, false, error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; /* And load this stub fully */ r = unit_load(u); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; manager_dispatch_load_queue(m); /* Finally, start it */ - return bus_unit_queue_job(bus, message, u, JOB_START, mode, false); + return bus_unit_queue_job(bus, message, u, JOB_START, mode, false, error); } -static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *path = NULL; Manager *m = userdata; uint32_t id; @@ -586,24 +692,28 @@ static int method_get_job(sd_bus *bus, sd_bus_message *message, void *userdata) assert(message); assert(m); + /* Anyone can call this method */ + r = sd_bus_message_read(message, "u", &id); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; j = manager_get_job(m, id); if (!j) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id); - SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "status"); + r = mac_selinux_unit_access_check(j->unit, message, "status", error); + if (r < 0) + return r; path = job_dbus_path(j); if (!path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "o", path); + return sd_bus_reply_method_return(message, "o", path); } -static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; uint32_t id; Job *j; @@ -615,46 +725,50 @@ static int method_cancel_job(sd_bus *bus, sd_bus_message *message, void *userdat r = sd_bus_message_read(message, "u", &id); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; j = manager_get_job(m, id); if (!j) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id); - - SELINUX_UNIT_ACCESS_CHECK(j->unit, bus, message, "stop"); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_JOB, "Job %u does not exist.", (unsigned) id); - job_finish_and_invalidate(j, JOB_CANCELED, true); - - return sd_bus_reply_method_return(bus, message, NULL); + return bus_job_method_cancel(bus, message, j, error); } -static int method_clear_jobs(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_clear_jobs(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reboot"); + r = mac_selinux_access_check(message, "reboot", error); + if (r < 0) + return r; + manager_clear_jobs(m); - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_reset_failed(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); + r = mac_selinux_access_check(message, "reload", error); + if (r < 0) + return r; + manager_reset_failed(m); - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int list_units_filtered(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error, char **states) { _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; Manager *m = userdata; const char *k; @@ -666,15 +780,19 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ - r = sd_bus_message_new_method_return(bus, message, &reply); + r = mac_selinux_access_check(message, "status", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; + + r = sd_bus_message_new_method_return(message, &reply); + if (r < 0) + return r; r = sd_bus_message_open_container(reply, 'a', "(ssssssouso)"); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; HASHMAP_FOREACH_KEY(u, k, m->units, i) { _cleanup_free_ char *unit_path = NULL, *job_path = NULL; @@ -685,14 +803,20 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat following = unit_following(u); + if (!strv_isempty(states) && + !strv_contains(states, unit_load_state_to_string(u->load_state)) && + !strv_contains(states, unit_active_state_to_string(unit_active_state(u))) && + !strv_contains(states, unit_sub_state_to_string(u))) + continue; + unit_path = unit_dbus_path(u); if (!unit_path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; if (u->job) { job_path = job_dbus_path(u->job); if (!job_path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; } r = sd_bus_message_append( @@ -708,17 +832,32 @@ static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdat u->job ? job_type_to_string(u->job->type) : "", job_path ? job_path : "/"); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; } r = sd_bus_message_close_container(reply); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; return sd_bus_send(bus, reply, NULL); } -static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_list_units(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return list_units_filtered(bus, message, userdata, error, NULL); +} + +static int method_list_units_filtered(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + _cleanup_strv_free_ char **states = NULL; + int r; + + r = sd_bus_message_read_strv(message, &states); + if (r < 0) + return r; + + return list_units_filtered(bus, message, userdata, error, states); +} + +static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; Manager *m = userdata; Iterator i; @@ -729,46 +868,51 @@ static int method_list_jobs(sd_bus *bus, sd_bus_message *message, void *userdata assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ + + r = mac_selinux_access_check(message, "status", error); + if (r < 0) + return r; - r = sd_bus_message_new_method_return(bus, message, &reply); + r = sd_bus_message_new_method_return(message, &reply); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; r = sd_bus_message_open_container(reply, 'a', "(usssoo)"); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; HASHMAP_FOREACH(j, m->jobs, i) { _cleanup_free_ char *unit_path = NULL, *job_path = NULL; job_path = job_dbus_path(j); if (!job_path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; unit_path = unit_dbus_path(j->unit); if (!unit_path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; r = sd_bus_message_append( reply, "(usssoo)", j->id, - job_state_to_string(j->state), + j->unit->id, job_type_to_string(j->type), + job_state_to_string(j->state), job_path, unit_path); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; } r = sd_bus_message_close_container(reply); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; return sd_bus_send(bus, reply, NULL); } -static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; int r; @@ -776,18 +920,34 @@ static int method_subscribe(sd_bus *bus, sd_bus_message *message, void *userdata assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ - r = bus_client_track(&m->subscribed, bus, sd_bus_message_get_sender(message)); + r = mac_selinux_access_check(message, "status", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); - if (r == 0) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_ALREADY_SUBSCRIBED, "Client is already subscribed."); + return r; + + if (bus == m->api_bus) { + + /* Note that direct bus connection subscribe by + * default, we only track peers on the API bus here */ + + if (!m->subscribed) { + r = sd_bus_track_new(bus, &m->subscribed, NULL, NULL); + if (r < 0) + return r; + } + + r = sd_bus_track_add_sender(m->subscribed, message); + if (r < 0) + return r; + if (r == 0) + return sd_bus_error_setf(error, BUS_ERROR_ALREADY_SUBSCRIBED, "Client is already subscribed."); + } - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; int r; @@ -795,32 +955,43 @@ static int method_unsubscribe(sd_bus *bus, sd_bus_message *message, void *userda assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ - r = bus_client_untrack(m->subscribed, bus, sd_bus_message_get_sender(message)); + r = mac_selinux_access_check(message, "status", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); - if (r == 0) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NOT_SUBSCRIBED, "Client is not subscribed."); + return r; - return sd_bus_reply_method_return(bus, message, NULL); + if (bus == m->api_bus) { + r = sd_bus_track_remove_sender(m->subscribed, message); + if (r < 0) + return r; + if (r == 0) + return sd_bus_error_setf(error, BUS_ERROR_NOT_SUBSCRIBED, "Client is not subscribed."); + } + + return sd_bus_reply_method_return(message, NULL); } -static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *dump = NULL; _cleanup_fclose_ FILE *f = NULL; Manager *m = userdata; size_t size; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ + + r = mac_selinux_access_check(message, "status", error); + if (r < 0) + return r; f = open_memstream(&dump, &size); if (!f) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; manager_dump_units(m, f, NULL); manager_dump_jobs(m, f, NULL); @@ -828,45 +999,46 @@ static int method_dump(sd_bus *bus, sd_bus_message *message, void *userdata) { fflush(f); if (ferror(f)) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "s", dump); + return sd_bus_reply_method_return(message, "s", dump); } -static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata) { - _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL; +static int method_create_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *path = NULL; Manager *m = userdata; const char *name; int cleanup; - Snapshot *s; + Snapshot *s = NULL; int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "start"); + r = mac_selinux_access_check(message, "start", error); + if (r < 0) + return r; r = sd_bus_message_read(message, "sb", &name, &cleanup); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; if (isempty(name)) name = NULL; - r = snapshot_create(m, name, cleanup, &error, &s); + r = snapshot_create(m, name, cleanup, error, &s); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, &error); + return r; path = unit_dbus_path(UNIT(s)); if (!path) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; - return sd_bus_reply_method_return(bus, message, "o", path); + return sd_bus_reply_method_return(message, "o", path); } -static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *name; Unit *u; @@ -876,23 +1048,25 @@ static int method_remove_snapshot(sd_bus *bus, sd_bus_message *message, void *us assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "start"); + r = mac_selinux_access_check(message, "stop", error); + if (r < 0) + return r; r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; u = manager_get_unit(m, name); if (!u) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", name); if (u->type != UNIT_SNAPSHOT) - return sd_bus_reply_method_errorf(bus, message, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not a snapshot", name); + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s is not a snapshot", name); - return bus_snapshot_method_remove(bus, message, u); + return bus_snapshot_method_remove(bus, message, u, error); } -static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; int r; @@ -900,7 +1074,15 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) { assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); + r = bus_verify_reload_daemon_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = mac_selinux_access_check(message, "reload", error); + if (r < 0) + return r; /* Instead of sending the reply back right away, we just * remember that we need to and then send it after the reload @@ -908,9 +1090,9 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) { * finished. */ assert(!m->queued_message); - r = sd_bus_message_new_method_return(bus, message, &m->queued_message); + r = sd_bus_message_new_method_return(message, &m->queued_message); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; m->queued_message_bus = sd_bus_ref(bus); m->exit_code = MANAGER_RELOAD; @@ -918,14 +1100,23 @@ static int method_reload(sd_bus *bus, sd_bus_message *message, void *userdata) { return 1; } -static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); + r = bus_verify_reload_daemon_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = mac_selinux_access_check(message, "reload", error); + if (r < 0) + return r; /* We don't send a reply back here, the client should * just wait for us disconnecting. */ @@ -934,93 +1125,108 @@ static int method_reexecute(sd_bus *bus, sd_bus_message *message, void *userdata return 1; } -static int method_exit(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_exit(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "halt"); + r = mac_selinux_access_check(message, "halt", error); + if (r < 0) + return r; if (m->running_as == SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "Exit is only supported for user service managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Exit is only supported for user service managers."); m->exit_code = MANAGER_EXIT; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_reboot(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reboot"); + r = mac_selinux_access_check(message, "reboot", error); + if (r < 0) + return r; if (m->running_as != SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "Reboot is only supported for system managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Reboot is only supported for system managers."); m->exit_code = MANAGER_REBOOT; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_poweroff(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_poweroff(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "halt"); + r = mac_selinux_access_check(message, "halt", error); + if (r < 0) + return r; if (m->running_as != SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "Powering off is only supported for system managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Powering off is only supported for system managers."); m->exit_code = MANAGER_POWEROFF; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_halt(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_halt(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "halt"); + r = mac_selinux_access_check(message, "halt", error); + if (r < 0) + return r; if (m->running_as != SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "Halt is only supported for system managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Halt is only supported for system managers."); m->exit_code = MANAGER_HALT; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_kexec(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_kexec(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; + int r; assert(bus); assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reboot"); + r = mac_selinux_access_check(message, "reboot", error); + if (r < 0) + return r; if (m->running_as != SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers."); m->exit_code = MANAGER_KEXEC; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { char *ri = NULL, *rt = NULL; const char *root, *init; Manager *m = userdata; @@ -1030,45 +1236,47 @@ static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userda assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reboot"); + r = mac_selinux_access_check(message, "reboot", error); + if (r < 0) + return r; if (m->running_as != SYSTEMD_SYSTEM) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_NOT_SUPPORTED, "KExec is only supported for system managers."); + return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Root switching is only supported by system manager."); r = sd_bus_message_read(message, "ss", &root, &init); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; if (path_equal(root, "/") || !path_is_absolute(root)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid switch root path %s", root); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid switch root path %s", root); /* Safety check */ if (isempty(init)) { - if (! path_is_os_tree(root)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Specified switch root path %s does not seem to be an OS tree. /etc/os-release is missing.", root); + if (!path_is_os_tree(root)) + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Specified switch root path %s does not seem to be an OS tree. os-release file is missing.", root); } else { _cleanup_free_ char *p = NULL; if (!path_is_absolute(init)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid init path %s", init); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid init path %s", init); p = strappend(root, init); if (!p) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; if (access(p, X_OK) < 0) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Specified init binary %s does not exist.", p); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Specified init binary %s does not exist.", p); } rt = strdup(root); if (!rt) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; if (!isempty(init)) { ri = strdup(init); if (!ri) { - free(ri); - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + free(rt); + return -ENOMEM; } } @@ -1078,10 +1286,12 @@ static int method_switch_root(sd_bus *bus, sd_bus_message *message, void *userda free(m->switch_root_init); m->switch_root_init = ri; - return sd_bus_reply_method_return(bus, message, NULL); + m->exit_code = MANAGER_SWITCH_ROOT; + + return sd_bus_reply_method_return(message, NULL); } -static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_strv_free_ char **plus = NULL; Manager *m = userdata; int r; @@ -1090,22 +1300,24 @@ static int method_set_environment(sd_bus *bus, sd_bus_message *message, void *us assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); + r = mac_selinux_access_check(message, "reload", error); + if (r < 0) + return r; r = sd_bus_message_read_strv(message, &plus); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; if (!strv_env_is_valid(plus)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments"); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments"); r = manager_environment_add(m, NULL, plus); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_strv_free_ char **minus = NULL; Manager *m = userdata; int r; @@ -1114,23 +1326,25 @@ static int method_unset_environment(sd_bus *bus, sd_bus_message *message, void * assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); + r = mac_selinux_access_check(message, "reload", error); + if (r < 0) + return r; r = sd_bus_message_read_strv(message, &minus); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; if (!strv_env_name_or_assignment_is_valid(minus)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments"); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments"); r = manager_environment_add(m, minus, NULL); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_strv_free_ char **minus = NULL, **plus = NULL; Manager *m = userdata; int r; @@ -1139,29 +1353,31 @@ static int method_unset_and_set_environment(sd_bus *bus, sd_bus_message *message assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "reload"); - - r = sd_bus_message_read_strv(message, &plus); + r = mac_selinux_access_check(message, "reload", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; r = sd_bus_message_read_strv(message, &minus); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; + + r = sd_bus_message_read_strv(message, &plus); + if (r < 0) + return r; - if (!strv_env_is_valid(plus)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments"); if (!strv_env_name_or_assignment_is_valid(minus)) - return sd_bus_reply_method_errorf(bus, message, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments"); + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment variable names or assignments"); + if (!strv_env_is_valid(plus)) + return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid environment assignments"); r = manager_environment_add(m, minus, plus); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - return sd_bus_reply_method_return(bus, message, NULL); + return sd_bus_reply_method_return(message, NULL); } -static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; Manager *m = userdata; UnitFileList *item; @@ -1173,42 +1389,40 @@ static int method_list_unit_files(sd_bus *bus, sd_bus_message *message, void *us assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ - r = sd_bus_message_new_method_return(bus, message, &reply); + r = mac_selinux_access_check(message, "status", error); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; + + r = sd_bus_message_new_method_return(message, &reply); + if (r < 0) + return r; - h = hashmap_new(string_hash_func, string_compare_func); + h = hashmap_new(&string_hash_ops); if (!h) - return sd_bus_reply_method_errno(bus, message, ENOMEM, NULL); + return -ENOMEM; r = unit_file_get_list(m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER, NULL, h); - if (r < 0) { - r = sd_bus_reply_method_errno(bus, message, r, NULL); + if (r < 0) goto fail; - } r = sd_bus_message_open_container(reply, 'a', "(ss)"); - if (r < 0) { - r = sd_bus_reply_method_errno(bus, message, r, NULL); + if (r < 0) goto fail; - } HASHMAP_FOREACH(item, h, i) { r = sd_bus_message_append(reply, "(ss)", item->path, unit_file_state_to_string(item->state)); - if (r < 0) { - r = sd_bus_reply_method_errno(bus, message, r, NULL); + if (r < 0) goto fail; - } } unit_file_list_free(h); r = sd_bus_message_close_container(reply); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; return sd_bus_send(bus, reply, NULL); @@ -1217,7 +1431,7 @@ fail: return r; } -static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *name; UnitFileState state; @@ -1228,22 +1442,26 @@ static int method_get_unit_file_state(sd_bus *bus, sd_bus_message *message, void assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ + + r = mac_selinux_access_check(message, "status", error); + if (r < 0) + return r; r = sd_bus_message_read(message, "s", &name); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; state = unit_file_get_state(scope, NULL, name); if (state < 0) - return sd_bus_reply_method_errno(bus, message, state, NULL); + return state; - return sd_bus_reply_method_return(bus, message, "s", unit_file_state_to_string(state)); + return sd_bus_reply_method_return(message, "s", unit_file_state_to_string(state)); } -static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { _cleanup_free_ char *default_target = NULL; Manager *m = userdata; UnitFileScope scope; @@ -1253,28 +1471,32 @@ static int method_get_default_target(sd_bus *bus, sd_bus_message *message, void assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "status"); + /* Anyone can call this method */ + + r = mac_selinux_access_check(message, "status", error); + if (r < 0) + return r; scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; r = unit_file_get_default(scope, NULL, &default_target); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; - return sd_bus_reply_method_return(bus, message, "s", default_target); + return sd_bus_reply_method_return(message, "s", default_target); } -static int send_unit_files_changed(sd_bus *bus, const char *destination, void *userdata) { +static int send_unit_files_changed(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *message = NULL; int r; assert(bus); - r = sd_bus_message_new_signal(bus, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "UnitFilesChanged", &message); + r = sd_bus_message_new_signal(bus, &message, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "UnitFilesChanged"); if (r < 0) return r; - return sd_bus_send_to(bus, message, destination, NULL); + return sd_bus_send(bus, message, NULL); } static int reply_unit_file_changes_and_free( @@ -1289,10 +1511,13 @@ static int reply_unit_file_changes_and_free( unsigned i; int r; - if (n_changes > 0) - bus_manager_foreach_client(m, send_unit_files_changed, NULL); + if (n_changes > 0) { + r = bus_foreach_bus(m, NULL, send_unit_files_changed, NULL); + if (r < 0) + log_debug_errno(-r, "Failed to send UnitFilesChanged signal: %m"); + } - r = sd_bus_message_new_method_return(bus, message, &reply); + r = sd_bus_message_new_method_return(message, &reply); if (r < 0) goto fail; @@ -1308,7 +1533,7 @@ static int reply_unit_file_changes_and_free( for (i = 0; i < n_changes; i++) { r = sd_bus_message_append( - message, "(sss)", + reply, "(sss)", unit_file_change_type_to_string(changes[i].type), changes[i].path, changes[i].source); @@ -1320,20 +1545,21 @@ static int reply_unit_file_changes_and_free( if (r < 0) goto fail; - return sd_bus_send(bus, message, NULL); + return sd_bus_send(bus, reply, NULL); fail: unit_file_changes_free(changes, n_changes); - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; } static int method_enable_unit_files_generic( sd_bus *bus, sd_bus_message *message, - Manager *m, const - char *verb, + Manager *m, + const char *verb, int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], bool force, UnitFileChange **changes, unsigned *n_changes), - bool carries_install_info) { + bool carries_install_info, + sd_bus_error *error) { _cleanup_strv_free_ char **l = NULL; UnitFileChange *changes = NULL; @@ -1345,43 +1571,105 @@ static int method_enable_unit_files_generic( assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, verb); + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ r = sd_bus_message_read_strv(message, &l); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; r = sd_bus_message_read(message, "bb", &runtime, &force); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; + + r = mac_selinux_unit_access_check_strv(l, message, m, verb, error); + if (r < 0) + return r; scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; r = call(scope, runtime, NULL, l, force, &changes, &n_changes); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; return reply_unit_file_changes_and_free(m, bus, message, carries_install_info ? r : -1, changes, n_changes); } -static int method_enable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_enable, true); +static int method_enable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_enable, true, error); } -static int method_reenable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_reenable, true); +static int method_reenable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_reenable, true, error); } -static int method_link_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_link, false); +static int method_link_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_link, false, error); } -static int method_preset_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_preset, true); +static int unit_file_preset_without_mode(UnitFileScope scope, bool runtime, const char *root_dir, char **files, bool force, UnitFileChange **changes, unsigned *n_changes) { + return unit_file_preset(scope, runtime, root_dir, files, UNIT_FILE_PRESET_FULL, force, changes, n_changes); } -static int method_mask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_enable_unit_files_generic(bus, message, userdata, "disable", unit_file_mask, false); +static int method_preset_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_enable_unit_files_generic(bus, message, userdata, "enable", unit_file_preset_without_mode, true, error); +} + +static int method_mask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_enable_unit_files_generic(bus, message, userdata, "disable", unit_file_mask, false, error); +} + +static int method_preset_unit_files_with_mode(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + + _cleanup_strv_free_ char **l = NULL; + UnitFileChange *changes = NULL; + unsigned n_changes = 0; + Manager *m = userdata; + UnitFilePresetMode mm; + UnitFileScope scope; + int runtime, force, r; + const char *mode; + + assert(bus); + assert(message); + assert(m); + + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = sd_bus_message_read_strv(message, &l); + if (r < 0) + return r; + + r = sd_bus_message_read(message, "sbb", &mode, &runtime, &force); + if (r < 0) + return r; + + if (isempty(mode)) + mm = UNIT_FILE_PRESET_FULL; + else { + mm = unit_file_preset_mode_from_string(mode); + if (mm < 0) + return -EINVAL; + } + + r = mac_selinux_unit_access_check_strv(l, message, m, "enable", error); + if (r < 0) + return r; + + scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; + + r = unit_file_preset(scope, runtime, NULL, l, mm, force, &changes, &n_changes); + if (r < 0) + return r; + + return reply_unit_file_changes_and_free(m, bus, message, r, changes, n_changes); } static int method_disable_unit_files_generic( @@ -1389,7 +1677,8 @@ static int method_disable_unit_files_generic( sd_bus_message *message, Manager *m, const char *verb, - int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], UnitFileChange **changes, unsigned *n_changes)) { + int (*call)(UnitFileScope scope, bool runtime, const char *root_dir, char *files[], UnitFileChange **changes, unsigned *n_changes), + sd_bus_error *error) { _cleanup_strv_free_ char **l = NULL; UnitFileChange *changes = NULL; @@ -1401,34 +1690,42 @@ static int method_disable_unit_files_generic( assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, verb); + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = mac_selinux_access_check(message, verb, error); + if (r < 0) + return r; r = sd_bus_message_read_strv(message, &l); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; r = sd_bus_message_read(message, "b", &runtime); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; r = call(scope, runtime, NULL, l, &changes, &n_changes); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes); } -static int method_disable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_disable_unit_files_generic(bus, message, userdata, "disable", unit_file_disable); +static int method_disable_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_disable_unit_files_generic(bus, message, userdata, "disable", unit_file_disable, error); } -static int method_unmask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata) { - return method_disable_unit_files_generic(bus, message, userdata, "enable", unit_file_unmask); +static int method_unmask_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + return method_disable_unit_files_generic(bus, message, userdata, "enable", unit_file_unmask, error); } -static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void *userdata) { +static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { UnitFileChange *changes = NULL; unsigned n_changes = 0; Manager *m = userdata; @@ -1440,17 +1737,115 @@ static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void assert(message); assert(m); - SELINUX_ACCESS_CHECK(bus, message, "enable"); + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = mac_selinux_access_check(message, "enable", error); + if (r < 0) + return r; r = sd_bus_message_read(message, "sb", &name, &force); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; r = unit_file_set_default(scope, NULL, name, force, &changes, &n_changes); if (r < 0) - return sd_bus_reply_method_errno(bus, message, r, NULL); + return r; + + return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes); +} + +static int method_preset_all_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + UnitFileChange *changes = NULL; + unsigned n_changes = 0; + Manager *m = userdata; + UnitFilePresetMode mm; + UnitFileScope scope; + const char *mode; + int force, runtime, r; + + assert(bus); + assert(message); + assert(m); + + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = mac_selinux_access_check(message, "enable", error); + if (r < 0) + return r; + + r = sd_bus_message_read(message, "sbb", &mode, &runtime, &force); + if (r < 0) + return r; + + if (isempty(mode)) + mm = UNIT_FILE_PRESET_FULL; + else { + mm = unit_file_preset_mode_from_string(mode); + if (mm < 0) + return -EINVAL; + } + + scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; + + r = unit_file_preset_all(scope, runtime, NULL, mm, force, &changes, &n_changes); + if (r < 0) + return r; + + return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes); +} + +static int method_add_dependency_unit_files(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + _cleanup_strv_free_ char **l = NULL; + Manager *m = userdata; + UnitFileChange *changes = NULL; + unsigned n_changes = 0; + UnitFileScope scope; + int runtime, force, r; + char *target; + char *type; + UnitDependency dep; + + assert(bus); + assert(message); + assert(m); + + r = bus_verify_manage_unit_files_async(m, message, error); + if (r < 0) + return r; + if (r == 0) + return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ + + r = sd_bus_message_read_strv(message, &l); + if (r < 0) + return r; + + r = sd_bus_message_read(message, "ssbb", &target, &type, &runtime, &force); + if (r < 0) + return r; + + dep = unit_dependency_from_string(type); + if (dep < 0) + return -EINVAL; + + r = mac_selinux_unit_access_check_strv(l, message, m, "enable", error); + if (r < 0) + return r; + + scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER; + + r = unit_file_add_dependency(scope, runtime, NULL, l, target, dep, force, &changes, &n_changes); + if (r < 0) + return r; return reply_unit_file_changes_and_free(m, bus, message, -1, changes, n_changes); } @@ -1458,86 +1853,94 @@ static int method_set_default_target(sd_bus *bus, sd_bus_message *message, void const sd_bus_vtable bus_manager_vtable[] = { SD_BUS_VTABLE_START(0), - SD_BUS_PROPERTY("Version", "s", property_get_version, 0, 0), - SD_BUS_PROPERTY("Features", "s", property_get_features, 0, 0), - SD_BUS_PROPERTY("Virtualization", "s", property_get_virtualization, 0, 0), - SD_BUS_PROPERTY("Tainted", "s", property_get_tainted, 0, 0), - BUS_PROPERTY_DUAL_TIMESTAMP("FirmwareTimestamp", offsetof(Manager, firmware_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("LoaderTimestamp", offsetof(Manager, loader_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("KernelTimestamp", offsetof(Manager, firmware_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("InitRDTimestamp", offsetof(Manager, initrd_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("UserspaceTimestamp", offsetof(Manager, userspace_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("FinishTimestamp", offsetof(Manager, finish_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("SecurityStartTimestamp", offsetof(Manager, security_start_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("SecurityFinishTimestamp", offsetof(Manager, security_finish_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("GeneratorsStartTimestamp", offsetof(Manager, generators_start_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("GeneratorsFinishTimestamp", offsetof(Manager, generators_finish_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("UnitsLoadStartTimestamp", offsetof(Manager, units_load_start_timestamp), 0), - BUS_PROPERTY_DUAL_TIMESTAMP("UnitsLoadFinishTimestamp", offsetof(Manager, units_load_finish_timestamp), 0), + SD_BUS_PROPERTY("Version", "s", property_get_version, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Features", "s", property_get_features, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Virtualization", "s", property_get_virtualization, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Architecture", "s", property_get_architecture, 0, SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("Tainted", "s", property_get_tainted, 0, SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("FirmwareTimestamp", offsetof(Manager, firmware_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("LoaderTimestamp", offsetof(Manager, loader_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("KernelTimestamp", offsetof(Manager, kernel_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("InitRDTimestamp", offsetof(Manager, initrd_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("UserspaceTimestamp", offsetof(Manager, userspace_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("FinishTimestamp", offsetof(Manager, finish_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("SecurityStartTimestamp", offsetof(Manager, security_start_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("SecurityFinishTimestamp", offsetof(Manager, security_finish_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("GeneratorsStartTimestamp", offsetof(Manager, generators_start_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("GeneratorsFinishTimestamp", offsetof(Manager, generators_finish_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("UnitsLoadStartTimestamp", offsetof(Manager, units_load_start_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), + BUS_PROPERTY_DUAL_TIMESTAMP("UnitsLoadFinishTimestamp", offsetof(Manager, units_load_finish_timestamp), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_WRITABLE_PROPERTY("LogLevel", "s", property_get_log_level, property_set_log_level, 0, 0), SD_BUS_WRITABLE_PROPERTY("LogTarget", "s", property_get_log_target, property_set_log_target, 0, 0), SD_BUS_PROPERTY("NNames", "u", property_get_n_names, 0, 0), + SD_BUS_PROPERTY("NFailedUnits", "u", property_get_n_failed_units, 0, 0), SD_BUS_PROPERTY("NJobs", "u", property_get_n_jobs, 0, 0), SD_BUS_PROPERTY("NInstalledJobs", "u", bus_property_get_unsigned, offsetof(Manager, n_installed_jobs), 0), SD_BUS_PROPERTY("NFailedJobs", "u", bus_property_get_unsigned, offsetof(Manager, n_failed_jobs), 0), SD_BUS_PROPERTY("Progress", "d", property_get_progress, 0, 0), SD_BUS_PROPERTY("Environment", "as", NULL, offsetof(Manager, environment), 0), - SD_BUS_PROPERTY("ConfirmSpawn", "b", bus_property_get_bool, offsetof(Manager, confirm_spawn), 0), - SD_BUS_PROPERTY("ShowStatus", "b", bus_property_get_bool, offsetof(Manager, show_status), 0), - SD_BUS_PROPERTY("UnitPath", "as", NULL, offsetof(Manager, lookup_paths.unit_path), 0), - SD_BUS_PROPERTY("DefaultStandardOutput", "s", bus_property_get_exec_output, offsetof(Manager, default_std_output), 0), - SD_BUS_PROPERTY("DefaultStandardError", "s", bus_property_get_exec_output, offsetof(Manager, default_std_output), 0), + SD_BUS_PROPERTY("ConfirmSpawn", "b", bus_property_get_bool, offsetof(Manager, confirm_spawn), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("ShowStatus", "b", bus_property_get_bool, offsetof(Manager, show_status), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("UnitPath", "as", NULL, offsetof(Manager, lookup_paths.unit_path), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("DefaultStandardOutput", "s", bus_property_get_exec_output, offsetof(Manager, default_std_output), SD_BUS_VTABLE_PROPERTY_CONST), + SD_BUS_PROPERTY("DefaultStandardError", "s", bus_property_get_exec_output, offsetof(Manager, default_std_output), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_WRITABLE_PROPERTY("RuntimeWatchdogUSec", "t", bus_property_get_usec, property_set_runtime_watchdog, offsetof(Manager, runtime_watchdog), 0), SD_BUS_WRITABLE_PROPERTY("ShutdownWatchdogUSec", "t", bus_property_get_usec, bus_property_set_usec, offsetof(Manager, shutdown_watchdog), 0), - - SD_BUS_METHOD("GetUnit", "s", "o", method_get_unit, 0), - SD_BUS_METHOD("GetUnitByPID", "u", "o", method_get_unit_by_pid, 0), - SD_BUS_METHOD("LoadUnit", "s", "o", method_load_unit, 0), - SD_BUS_METHOD("StartUnit", "ss", "o", method_start_unit, 0), - SD_BUS_METHOD("StartUnitReplace", "sss", "o", method_start_unit_replace, 0), - SD_BUS_METHOD("StopUnit", "ss", "o", method_stop_unit, 0), - SD_BUS_METHOD("ReloadUnit", "ss", "o", method_reload_unit, 0), - SD_BUS_METHOD("RestartUnit", "ss", "o", method_restart_unit, 0), - SD_BUS_METHOD("TryRestartUnit", "ss", "o", method_try_restart_unit, 0), - SD_BUS_METHOD("ReloadOrRestartUnit", "ss", "o", method_reload_or_restart_unit, 0), - SD_BUS_METHOD("ReloadOrTryRestartUnit", "ss", "o", method_reload_or_try_restart_unit, 0), - SD_BUS_METHOD("KillUnit", "ssi", NULL, method_kill_unit, 0), - SD_BUS_METHOD("ResetFailedUnit", "s", NULL, method_reset_failed_unit, 0), - SD_BUS_METHOD("SetUnitProperties", "sb", "a(sv)", method_set_unit_properties, 0), - SD_BUS_METHOD("StartTransientUnit", "ssa(sv)a(sa(sv))", "o", method_start_transient_unit, 0), - SD_BUS_METHOD("GetJob", "u", "o", method_get_job, 0), - SD_BUS_METHOD("CancelJob", "u", NULL, method_cancel_job, 0), + SD_BUS_PROPERTY("ControlGroup", "s", NULL, offsetof(Manager, cgroup_root), 0), + SD_BUS_PROPERTY("SystemState", "s", property_get_system_state, 0, 0), + + SD_BUS_METHOD("GetUnit", "s", "o", method_get_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("GetUnitByPID", "u", "o", method_get_unit_by_pid, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("LoadUnit", "s", "o", method_load_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("StartUnit", "ss", "o", method_start_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("StartUnitReplace", "sss", "o", method_start_unit_replace, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("StopUnit", "ss", "o", method_stop_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ReloadUnit", "ss", "o", method_reload_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("RestartUnit", "ss", "o", method_restart_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("TryRestartUnit", "ss", "o", method_try_restart_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ReloadOrRestartUnit", "ss", "o", method_reload_or_restart_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ReloadOrTryRestartUnit", "ss", "o", method_reload_or_try_restart_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("KillUnit", "ssi", NULL, method_kill_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ResetFailedUnit", "s", NULL, method_reset_failed_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("SetUnitProperties", "sba(sv)", NULL, method_set_unit_properties, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("StartTransientUnit", "ssa(sv)a(sa(sv))", "o", method_start_transient_unit, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("GetJob", "u", "o", method_get_job, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CancelJob", "u", NULL, method_cancel_job, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("ClearJobs", NULL, NULL, method_clear_jobs, 0), SD_BUS_METHOD("ResetFailed", NULL, NULL, method_reset_failed, 0), - SD_BUS_METHOD("ListUnits", NULL, "a(ssssssouso)", method_list_units, 0), - SD_BUS_METHOD("ListJobs", NULL, "a(usssoo)", method_list_jobs, 0), - SD_BUS_METHOD("Subscribe", NULL, NULL, method_subscribe, 0), - SD_BUS_METHOD("Unsubscribe", NULL, NULL, method_unsubscribe, 0), - SD_BUS_METHOD("Dump", NULL, "s", method_dump, 0), + SD_BUS_METHOD("ListUnits", NULL, "a(ssssssouso)", method_list_units, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ListUnitsFiltered", "as", "a(ssssssouso)", method_list_units_filtered, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ListJobs", NULL, "a(usssoo)", method_list_jobs, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Subscribe", NULL, NULL, method_subscribe, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Unsubscribe", NULL, NULL, method_unsubscribe, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Dump", NULL, "s", method_dump, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("CreateSnapshot", "sb", "o", method_create_snapshot, 0), SD_BUS_METHOD("RemoveSnapshot", "s", NULL, method_remove_snapshot, 0), - SD_BUS_METHOD("Reload", NULL, NULL, method_reload, 0), - SD_BUS_METHOD("Reexecute", NULL, NULL, method_reexecute, 0), + SD_BUS_METHOD("Reload", NULL, NULL, method_reload, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Reexecute", NULL, NULL, method_reexecute, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("Exit", NULL, NULL, method_exit, 0), - SD_BUS_METHOD("Reboot", NULL, NULL, method_reboot, 0), - SD_BUS_METHOD("PowerOff", NULL, NULL, method_poweroff, 0), - SD_BUS_METHOD("Halt", NULL, NULL, method_halt, 0), - SD_BUS_METHOD("KExec", NULL, NULL, method_kexec, 0), - SD_BUS_METHOD("SwitchRoot", "ss", NULL, method_switch_root, 0), + SD_BUS_METHOD("Reboot", NULL, NULL, method_reboot, SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)), + SD_BUS_METHOD("PowerOff", NULL, NULL, method_poweroff, SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)), + SD_BUS_METHOD("Halt", NULL, NULL, method_halt, SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)), + SD_BUS_METHOD("KExec", NULL, NULL, method_kexec, SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)), + SD_BUS_METHOD("SwitchRoot", "ss", NULL, method_switch_root, SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)), SD_BUS_METHOD("SetEnvironment", "as", NULL, method_set_environment, 0), SD_BUS_METHOD("UnsetEnvironment", "as", NULL, method_unset_environment, 0), SD_BUS_METHOD("UnsetAndSetEnvironment", "asas", NULL, method_unset_and_set_environment, 0), - SD_BUS_METHOD("ListUnitFiles", NULL, "a(ss)", method_list_unit_files, 0), - SD_BUS_METHOD("GetUnitFileState", "s", "s", method_get_unit_file_state, 0), - SD_BUS_METHOD("EnableUnitFiles", "asbb", "ba(sss)", method_enable_unit_files, 0), - SD_BUS_METHOD("DisableUnitFiles", "asb", "a(sss)", method_disable_unit_files, 0), - SD_BUS_METHOD("ReenableUnitFiles", "asbb", "ba(sss)", method_reenable_unit_files, 0), - SD_BUS_METHOD("LinkUnitFiles", "asbb", "a(sss)", method_link_unit_files, 0), - SD_BUS_METHOD("PresetUnitFiles", "asbb", "ba(sss)", method_preset_unit_files, 0), - SD_BUS_METHOD("MaskUnitFiles", "asbb", "a(sss)", method_mask_unit_files, 0), - SD_BUS_METHOD("UnmaskUnitFiles", "asb", "a(sss)", method_unmask_unit_files, 0), - SD_BUS_METHOD("SetDefaultTarget", "sb", "a(sss)", method_set_default_target, 0), - SD_BUS_METHOD("GetDefaultTarget", NULL, "s", method_get_default_target, 0), + SD_BUS_METHOD("ListUnitFiles", NULL, "a(ss)", method_list_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("GetUnitFileState", "s", "s", method_get_unit_file_state, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("EnableUnitFiles", "asbb", "ba(sss)", method_enable_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("DisableUnitFiles", "asb", "a(sss)", method_disable_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("ReenableUnitFiles", "asbb", "ba(sss)", method_reenable_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("LinkUnitFiles", "asbb", "a(sss)", method_link_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("PresetUnitFiles", "asbb", "ba(sss)", method_preset_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("PresetUnitFilesWithMode", "assbb", "ba(sss)", method_preset_unit_files_with_mode, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("MaskUnitFiles", "asbb", "a(sss)", method_mask_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("UnmaskUnitFiles", "asb", "a(sss)", method_unmask_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("SetDefaultTarget", "sb", "a(sss)", method_set_default_target, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("GetDefaultTarget", NULL, "s", method_get_default_target, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("PresetAllUnitFiles", "sbb", "a(sss)", method_preset_all_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("AddDependencyUnitFiles", "asssbb", "a(sss)", method_add_dependency_unit_files, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_SIGNAL("UnitNew", "so", 0), SD_BUS_SIGNAL("UnitRemoved", "so", 0), @@ -1550,36 +1953,7 @@ const sd_bus_vtable bus_manager_vtable[] = { SD_BUS_VTABLE_END }; -int bus_manager_foreach_client(Manager *m, int (*send_message)(sd_bus *bus, const char *destination, void *userdata), void *userdata) { - Iterator i; - sd_bus *b; - unsigned n; - int r; - - n = set_size(m->subscribed); - if (n <= 0) - return 0; - if (n == 1) { - BusTrackedClient *d; - - assert_se(d = set_first(m->subscribed)); - return send_message(d->bus, isempty(d->name) ? NULL : d->name, userdata); - } - - /* Send to everybody */ - SET_FOREACH(b, m->private_buses, i) { - r = send_message(b, NULL, userdata); - if (r < 0) - return r; - } - - if (m->api_bus) - return send_message(m->api_bus, NULL, userdata); - - return 0; -} - -static int send_finished(sd_bus *bus, const char *destination, void *userdata) { +static int send_finished(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *message = NULL; usec_t *times = userdata; int r; @@ -1587,7 +1961,7 @@ static int send_finished(sd_bus *bus, const char *destination, void *userdata) { assert(bus); assert(times); - r = sd_bus_message_new_signal(bus, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "StartupFinished", &message); + r = sd_bus_message_new_signal(bus, &message, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "StartupFinished"); if (r < 0) return r; @@ -1595,10 +1969,10 @@ static int send_finished(sd_bus *bus, const char *destination, void *userdata) { if (r < 0) return r; - return sd_bus_send_to(bus, message, destination, NULL); + return sd_bus_send(bus, message, NULL); } -int bus_manager_send_finished( +void bus_manager_send_finished( Manager *m, usec_t firmware_usec, usec_t loader_usec, @@ -1607,19 +1981,33 @@ int bus_manager_send_finished( usec_t userspace_usec, usec_t total_usec) { + int r; + assert(m); - return bus_manager_foreach_client(m, send_finished, - (usec_t[6]) { firmware_usec, loader_usec, kernel_usec, initrd_usec, userspace_usec, total_usec }); + r = bus_foreach_bus( + m, + NULL, + send_finished, + (usec_t[6]) { + firmware_usec, + loader_usec, + kernel_usec, + initrd_usec, + userspace_usec, + total_usec + }); + if (r < 0) + log_debug_errno(-r, "Failed to send finished signal: %m"); } -static int send_reloading(sd_bus *bus, const char *destination, void *userdata) { +static int send_reloading(sd_bus *bus, void *userdata) { _cleanup_bus_message_unref_ sd_bus_message *message = NULL; int r; assert(bus); - r = sd_bus_message_new_signal(bus, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "Reloading", &message); + r = sd_bus_message_new_signal(bus, &message, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "Reloading"); if (r < 0) return r; @@ -1627,11 +2015,16 @@ static int send_reloading(sd_bus *bus, const char *destination, void *userdata) if (r < 0) return r; - return sd_bus_send_to(bus, message, destination, NULL); + return sd_bus_send(bus, message, NULL); } -int bus_manager_send_reloading(Manager *m, bool active) { +void bus_manager_send_reloading(Manager *m, bool active) { + int r; + assert(m); - return bus_manager_foreach_client(m, send_reloading, INT_TO_PTR(active)); + r = bus_foreach_bus(m, NULL, send_reloading, INT_TO_PTR(active)); + if (r < 0) + log_debug_errno(-r, "Failed to send reloading signal: %m"); + }