[systemd-commits] 2 commits - src/bus-proxyd src/shared units/systemd-bus-proxyd at .service.in units/user
Lennart Poettering
lennart at kemper.freedesktop.org
Tue Jun 10 08:57:14 PDT 2014
src/bus-proxyd/bus-policy.c | 144 +++++++++++++++++++-----------
src/bus-proxyd/bus-policy.h | 2
src/bus-proxyd/bus-proxyd.c | 27 +++--
src/shared/util.c | 2
src/shared/util.h | 1
units/systemd-bus-proxyd at .service.in | 2
units/user/systemd-bus-proxyd at .service.in | 2
7 files changed, 117 insertions(+), 63 deletions(-)
New commits:
commit 13f8b8cbb466affdaeba2294ee7ab0f33015f356
Author: Lennart Poettering <lennart at poettering.net>
Date: Tue Jun 10 17:56:17 2014 +0200
bus-proxy: properly index policy by uid/gid when parsing
diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c
index 2234e7a..c23d394 100644
--- a/src/bus-proxyd/bus-policy.c
+++ b/src/bus-proxyd/bus-policy.c
@@ -323,7 +323,7 @@ static int file_load(Policy *p, const char *path) {
else if (policy_category == POLICY_CATEGORY_MANDATORY)
LIST_PREPEND(items, p->default_items, i);
else if (policy_category == POLICY_CATEGORY_USER) {
- PolicyItem *first;
+ const char *u = policy_user;
assert_cc(sizeof(uid_t) == sizeof(uint32_t));
@@ -331,16 +331,30 @@ static int file_load(Policy *p, const char *path) {
if (r < 0)
return log_oom();
- first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid));
- LIST_PREPEND(items, first, i);
+ if (!u) {
+ log_error("User policy without name");
+ return -EINVAL;
+ }
- r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first);
+ r = get_user_creds(&u, &i->uid, NULL, NULL, NULL);
if (r < 0) {
- LIST_REMOVE(items, first, i);
- return log_oom();
+ log_error("Failed to resolve user %s, ignoring policy: %s", u, strerror(-r));
+ free(i);
+ } else {
+ PolicyItem *first;
+
+ first = hashmap_get(p->user_items, UINT32_TO_PTR(i->uid));
+ LIST_PREPEND(items, first, i);
+
+ r = hashmap_replace(p->user_items, UINT32_TO_PTR(i->uid), first);
+ if (r < 0) {
+ LIST_REMOVE(items, first, i);
+ return log_oom();
+ }
}
+
} else if (policy_category == POLICY_CATEGORY_GROUP) {
- PolicyItem *first;
+ const char *g = policy_group;
assert_cc(sizeof(gid_t) == sizeof(uint32_t));
@@ -348,13 +362,26 @@ static int file_load(Policy *p, const char *path) {
if (r < 0)
return log_oom();
- first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid));
- LIST_PREPEND(items, first, i);
+ if (!g) {
+ log_error("Group policy without name");
+ return -EINVAL;
+ }
- r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first);
+ r = get_group_creds(&g, &i->gid);
if (r < 0) {
- LIST_REMOVE(items, first, i);
- return log_oom();
+ log_error("Failed to resolve group %s, ignoring policy: %s", g, strerror(-r));
+ free(i);
+ } else {
+ PolicyItem *first;
+
+ first = hashmap_get(p->group_items, UINT32_TO_PTR(i->gid));
+ LIST_PREPEND(items, first, i);
+
+ r = hashmap_replace(p->group_items, UINT32_TO_PTR(i->gid), first);
+ if (r < 0) {
+ LIST_REMOVE(items, first, i);
+ return log_oom();
+ }
}
}
@@ -582,47 +609,50 @@ void policy_free(Policy *p) {
p->user_items = p->group_items = NULL;
}
-static void dump_items(PolicyItem *i) {
+static void dump_items(PolicyItem *i, const char *prefix) {
if (!i)
return;
- printf("Type: %s\n"
- "Class: %s\n",
- policy_item_type_to_string(i->type),
- policy_item_class_to_string(i->class));
+ if (!prefix)
+ prefix = "";
+
+ printf("%sType: %s\n"
+ "%sClass: %s\n",
+ prefix, policy_item_type_to_string(i->type),
+ prefix, policy_item_class_to_string(i->class));
if (i->interface)
- printf("Interface: %s\n",
- i->interface);
+ printf("%sInterface: %s\n",
+ prefix, i->interface);
if (i->member)
- printf("Member: %s\n",
- i->member);
+ printf("%sMember: %s\n",
+ prefix, i->member);
if (i->error)
- printf("Error: %s\n",
- i->error);
+ printf("%sError: %s\n",
+ prefix, i->error);
if (i->path)
- printf("Path: %s\n",
- i->path);
+ printf("%sPath: %s\n",
+ prefix, i->path);
if (i->name)
- printf("Name: %s\n",
- i->name);
+ printf("%sName: %s\n",
+ prefix, i->name);
if (i->message_type != 0)
- printf("Message Type: %s\n",
- bus_message_type_to_string(i->message_type));
+ printf("%sMessage Type: %s\n",
+ prefix, bus_message_type_to_string(i->message_type));
if (i->uid_valid) {
_cleanup_free_ char *user;
user = uid_to_name(i->uid);
- printf("User: %s\n",
- strna(user));
+ printf("%sUser: %s\n",
+ prefix, strna(user));
}
if (i->gid_valid) {
@@ -630,13 +660,13 @@ static void dump_items(PolicyItem *i) {
group = gid_to_name(i->gid);
- printf("Group: %s\n",
- strna(group));
+ printf("%sGroup: %s\n",
+ prefix, strna(group));
}
if (i->items_next) {
- printf("--\n");
- dump_items(i->items_next);
+ printf("%s%s\n", prefix, draw_special_char(DRAW_DASH));
+ dump_items(i->items_next, prefix);
}
}
@@ -646,24 +676,25 @@ static void dump_hashmap_items(Hashmap *h) {
void *k;
HASHMAP_FOREACH_KEY(i, k, h, j) {
- printf("Item for %u:\n", PTR_TO_UINT(k));
- dump_items(i);
+ printf("\t%s Item for %u:\n", draw_special_char(DRAW_ARROW), PTR_TO_UINT(k));
+ dump_items(i, "\t\t");
}
}
noreturn void policy_dump(Policy *p) {
printf("%s Default Items:\n", draw_special_char(DRAW_ARROW));
- dump_items(p->default_items);
-
- printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW));
- dump_items(p->mandatory_items);
+ dump_items(p->default_items, "\t");
printf("%s Group Items:\n", draw_special_char(DRAW_ARROW));
dump_hashmap_items(p->group_items);
printf("%s User Items:\n", draw_special_char(DRAW_ARROW));
dump_hashmap_items(p->user_items);
+
+ printf("%s Mandatory Items:\n", draw_special_char(DRAW_ARROW));
+ dump_items(p->mandatory_items, "\t");
+
exit(0);
}
diff --git a/src/shared/util.c b/src/shared/util.c
index 7fa3742..2e832ca 100644
--- a/src/shared/util.c
+++ b/src/shared/util.c
@@ -5507,6 +5507,7 @@ const char *draw_special_char(DrawSpecialChar ch) {
[DRAW_TRIANGULAR_BULLET] = "\342\200\243", /* ‣ */
[DRAW_BLACK_CIRCLE] = "\342\227\217", /* â— */
[DRAW_ARROW] = "\342\206\222", /* → */
+ [DRAW_DASH] = "\342\200\223", /* – */
},
/* ASCII fallback */ {
@@ -5517,6 +5518,7 @@ const char *draw_special_char(DrawSpecialChar ch) {
[DRAW_TRIANGULAR_BULLET] = ">",
[DRAW_BLACK_CIRCLE] = "*",
[DRAW_ARROW] = "->",
+ [DRAW_DASH] = "-",
}
};
diff --git a/src/shared/util.h b/src/shared/util.h
index 952239e..7618aef 100644
--- a/src/shared/util.h
+++ b/src/shared/util.h
@@ -706,6 +706,7 @@ typedef enum DrawSpecialChar {
DRAW_TRIANGULAR_BULLET,
DRAW_BLACK_CIRCLE,
DRAW_ARROW,
+ DRAW_DASH,
_DRAW_SPECIAL_CHAR_MAX
} DrawSpecialChar;
commit 2e2b36084a98f9071fd178c6540ce57b2f577f8d
Author: Lennart Poettering <lennart at poettering.net>
Date: Tue Jun 10 15:46:32 2014 +0200
bus-proxy: read the right policy when running in user mode
diff --git a/src/bus-proxyd/bus-policy.c b/src/bus-proxyd/bus-policy.c
index 2df4bf7..2234e7a 100644
--- a/src/bus-proxyd/bus-policy.c
+++ b/src/bus-proxyd/bus-policy.c
@@ -83,6 +83,8 @@ static int file_load(Policy *p, const char *path) {
if (r < 0) {
if (r == -ENOENT)
return 0;
+ if (r == -EISDIR)
+ return r;
log_error("Failed to load %s: %s", path, strerror(-r));
return r;
@@ -513,24 +515,31 @@ static int file_load(Policy *p, const char *path) {
}
}
-int policy_load(Policy *p) {
- _cleanup_strv_free_ char **l = NULL;
+int policy_load(Policy *p, char **files) {
char **i;
int r;
assert(p);
- file_load(p, "/etc/dbus-1/system.conf");
- file_load(p, "/etc/dbus-1/system-local.conf");
+ STRV_FOREACH(i, files) {
- r = conf_files_list(&l, ".conf", NULL, "/etc/dbus-1/system.d/", NULL);
- if (r < 0) {
- log_error("Failed to get configuration file list: %s", strerror(-r));
- return r;
- }
+ r = file_load(p, *i);
+ if (r == -EISDIR) {
+ _cleanup_strv_free_ char **l = NULL;
+ char **j;
+
+ r = conf_files_list(&l, ".conf", NULL, *i, NULL);
+ if (r < 0) {
+ log_error("Failed to get configuration file list: %s", strerror(-r));
+ return r;
+ }
+
+ STRV_FOREACH(j, l)
+ file_load(p, *j);
+ }
- STRV_FOREACH(i, l)
- file_load(p, *i);
+ /* We ignore all errors but EISDIR, and just proceed. */
+ }
return 0;
}
diff --git a/src/bus-proxyd/bus-policy.h b/src/bus-proxyd/bus-policy.h
index cff2613..bad4256 100644
--- a/src/bus-proxyd/bus-policy.h
+++ b/src/bus-proxyd/bus-policy.h
@@ -72,7 +72,7 @@ typedef struct Policy {
Hashmap *group_items;
} Policy;
-int policy_load(Policy *p);
+int policy_load(Policy *p, char **files);
void policy_free(Policy *p);
void policy_dump(Policy *p);
diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index 9937159..07995ec 100644
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -47,19 +47,21 @@
#include "capability.h"
#include "bus-policy.h"
-static const char *arg_address = DEFAULT_SYSTEM_BUS_PATH;
+static const char *arg_address = KERNEL_SYSTEM_BUS_PATH;
static char *arg_command_line_buffer = NULL;
static bool arg_drop_privileges = false;
+static char **arg_configuration = NULL;
static int help(void) {
printf("%s [OPTIONS...]\n\n"
"Connect STDIO or a socket to a given bus address.\n\n"
- " -h --help Show this help\n"
- " --version Show package version\n"
- " --drop-privileges Drop privileges\n"
- " --address=ADDRESS Connect to the bus specified by ADDRESS\n"
- " (default: " DEFAULT_SYSTEM_BUS_PATH ")\n",
+ " -h --help Show this help\n"
+ " --version Show package version\n"
+ " --drop-privileges Drop privileges\n"
+ " --configuration=PATH Configuration file or directory\n"
+ " --address=ADDRESS Connect to the bus specified by ADDRESS\n"
+ " (default: " KERNEL_SYSTEM_BUS_PATH ")\n",
program_invocation_short_name);
return 0;
@@ -71,6 +73,7 @@ static int parse_argv(int argc, char *argv[]) {
ARG_VERSION = 0x100,
ARG_ADDRESS,
ARG_DROP_PRIVILEGES,
+ ARG_CONFIGURATION,
};
static const struct option options[] = {
@@ -78,10 +81,11 @@ static int parse_argv(int argc, char *argv[]) {
{ "version", no_argument, NULL, ARG_VERSION },
{ "address", required_argument, NULL, ARG_ADDRESS },
{ "drop-privileges", no_argument, NULL, ARG_DROP_PRIVILEGES },
+ { "configuration", required_argument, NULL, ARG_CONFIGURATION },
{ NULL, 0, NULL, 0 },
};
- int c;
+ int c, r;
assert(argc >= 0);
assert(argv);
@@ -107,6 +111,12 @@ static int parse_argv(int argc, char *argv[]) {
arg_drop_privileges = true;
break;
+ case ARG_CONFIGURATION:
+ r = strv_extend(&arg_configuration, optarg);
+ if (r < 0)
+ return log_oom();
+ break;
+
case '?':
return -EINVAL;
@@ -1054,7 +1064,7 @@ int main(int argc, char *argv[]) {
if (r <= 0)
goto finish;
- r = policy_load(&policy);
+ r = policy_load(&policy, arg_configuration);
if (r < 0) {
log_error("Failed to load policy: %s", strerror(-r));
goto finish;
@@ -1425,6 +1435,7 @@ finish:
sd_bus_flush(b);
policy_free(&policy);
+ strv_free(arg_configuration);
return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
}
diff --git a/units/systemd-bus-proxyd at .service.in b/units/systemd-bus-proxyd at .service.in
index 0499269..eef703f 100644
--- a/units/systemd-bus-proxyd at .service.in
+++ b/units/systemd-bus-proxyd at .service.in
@@ -12,7 +12,7 @@ Description=Legacy D-Bus Protocol Compatibility Daemon
# The first argument will be replaced by the service by information on
# the process requesting the proxy, we need a placeholder to keep the
# space available for this.
-ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/dev/kdbus/0-system/bus --configuration=/etc/dbus-1/system.conf --configuration=/etc/dbus-1/system-local.conf --configuration=/etc/dbus-1/system.d/ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP
PrivateTmp=yes
diff --git a/units/user/systemd-bus-proxyd at .service.in b/units/user/systemd-bus-proxyd at .service.in
index 5a9f31c..68f59f5 100644
--- a/units/user/systemd-bus-proxyd at .service.in
+++ b/units/user/systemd-bus-proxyd at .service.in
@@ -12,5 +12,5 @@ Description=Legacy D-Bus Protocol Compatibility Daemon
# The first argument will be replaced by the service by information on
# the process requesting the proxy, we need a placeholder to keep the
# space available for this.
-ExecStart=@rootlibexecdir@/systemd-bus-proxyd --address=kernel:path=/dev/kdbus/%U-user/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+ExecStart=@rootlibexecdir@/sessiond-bus-proxyd --address=kernel:path=/dev/kdbus/%U-user/bus --configuration=/etc/dbus-1/session.conf --configuration=/etc/dbus-1/session-local.conf --configuration=/etc/dbus-1/session.d/ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
More information about the systemd-commits
mailing list