X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=src%2Fcore%2Fdbus.c;h=e000cccd1110cd16d221179fb95c4c4adbaba54f;hp=e7eee3c6d1ef3c132df824a9851fefdb96f7ae21;hb=39881ed299a39ad331262c75d9e627e6ffb848eb;hpb=283868e1dcd8ea7475850d9c6e7d4722c473dd50 diff --git a/src/core/dbus.c b/src/core/dbus.c index e7eee3c6d..e000cccd1 100644 --- a/src/core/dbus.c +++ b/src/core/dbus.c @@ -20,7 +20,6 @@ ***/ #include -#include #include #include @@ -39,12 +38,12 @@ #include "dbus.h" #include "bus-util.h" #include "bus-error.h" -#include "bus-errors.h" +#include "bus-common-errors.h" #include "strxcpyx.h" #include "bus-internal.h" #include "selinux-access.h" -#define CONNECTIONS_MAX 512 +#define CONNECTIONS_MAX 4096 static void destroy_bus(Manager *m, sd_bus **bus); @@ -64,7 +63,7 @@ int bus_send_queued_message(Manager *m) { r = sd_bus_send(m->queued_message_bus, m->queued_message, NULL); if (r < 0) - log_warning("Failed to send queued message: %s", strerror(-r)); + log_warning_errno(r, "Failed to send queued message: %m"); m->queued_message = sd_bus_message_unref(m->queued_message); m->queued_message_bus = sd_bus_unref(m->queued_message_bus); @@ -89,15 +88,19 @@ static int signal_agent_released(sd_bus *bus, sd_bus_message *message, void *use manager_notify_cgroup_empty(m, cgroup); - if (m->running_as == SYSTEMD_SYSTEM && m->system_bus) { - /* If we are running as system manager, forward the - * message to the system bus */ + /* only forward to system bus if running as system instance */ + if (m->running_as != SYSTEMD_SYSTEM || !m->system_bus) + return 0; - r = sd_bus_send(m->system_bus, message, NULL); - if (r < 0) - log_warning("Failed to forward Released message: %s", strerror(-r)); - } + r = sd_bus_message_rewind(message, 1); + if (r < 0) + goto exit; + + r = sd_bus_send(m->system_bus, message, NULL); +exit: + if (r < 0) + log_warning_errno(r, "Failed to forward Released message: %m"); return 0; } @@ -202,16 +205,14 @@ failed: } r = sd_bus_send_to(bus, reply, "org.freedesktop.DBus", NULL); - if (r < 0) { - log_error("Failed to respond with to bus activation request: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to respond with to bus activation request: %m"); return 0; } #ifdef HAVE_SELINUX -static int selinux_filter(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { +static int mac_selinux_filter(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; const char *verb, *path; Unit *u = NULL; @@ -239,7 +240,7 @@ static int selinux_filter(sd_bus *bus, sd_bus_message *message, void *userdata, if (object_path_startswith("/org/freedesktop/systemd1", path)) { - r = selinux_access_check(message, verb, error); + r = mac_selinux_access_check(message, verb, error); if (r < 0) return r; @@ -270,7 +271,7 @@ static int selinux_filter(sd_bus *bus, sd_bus_message *message, void *userdata, if (!u) return 0; - r = selinux_unit_access_check(u, message, verb, error); + r = mac_selinux_unit_access_check(u, message, verb, error); if (r < 0) return r; @@ -536,78 +537,56 @@ static int bus_setup_api_vtables(Manager *m, sd_bus *bus) { assert(bus); #ifdef HAVE_SELINUX - r = sd_bus_add_filter(bus, NULL, selinux_filter, m); - if (r < 0) { - log_error("Failed to add SELinux access filter: %s", strerror(-r)); - return r; - } + r = sd_bus_add_filter(bus, NULL, mac_selinux_filter, m); + if (r < 0) + return log_error_errno(r, "Failed to add SELinux access filter: %m"); #endif r = sd_bus_add_object_vtable(bus, NULL, "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", bus_manager_vtable, m); - if (r < 0) { - log_error("Failed to register Manager vtable: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register Manager vtable: %m"); r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/job", "org.freedesktop.systemd1.Job", bus_job_vtable, bus_job_find, m); - if (r < 0) { - log_error("Failed to register Job vtable: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register Job vtable: %m"); r = sd_bus_add_node_enumerator(bus, NULL, "/org/freedesktop/systemd1/job", bus_job_enumerate, m); - if (r < 0) { - log_error("Failed to add job enumerator: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to add job enumerator: %m"); r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", "org.freedesktop.systemd1.Unit", bus_unit_vtable, bus_unit_find, m); - if (r < 0) { - log_error("Failed to register Unit vtable: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register Unit vtable: %m"); r = sd_bus_add_node_enumerator(bus, NULL, "/org/freedesktop/systemd1/unit", bus_unit_enumerate, m); - if (r < 0) { - log_error("Failed to add job enumerator: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to add job enumerator: %m"); for (t = 0; t < _UNIT_TYPE_MAX; t++) { r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", unit_vtable[t]->bus_interface, unit_vtable[t]->bus_vtable, bus_unit_interface_find, m); - if (r < 0) { - log_error("Failed to register type specific vtable for %s: %s", unit_vtable[t]->bus_interface, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register type specific vtable for %s: %m", unit_vtable[t]->bus_interface); if (unit_vtable[t]->cgroup_context_offset > 0) { r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", unit_vtable[t]->bus_interface, bus_unit_cgroup_vtable, bus_unit_cgroup_find, m); - if (r < 0) { - log_error("Failed to register control group unit vtable for %s: %s", unit_vtable[t]->bus_interface, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register control group unit vtable for %s: %m", unit_vtable[t]->bus_interface); r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", unit_vtable[t]->bus_interface, bus_cgroup_vtable, bus_cgroup_context_find, m); - if (r < 0) { - log_error("Failed to register control group vtable for %s: %s", unit_vtable[t]->bus_interface, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register control group vtable for %s: %m", unit_vtable[t]->bus_interface); } if (unit_vtable[t]->exec_context_offset > 0) { r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", unit_vtable[t]->bus_interface, bus_exec_vtable, bus_exec_context_find, m); - if (r < 0) { - log_error("Failed to register execute vtable for %s: %s", unit_vtable[t]->bus_interface, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register execute vtable for %s: %m", unit_vtable[t]->bus_interface); } if (unit_vtable[t]->kill_context_offset > 0) { r = sd_bus_add_fallback_vtable(bus, NULL, "/org/freedesktop/systemd1/unit", unit_vtable[t]->bus_interface, bus_kill_vtable, bus_kill_context_find, m); - if (r < 0) { - log_error("Failed to register kill vtable for %s: %s", unit_vtable[t]->bus_interface, strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register kill vtable for %s: %m", unit_vtable[t]->bus_interface); } } @@ -630,10 +609,8 @@ static int bus_setup_disconnected_match(Manager *m, sd_bus *bus) { "member='Disconnected'", signal_disconnected, m); - if (r < 0) { - log_error("Failed to register match for Disconnected message: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register match for Disconnected message: %m"); return 0; } @@ -650,7 +627,7 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void nfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC); if (nfd < 0) { - log_warning("Failed to accept private connection, ignoring: %m"); + log_warning_errno(errno, "Failed to accept private connection, ignoring: %m"); return 0; } @@ -659,7 +636,7 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void return 0; } - r = set_ensure_allocated(&m->private_buses, trivial_hash_func, trivial_compare_func); + r = set_ensure_allocated(&m->private_buses, NULL); if (r < 0) { log_oom(); return 0; @@ -667,13 +644,13 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void r = sd_bus_new(&bus); if (r < 0) { - log_warning("Failed to allocate new private connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to allocate new private connection bus: %m"); return 0; } r = sd_bus_set_fd(bus, nfd, nfd); if (r < 0) { - log_warning("Failed to set fd on new connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to set fd on new connection bus: %m"); return 0; } @@ -681,7 +658,7 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void r = bus_check_peercred(bus); if (r < 0) { - log_warning("Incoming private connection from unprivileged client, refusing: %s", strerror(-r)); + log_warning_errno(r, "Incoming private connection from unprivileged client, refusing: %m"); return 0; } @@ -689,19 +666,19 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void r = sd_bus_set_server(bus, 1, id); if (r < 0) { - log_warning("Failed to enable server support for new connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to enable server support for new connection bus: %m"); return 0; } r = sd_bus_start(bus); if (r < 0) { - log_warning("Failed to start new connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to start new connection bus: %m"); return 0; } r = sd_bus_attach_event(bus, m->event, SD_EVENT_PRIORITY_NORMAL); if (r < 0) { - log_warning("Failed to attach new connection bus to event loop: %s", strerror(-r)); + log_warning_errno(r, "Failed to attach new connection bus to event loop: %m"); return 0; } @@ -719,7 +696,7 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void signal_agent_released, m); if (r < 0) { - log_warning("Failed to register Released match on new connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to register Released match on new connection bus: %m"); return 0; } } @@ -730,13 +707,13 @@ static int bus_on_connection(sd_event_source *s, int fd, uint32_t revents, void r = bus_setup_api_vtables(m, bus); if (r < 0) { - log_warning("Failed to set up API vtables on new connection bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to set up API vtables on new connection bus: %m"); return 0; } r = set_put(m->private_buses, bus); if (r < 0) { - log_warning("Failed to add new conenction bus to set: %s", strerror(-r)); + log_warning_errno(r, "Failed to add new conenction bus to set: %m"); return 0; } @@ -756,10 +733,8 @@ static int bus_list_names(Manager *m, sd_bus *bus) { assert(bus); r = sd_bus_list_names(bus, &names, NULL); - if (r < 0) { - log_error("Failed to get initial list of names: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to get initial list of names: %m"); /* This is a bit hacky, we say the owner of the name is the * name itself, because we don't want the extra traffic to @@ -776,6 +751,14 @@ static int bus_setup_api(Manager *m, sd_bus *bus) { assert(m); assert(bus); + /* Let's make sure we have enough credential bits so that we can make security and selinux decisions */ + r = sd_bus_negotiate_creds(bus, 1, + SD_BUS_CREDS_PID|SD_BUS_CREDS_UID| + SD_BUS_CREDS_EUID|SD_BUS_CREDS_EFFECTIVE_CAPS| + SD_BUS_CREDS_SELINUX_CONTEXT); + if (r < 0) + log_warning_errno(r, "Failed to enable credential passing, ignoring: %m"); + r = bus_setup_api_vtables(m, bus); if (r < 0) return r; @@ -790,7 +773,7 @@ static int bus_setup_api(Manager *m, sd_bus *bus) { "member='NameOwnerChanged'", signal_name_owner_changed, m); if (r < 0) - log_warning("Failed to subscribe to NameOwnerChanged signal: %s", strerror(-r)); + log_warning_errno(r, "Failed to subscribe to NameOwnerChanged signal: %m"); r = sd_bus_add_match( bus, @@ -802,7 +785,7 @@ static int bus_setup_api(Manager *m, sd_bus *bus) { "member='ActivationRequest'", signal_activation_request, m); if (r < 0) - log_warning("Failed to subscribe to activation signal: %s", strerror(-r)); + log_warning_errno(r, "Failed to subscribe to activation signal: %m"); /* Allow replacing of our name, to ease implementation of * reexecution, where we keep the old connection open until @@ -810,10 +793,8 @@ static int bus_setup_api(Manager *m, sd_bus *bus) { * to allow clients to synchronously wait for reexecution to * finish */ r = sd_bus_request_name(bus,"org.freedesktop.systemd1", SD_BUS_NAME_REPLACE_EXISTING|SD_BUS_NAME_ALLOW_REPLACEMENT); - if (r < 0) { - log_error("Failed to register name: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to register name: %m"); bus_list_names(m, bus); @@ -844,7 +825,7 @@ static int bus_init_api(Manager *m) { r = sd_bus_attach_event(bus, m->event, SD_EVENT_PRIORITY_NORMAL); if (r < 0) { - log_error("Failed to attach API bus to event loop: %s", strerror(-r)); + log_error_errno(r, "Failed to attach API bus to event loop: %m"); return 0; } @@ -855,7 +836,7 @@ static int bus_init_api(Manager *m) { r = bus_setup_api(m, bus); if (r < 0) { - log_error("Failed to set up API bus: %s", strerror(-r)); + log_error_errno(r, "Failed to set up API bus: %m"); return 0; } @@ -886,7 +867,7 @@ static int bus_setup_system(Manager *m, sd_bus *bus) { signal_agent_released, m); if (r < 0) - log_warning("Failed to register Released match on system bus: %s", strerror(-r)); + log_warning_errno(r, "Failed to register Released match on system bus: %m"); log_debug("Successfully connected to system bus."); return 0; @@ -917,13 +898,13 @@ static int bus_init_system(Manager *m) { r = sd_bus_attach_event(bus, m->event, SD_EVENT_PRIORITY_NORMAL); if (r < 0) { - log_error("Failed to attach system bus to event loop: %s", strerror(-r)); + log_error_errno(r, "Failed to attach system bus to event loop: %m"); return 0; } r = bus_setup_system(m, bus); if (r < 0) { - log_error("Failed to set up system bus: %s", strerror(-r)); + log_error_errno(r, "Failed to set up system bus: %m"); return 0; } @@ -974,35 +955,26 @@ static int bus_init_private(Manager *m) { left = strpcpy(&p, left, "/systemd/private"); salen = sizeof(sa.un) - left; - - mkdir_parents_label(sa.un.sun_path, 0755); } - unlink(sa.un.sun_path); + (void) mkdir_parents_label(sa.un.sun_path, 0755); + (void) unlink(sa.un.sun_path); fd = socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0); - if (fd < 0) { - log_error("Failed to allocate private socket: %m"); - return -errno; - } + if (fd < 0) + return log_error_errno(errno, "Failed to allocate private socket: %m"); r = bind(fd, &sa.sa, salen); - if (r < 0) { - log_error("Failed to bind private socket: %m"); - return -errno; - } + if (r < 0) + return log_error_errno(errno, "Failed to bind private socket: %m"); r = listen(fd, SOMAXCONN); - if (r < 0) { - log_error("Failed to make private socket listening: %m"); - return -errno; - } + if (r < 0) + return log_error_errno(errno, "Failed to make private socket listening: %m"); r = sd_event_add_io(m->event, &s, fd, EPOLLIN, bus_on_connection, m); - if (r < 0) { - log_error("Failed to allocate event source: %s", strerror(-r)); - return r; - } + if (r < 0) + return log_error_errno(r, "Failed to allocate event source: %m"); m->private_listen_fd = fd; m->private_listen_event_source = s; @@ -1175,6 +1147,7 @@ void bus_track_serialize(sd_bus_track *t, FILE *f) { int bus_track_deserialize_item(char ***l, const char *line) { const char *e; + int r; assert(l); assert(line); @@ -1183,7 +1156,11 @@ int bus_track_deserialize_item(char ***l, const char *line) { if (!e) return 0; - return strv_extend(l, e); + r = strv_extend(l, e); + if (r < 0) + return r; + + return 1; } int bus_track_coldplug(Manager *m, sd_bus_track **t, char ***l) { @@ -1218,19 +1195,23 @@ int bus_track_coldplug(Manager *m, sd_bus_track **t, char ***l) { return r; } -int bus_verify_manage_unit_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.manage-units", false, &m->polkit_registry, error); +int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.manage-units", false, UID_INVALID, &m->polkit_registry, error); } /* Same as bus_verify_manage_unit_async(), but checks for CAP_KILL instead of CAP_SYS_ADMIN */ -int bus_verify_manage_unit_async_for_kill(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async(call, CAP_KILL, "org.freedesktop.systemd1.manage-units", false, &m->polkit_registry, error); +int bus_verify_manage_units_async_for_kill(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async(call, CAP_KILL, "org.freedesktop.systemd1.manage-units", false, UID_INVALID, &m->polkit_registry, error); } int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.manage-unit-files", false, &m->polkit_registry, error); + return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.manage-unit-files", false, UID_INVALID, &m->polkit_registry, error); } int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.reload-daemon", false, &m->polkit_registry, error); + return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.reload-daemon", false, UID_INVALID, &m->polkit_registry, error); +} + +int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async(call, CAP_SYS_ADMIN, "org.freedesktop.systemd1.set-environment", false, UID_INVALID, &m->polkit_registry, error); }