[systemd-commits] 5 commits - TODO src/bus-proxyd src/dbus1-generator src/libsystemd src/login src/shared src/systemd units/systemd-bus-proxyd at .service.in units/user
Lennart Poettering
lennart at kemper.freedesktop.org
Fri Nov 28 07:20:06 PST 2014
TODO | 5 +
src/bus-proxyd/bus-proxyd.c | 71 ++++++++-------
src/dbus1-generator/dbus1-generator.c | 4
src/libsystemd/sd-bus/bus-control.c | 140 ++++++++++++++++--------------
src/libsystemd/sd-bus/bus-kernel.c | 59 +++++++++++-
src/libsystemd/sd-bus/bus-kernel.h | 4
src/libsystemd/sd-bus/bus-util.c | 4
src/libsystemd/sd-bus/busctl.c | 16 ++-
src/libsystemd/sd-bus/sd-bus.c | 50 +++++++++-
src/libsystemd/sd-bus/test-bus-kernel.c | 5 -
src/login/pam_systemd.c | 3
src/shared/def.h | 12 +-
src/systemd/sd-bus.h | 1
units/systemd-bus-proxyd at .service.in | 2
units/user/systemd-bus-proxyd at .service.in | 2
15 files changed, 256 insertions(+), 122 deletions(-)
New commits:
commit 818eae495ecc1a19d1906bafa6e3a61fe6171f50
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Nov 28 16:16:18 2014 +0100
update TODO
diff --git a/TODO b/TODO
index 8f5e3a5..5baf812 100644
--- a/TODO
+++ b/TODO
@@ -257,6 +257,11 @@ Features:
ReadOnlyDirectories=... for whitelisting files for a service.
* sd-bus:
+ - add sd_bus_get_address() call
+ - s/owner_id/bus_id/?
+ - how can we make the xml enforcement for native clients unnecessary?
+ - replace "container" by "machine" in sd_bus_open_system_container()
+ - add "as" (array of strings) support to bloom filter
- bus-proxy: fix how we detect whether we are connected to a system bus
- kdbus: the kernel should not allow messages to be delivered that have a reply serial != 0, reply-expect unset, but no appropriate window
- kdbus: when we fake creds euid being (uint32_t) -1 is weirdly translated
commit 2e43ad9ca677b1f641a30849526e2b999cb81075
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Nov 28 16:14:39 2014 +0100
bus-proxy: automatically detect scope of bus and derive which XML snippets to load from that
diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index a66197a..d2acb78 100644
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -1381,39 +1381,50 @@ int main(int argc, char *argv[]) {
}
if (a->is_kernel) {
- _cleanup_bus_creds_unref_ sd_bus_creds *bus_creds = NULL;
- uid_t bus_uid;
+ if (!arg_configuration) {
+ const char *scope;
- r = sd_bus_get_owner_creds(a, SD_BUS_CREDS_UID, &bus_creds);
- if (r < 0) {
- log_error_errno(r, "Failed to get bus creds: %m");
- goto finish;
- }
-
- r = sd_bus_creds_get_uid(bus_creds, &bus_uid);
- if (r < 0) {
- log_error_errno(r, "Failed to get bus owner UID: %m");
- goto finish;
- }
-
- if (bus_uid == 0) {
- /* We only enforce the old XML policy on
- * kernel busses owned by root users. */
-
- r = policy_load(&policy_buffer, arg_configuration);
+ r = sd_bus_get_scope(a, &scope);
if (r < 0) {
- log_error_errno(r, "Failed to load policy: %m");
+ log_error_errno(r, "Couldn't determine bus scope: %m");
goto finish;
}
- if (!policy_check_hello(&policy_buffer, ucred.uid, ucred.gid)) {
- log_error("Policy denied connection");
- r = -EPERM;
+ if (streq(scope, "system"))
+ arg_configuration = strv_new(
+ "/etc/dbus-1/system.conf",
+ "/etc/dbus-1/system.d/",
+ "/etc/dbus-1/system-local.conf",
+ NULL);
+ else if (streq(scope, "user"))
+ arg_configuration = strv_new(
+ "/etc/dbus-1/session.conf",
+ "/etc/dbus-1/session.d/",
+ "/etc/dbus-1/session-local.conf",
+ NULL);
+ else {
+ log_error("Unknown scope %s, don't know which policy to load. Refusing.", scope);
goto finish;
}
- policy_dump(&policy_buffer);
- policy = &policy_buffer;
+ if (!arg_configuration) {
+ r = log_oom();
+ goto finish;
+ }
+ }
+
+ r = policy_load(&policy_buffer, arg_configuration);
+ if (r < 0) {
+ log_error_errno(r, "Failed to load policy: %m");
+ goto finish;
+ }
+
+ policy = &policy_buffer;
+ policy_dump(policy);
+
+ if (!policy_check_hello(policy, ucred.uid, ucred.gid)) {
+ r = log_error_errno(EPERM, "Policy denied connection.");
+ goto finish;
}
}
diff --git a/units/systemd-bus-proxyd at .service.in b/units/systemd-bus-proxyd at .service.in
index fdcd302..23b5ffa 100644
--- a/units/systemd-bus-proxyd at .service.in
+++ b/units/systemd-bus-proxyd at .service.in
@@ -12,7 +12,7 @@ Description=Legacy D-Bus Protocol Compatibility Daemon
# The first argument will be replaced by the service by information on
# the process requesting the proxy, we need a placeholder to keep the
# space available for this.
-ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus --configuration=/etc/dbus-1/system.conf --configuration=/etc/dbus-1/system-local.conf --configuration=/etc/dbus-1/system.d/ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP
PrivateTmp=yes
diff --git a/units/user/systemd-bus-proxyd at .service.in b/units/user/systemd-bus-proxyd at .service.in
index 48294db..0ab5462 100644
--- a/units/user/systemd-bus-proxyd at .service.in
+++ b/units/user/systemd-bus-proxyd at .service.in
@@ -12,5 +12,5 @@ Description=Legacy D-Bus Protocol Compatibility Daemon
# The first argument will be replaced by the service by information on
# the process requesting the proxy, we need a placeholder to keep the
# space available for this.
-ExecStart=@rootlibexecdir@/systemd-bus-proxyd --address=kernel:path=/sys/fs/kdbus/%U-user/bus --configuration=/etc/dbus-1/session.conf --configuration=/etc/dbus-1/session-local.conf --configuration=/etc/dbus-1/session.d/ xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+ExecStart=@rootlibexecdir@/systemd-bus-proxyd --address=kernel:path=/sys/fs/kdbus/%U-user/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
NotifyAccess=main
commit e3afaf6b8e540d4c0dc5a7f0d5178ce29c1ac2a5
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Nov 28 16:05:43 2014 +0100
sd-bus: rename default bus address constants, they aren't "paths" but "addresses"
diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index 45061ad..a66197a 100644
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -61,7 +61,7 @@ static int help(void) {
" --configuration=PATH Configuration file or directory\n"
" --machine=MACHINE Connect to specified machine\n"
" --address=ADDRESS Connect to the bus specified by ADDRESS\n"
- " (default: " DEFAULT_SYSTEM_BUS_PATH ")\n",
+ " (default: " DEFAULT_SYSTEM_BUS_ADDRESS ")\n",
program_invocation_short_name);
return 0;
@@ -166,7 +166,7 @@ static int parse_argv(int argc, char *argv[]) {
}
if (!arg_address) {
- arg_address = strdup(DEFAULT_SYSTEM_BUS_PATH);
+ arg_address = strdup(DEFAULT_SYSTEM_BUS_ADDRESS);
if (!arg_address)
return log_oom();
}
diff --git a/src/dbus1-generator/dbus1-generator.c b/src/dbus1-generator/dbus1-generator.c
index a459c84..5d3b1a8 100644
--- a/src/dbus1-generator/dbus1-generator.c
+++ b/src/dbus1-generator/dbus1-generator.c
@@ -86,7 +86,7 @@ static int create_dbus_files(
fprintf(f, "Environment=DBUS_STARTER_BUS_TYPE=%s\n", type);
if (streq(type, "system"))
- fprintf(f, "Environment=DBUS_STARTER_ADDRESS=" DEFAULT_SYSTEM_BUS_PATH "\n");
+ fprintf(f, "Environment=DBUS_STARTER_ADDRESS=" DEFAULT_SYSTEM_BUS_ADDRESS "\n");
else if (streq(type, "session")) {
char *run;
@@ -96,7 +96,7 @@ static int create_dbus_files(
return -EINVAL;
}
- fprintf(f, "Environment=DBUS_STARTER_ADDRESS="KERNEL_USER_BUS_FMT ";" UNIX_USER_BUS_FMT "\n",
+ fprintf(f, "Environment=DBUS_STARTER_ADDRESS="KERNEL_USER_BUS_ADDRESS_FMT ";" UNIX_USER_BUS_ADDRESS_FMT "\n",
getuid(), run);
}
}
diff --git a/src/libsystemd/sd-bus/bus-util.c b/src/libsystemd/sd-bus/bus-util.c
index 22a3766..9fcbfcc 100644
--- a/src/libsystemd/sd-bus/bus-util.c
+++ b/src/libsystemd/sd-bus/bus-util.c
@@ -521,7 +521,7 @@ int bus_open_system_systemd(sd_bus **_bus) {
if (r < 0)
return r;
- r = sd_bus_set_address(bus, KERNEL_SYSTEM_BUS_PATH);
+ r = sd_bus_set_address(bus, KERNEL_SYSTEM_BUS_ADDRESS);
if (r < 0)
return r;
@@ -574,7 +574,7 @@ int bus_open_user_systemd(sd_bus **_bus) {
if (r < 0)
return r;
- if (asprintf(&bus->address, KERNEL_USER_BUS_FMT, getuid()) < 0)
+ if (asprintf(&bus->address, KERNEL_USER_BUS_ADDRESS_FMT, getuid()) < 0)
return -ENOMEM;
bus->bus_client = true;
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
index 9ce6bfa..70dabcc 100644
--- a/src/libsystemd/sd-bus/sd-bus.c
+++ b/src/libsystemd/sd-bus/sd-bus.c
@@ -1119,7 +1119,7 @@ int bus_set_address_system(sd_bus *b) {
if (e)
return sd_bus_set_address(b, e);
- return sd_bus_set_address(b, DEFAULT_SYSTEM_BUS_PATH);
+ return sd_bus_set_address(b, DEFAULT_SYSTEM_BUS_ADDRESS);
}
_public_ int sd_bus_open_system(sd_bus **ret) {
@@ -1175,13 +1175,13 @@ int bus_set_address_user(sd_bus *b) {
return -ENOMEM;
#ifdef ENABLE_KDBUS
- (void) asprintf(&b->address, KERNEL_USER_BUS_FMT ";" UNIX_USER_BUS_FMT, getuid(), ee);
+ (void) asprintf(&b->address, KERNEL_USER_BUS_ADDRESS_FMT ";" UNIX_USER_BUS_ADDRESS_FMT, getuid(), ee);
#else
- (void) asprintf(&b->address, UNIX_USER_BUS_FMT, ee);
+ (void) asprintf(&b->address, UNIX_USER_BUS_ADDRESS_FMT, ee);
#endif
} else {
#ifdef ENABLE_KDBUS
- (void) asprintf(&b->address, KERNEL_USER_BUS_FMT, getuid());
+ (void) asprintf(&b->address, KERNEL_USER_BUS_ADDRESS_FMT, getuid());
#else
return -ECONNREFUSED;
#endif
diff --git a/src/login/pam_systemd.c b/src/login/pam_systemd.c
index 4974c51..111e2b7 100644
--- a/src/login/pam_systemd.c
+++ b/src/login/pam_systemd.c
@@ -183,8 +183,7 @@ static int export_legacy_dbus_address(
if (access("/sys/fs/kdbus", F_OK) < 0)
return PAM_SUCCESS;
- if (asprintf(&s, KERNEL_USER_BUS_FMT ";" UNIX_USER_BUS_FMT,
- uid, runtime) < 0) {
+ if (asprintf(&s, KERNEL_USER_BUS_ADDRESS_FMT ";" UNIX_USER_BUS_ADDRESS_FMT, uid, runtime) < 0) {
pam_syslog(handle, LOG_ERR, "Failed to set bus variable.");
return PAM_BUF_ERR;
}
diff --git a/src/shared/def.h b/src/shared/def.h
index 98e3e10..96c45a6 100644
--- a/src/shared/def.h
+++ b/src/shared/def.h
@@ -61,17 +61,17 @@
"/usr/lib/kbd/keymaps/\0"
#endif
-#define UNIX_SYSTEM_BUS_PATH "unix:path=/var/run/dbus/system_bus_socket"
-#define KERNEL_SYSTEM_BUS_PATH "kernel:path=/sys/fs/kdbus/0-system/bus"
+#define UNIX_SYSTEM_BUS_ADDRESS "unix:path=/var/run/dbus/system_bus_socket"
+#define KERNEL_SYSTEM_BUS_ADDRESS "kernel:path=/sys/fs/kdbus/0-system/bus"
#ifdef ENABLE_KDBUS
-# define DEFAULT_SYSTEM_BUS_PATH KERNEL_SYSTEM_BUS_PATH ";" UNIX_SYSTEM_BUS_PATH
+# define DEFAULT_SYSTEM_BUS_ADDRESS KERNEL_SYSTEM_BUS_ADDRESS ";" UNIX_SYSTEM_BUS_ADDRESS
#else
-# define DEFAULT_SYSTEM_BUS_PATH UNIX_SYSTEM_BUS_PATH
+# define DEFAULT_SYSTEM_BUS_ADDRESS UNIX_SYSTEM_BUS_ADDRESS
#endif
-#define UNIX_USER_BUS_FMT "unix:path=%s/bus"
-#define KERNEL_USER_BUS_FMT "kernel:path=/sys/fs/kdbus/"UID_FMT"-user/bus"
+#define UNIX_USER_BUS_ADDRESS_FMT "unix:path=%s/bus"
+#define KERNEL_USER_BUS_ADDRESS_FMT "kernel:path=/sys/fs/kdbus/"UID_FMT"-user/bus"
#define PLYMOUTH_SOCKET { \
.un.sun_family = AF_UNIX, \
commit 3acc1dafd14420872f7f13319260eeb5d62c2533
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Nov 28 15:59:05 2014 +0100
sd-bus: add new call sd_bus_get_scope() for querying whether one is connected to a system or a user bus
diff --git a/src/libsystemd/sd-bus/bus-kernel.c b/src/libsystemd/sd-bus/bus-kernel.c
index c86ed6a..58f011f 100644
--- a/src/libsystemd/sd-bus/bus-kernel.c
+++ b/src/libsystemd/sd-bus/bus-kernel.c
@@ -1845,3 +1845,39 @@ int bus_kernel_fix_attach_mask(void) {
return 0;
}
+
+int bus_kernel_get_bus_name(sd_bus *bus, char **name) {
+ struct kdbus_cmd_info cmd = {
+ .size = sizeof(struct kdbus_cmd_info),
+ };
+ struct kdbus_info *info;
+ struct kdbus_item *item;
+ char *n = NULL;
+ int r;
+
+ assert(bus);
+ assert(name);
+ assert(bus->is_kernel);
+
+ r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
+ if (r < 0)
+ return -errno;
+
+ info = (struct kdbus_info*) ((uint8_t*) bus->kdbus_buffer + cmd.offset);
+
+ KDBUS_ITEM_FOREACH(item, info, items)
+ if (item->type == KDBUS_ITEM_MAKE_NAME) {
+ r = free_and_strdup(&n, item->str);
+ break;
+ }
+
+ bus_kernel_cmd_free(bus, cmd.offset);
+
+ if (r < 0)
+ return r;
+ if (!n)
+ return -EIO;
+
+ *name = n;
+ return 0;
+}
diff --git a/src/libsystemd/sd-bus/bus-kernel.h b/src/libsystemd/sd-bus/bus-kernel.h
index 0d406fb..2152f62 100644
--- a/src/libsystemd/sd-bus/bus-kernel.h
+++ b/src/libsystemd/sd-bus/bus-kernel.h
@@ -92,4 +92,6 @@ int bus_kernel_realize_attach_flags(sd_bus *bus);
int bus_kernel_fix_attach_mask(void);
+int bus_kernel_get_bus_name(sd_bus *bus, char **name);
+
int bus_kernel_cmd_free(sd_bus *bus, uint64_t offset);
diff --git a/src/libsystemd/sd-bus/busctl.c b/src/libsystemd/sd-bus/busctl.c
index b4a91df..febfc98 100644
--- a/src/libsystemd/sd-bus/busctl.c
+++ b/src/libsystemd/sd-bus/busctl.c
@@ -1193,11 +1193,18 @@ static int status(sd_bus *bus, char *argv[]) {
&creds,
pid,
_SD_BUS_CREDS_ALL);
- } else
+ } else {
+ const char *scope;
+
+ r = sd_bus_get_scope(bus, &scope);
+ if (r >= 0)
+ printf("Scope=%s%s%s\n", ansi_highlight(), scope, ansi_highlight_off());
+
r = sd_bus_get_owner_creds(
bus,
(arg_augment_creds ? SD_BUS_CREDS_AUGMENT : 0) | _SD_BUS_CREDS_ALL,
&creds);
+ }
if (r < 0) {
log_error_errno(r, "Failed to get credentials: %m");
@@ -2006,10 +2013,13 @@ int main(int argc, char *argv[]) {
switch (arg_transport) {
case BUS_TRANSPORT_LOCAL:
- if (arg_user)
+ if (arg_user) {
+ bus->is_user = true;
r = bus_set_address_user(bus);
- else
+ } else {
+ bus->is_system = true;
r = bus_set_address_system(bus);
+ }
break;
case BUS_TRANSPORT_REMOTE:
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
index 8f97a58..9ce6bfa 100644
--- a/src/libsystemd/sd-bus/sd-bus.c
+++ b/src/libsystemd/sd-bus/sd-bus.c
@@ -1283,6 +1283,7 @@ _public_ int sd_bus_open_system_remote(sd_bus **ret, const char *host) {
bus->bus_client = true;
bus->trusted = false;
+ bus->is_system = true;
r = sd_bus_start(bus);
if (r < 0)
@@ -1335,6 +1336,7 @@ _public_ int sd_bus_open_system_container(sd_bus **ret, const char *machine) {
bus->bus_client = true;
bus->trusted = false;
+ bus->is_system = true;
r = sd_bus_start(bus);
if (r < 0)
@@ -3376,3 +3378,43 @@ int bus_get_root_path(sd_bus *bus) {
return r;
}
+
+_public_ int sd_bus_get_scope(sd_bus *bus, const char **scope) {
+ int r;
+
+ assert_return(bus, -EINVAL);
+ assert_return(scope, -EINVAL);
+ assert_return(!bus_pid_changed(bus), -ECHILD);
+
+ if (bus->is_kernel) {
+ _cleanup_free_ char *n = NULL;
+ const char *dash;
+
+ r = bus_kernel_get_bus_name(bus, &n);
+ if (r < 0)
+ return r;
+
+ if (streq(n, "0-system")) {
+ *scope = "system";
+ return 1;
+ }
+
+ dash = strchr(n, '-');
+ if (streq(dash, "-user")) {
+ *scope = "user";
+ return 1;
+ }
+ }
+
+ if (bus->is_user) {
+ *scope = "user";
+ return 1;
+ }
+
+ if (bus->is_system) {
+ *scope = "system";
+ return 1;
+ }
+
+ return -ENODATA;
+}
diff --git a/src/libsystemd/sd-bus/test-bus-kernel.c b/src/libsystemd/sd-bus/test-bus-kernel.c
index 485c396..3aec568 100644
--- a/src/libsystemd/sd-bus/test-bus-kernel.c
+++ b/src/libsystemd/sd-bus/test-bus-kernel.c
@@ -33,7 +33,7 @@
int main(int argc, char *argv[]) {
_cleanup_close_ int bus_ref = -1;
- _cleanup_free_ char *name = NULL, *bus_name = NULL, *address = NULL;
+ _cleanup_free_ char *name = NULL, *bus_name = NULL, *address = NULL, *bname = NULL;
_cleanup_bus_message_unref_ sd_bus_message *m = NULL;
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
const char *ua = NULL, *ub = NULL, *the_string = NULL;
@@ -102,6 +102,9 @@ int main(int argc, char *argv[]) {
assert_se(r >= 0);
printf("name of b: %s\n", nn);
+ assert_se(bus_kernel_get_bus_name(b, &bname) >= 0);
+ assert_se(endswith(bname, name));
+
r = sd_bus_call_method(a, "this.doesnt.exist", "/foo", "meh.mah", "muh", &error, NULL, "s", "yayayay");
assert_se(sd_bus_error_has_name(&error, SD_BUS_ERROR_SERVICE_UNKNOWN));
assert_se(r == -EHOSTUNREACH);
diff --git a/src/systemd/sd-bus.h b/src/systemd/sd-bus.h
index 47fc8df..b245833 100644
--- a/src/systemd/sd-bus.h
+++ b/src/systemd/sd-bus.h
@@ -140,6 +140,7 @@ int sd_bus_is_open(sd_bus *bus);
int sd_bus_can_send(sd_bus *bus, char type);
int sd_bus_get_owner_id(sd_bus *bus, sd_id128_t *id);
int sd_bus_get_owner_creds(sd_bus *bus, uint64_t creds_mask, sd_bus_creds **ret);
+int sd_bus_get_scope(sd_bus *bus, const char **scope);
int sd_bus_get_description(sd_bus *bus, const char **description);
int sd_bus_get_tid(sd_bus *bus, pid_t *tid);
commit 52cfc0379a9d63f99cdb3d9f63c839bbc8889b4c
Author: Lennart Poettering <lennart at poettering.net>
Date: Fri Nov 28 15:58:03 2014 +0100
sd-bus: rework credential query logic
Also, make the call to free kdbus slices generic and use it everywhere
diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index 5c8357c..45061ad 100644
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -689,7 +689,6 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m, Policy *polic
} else if (sd_bus_message_is_method_call(m, "org.freedesktop.DBus", "ListQueuedOwners")) {
struct kdbus_cmd_name_list cmd = {};
struct kdbus_name_list *name_list;
- struct kdbus_cmd_free cmd_free;
struct kdbus_name_info *name;
_cleanup_strv_free_ char **owners = NULL;
_cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
@@ -742,10 +741,7 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m, Policy *polic
}
}
- cmd_free.flags = 0;
- cmd_free.offset = cmd.offset;
-
- r = ioctl(a->input_fd, KDBUS_CMD_FREE, &cmd_free);
+ r = bus_kernel_cmd_free(a, cmd.offset);
if (r < 0)
return synthetic_reply_method_errno(m, r, NULL);
diff --git a/src/libsystemd/sd-bus/bus-control.c b/src/libsystemd/sd-bus/bus-control.c
index e6e905c..71fdbcf 100644
--- a/src/libsystemd/sd-bus/bus-control.c
+++ b/src/libsystemd/sd-bus/bus-control.c
@@ -223,23 +223,6 @@ _public_ int sd_bus_release_name(sd_bus *bus, const char *name) {
return bus_release_name_dbus1(bus, name);
}
-static int kernel_cmd_free(sd_bus *bus, uint64_t offset)
-{
- struct kdbus_cmd_free cmd;
- int r;
-
- assert(bus);
-
- cmd.flags = 0;
- cmd.offset = offset;
-
- r = ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
- if (r < 0)
- return -errno;
-
- return 0;
-}
-
static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
struct kdbus_cmd_name_list cmd = {};
struct kdbus_name_list *name_list;
@@ -293,7 +276,7 @@ static int kernel_get_list(sd_bus *bus, uint64_t flags, char ***x) {
r = 0;
fail:
- kernel_cmd_free(bus, cmd.offset);
+ bus_kernel_cmd_free(bus, cmd.offset);
return r;
}
@@ -715,7 +698,7 @@ static int bus_get_name_creds_kdbus(
r = 0;
fail:
- kernel_cmd_free(bus, cmd->offset);
+ bus_kernel_cmd_free(bus, cmd->offset);
return r;
}
@@ -897,18 +880,58 @@ _public_ int sd_bus_get_name_creds(
return bus_get_name_creds_dbus1(bus, name, mask, creds);
}
-_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+static int bus_get_owner_creds_kdbus(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+ struct kdbus_cmd_info cmd = {
+ .size = sizeof(struct kdbus_cmd_info)
+ };
+ struct kdbus_info *creator_info;
pid_t pid = 0;
int r;
- assert_return(bus, -EINVAL);
- assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
- assert_return(ret, -EINVAL);
- assert_return(!bus_pid_changed(bus), -ECHILD);
+ c = bus_creds_new();
+ if (!c)
+ return -ENOMEM;
- if (!BUS_IS_OPEN(bus->state))
- return -ENOTCONN;
+ cmd.flags = attach_flags_to_kdbus(mask);
+
+ /* If augmentation is on, and the bus doesn't didn't allow us
+ * to get the bits we want, then ask for the PID/TID so that we
+ * can read the rest from /proc. */
+ if ((mask & SD_BUS_CREDS_AUGMENT) &&
+ (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
+ SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
+ SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
+ SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
+ SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
+ SD_BUS_CREDS_SELINUX_CONTEXT|
+ SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
+ cmd.flags |= KDBUS_ATTACH_PIDS;
+
+ r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
+ if (r < 0)
+ return -errno;
+
+ creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
+
+ r = bus_populate_creds_from_items(bus, creator_info, mask, c);
+ bus_kernel_cmd_free(bus, cmd.offset);
+ if (r < 0)
+ return r;
+
+ r = bus_creds_add_more(c, mask, pid, 0);
+ if (r < 0)
+ return r;
+
+ *ret = c;
+ c = NULL;
+ return 0;
+}
+
+static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+ _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
+ pid_t pid = 0;
+ int r;
if (!bus->ucred_valid && !isempty(bus->label))
return -ENODATA;
@@ -918,11 +941,20 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
return -ENOMEM;
if (bus->ucred_valid) {
- pid = c->pid = bus->ucred.pid;
- c->uid = bus->ucred.uid;
- c->gid = bus->ucred.gid;
+ if (bus->ucred.pid > 0) {
+ pid = c->pid = bus->ucred.pid;
+ c->mask |= SD_BUS_CREDS_PID & mask;
+ }
+
+ if (bus->ucred.uid != (uid_t) -1) {
+ c->uid = bus->ucred.uid;
+ c->mask |= SD_BUS_CREDS_UID & mask;
+ }
- c->mask |= (SD_BUS_CREDS_UID | SD_BUS_CREDS_PID | SD_BUS_CREDS_GID) & mask;
+ if (bus->ucred.gid != (gid_t) -1) {
+ c->gid = bus->ucred.gid;
+ c->mask |= SD_BUS_CREDS_GID & mask;
+ }
}
if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
@@ -933,39 +965,6 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
c->mask |= SD_BUS_CREDS_SELINUX_CONTEXT;
}
- if (bus->is_kernel) {
- struct kdbus_cmd_info cmd = {};
- struct kdbus_info *creator_info;
-
- cmd.size = sizeof(cmd);
- cmd.flags = attach_flags_to_kdbus(mask);
-
- /* If augmentation is on, and the bus doesn't didn't allow us
- * to get the bits we want, then ask for the PID/TID so that we
- * can read the rest from /proc. */
- if ((mask & SD_BUS_CREDS_AUGMENT) &&
- (mask & (SD_BUS_CREDS_UID|SD_BUS_CREDS_EUID|SD_BUS_CREDS_SUID|SD_BUS_CREDS_FSUID|
- SD_BUS_CREDS_GID|SD_BUS_CREDS_EGID|SD_BUS_CREDS_SGID|SD_BUS_CREDS_FSGID|
- SD_BUS_CREDS_COMM|SD_BUS_CREDS_TID_COMM|SD_BUS_CREDS_EXE|SD_BUS_CREDS_CMDLINE|
- SD_BUS_CREDS_CGROUP|SD_BUS_CREDS_UNIT|SD_BUS_CREDS_USER_UNIT|SD_BUS_CREDS_SLICE|SD_BUS_CREDS_SESSION|SD_BUS_CREDS_OWNER_UID|
- SD_BUS_CREDS_EFFECTIVE_CAPS|SD_BUS_CREDS_PERMITTED_CAPS|SD_BUS_CREDS_INHERITABLE_CAPS|SD_BUS_CREDS_BOUNDING_CAPS|
- SD_BUS_CREDS_SELINUX_CONTEXT|
- SD_BUS_CREDS_AUDIT_SESSION_ID|SD_BUS_CREDS_AUDIT_LOGIN_UID)))
- cmd.flags |= KDBUS_ATTACH_PIDS;
-
- r = ioctl(bus->input_fd, KDBUS_CMD_BUS_CREATOR_INFO, &cmd);
- if (r < 0)
- return -errno;
-
- creator_info = (struct kdbus_info *) ((uint8_t *) bus->kdbus_buffer + cmd.offset);
-
- r = bus_populate_creds_from_items(bus, creator_info, mask, c);
- kernel_cmd_free(bus, cmd.offset);
-
- if (r < 0)
- return r;
- }
-
r = bus_creds_add_more(c, mask, pid, 0);
if (r < 0)
return r;
@@ -975,6 +974,21 @@ _public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **r
return 0;
}
+_public_ int sd_bus_get_owner_creds(sd_bus *bus, uint64_t mask, sd_bus_creds **ret) {
+ assert_return(bus, -EINVAL);
+ assert_return((mask & ~SD_BUS_CREDS_AUGMENT) <= _SD_BUS_CREDS_ALL, -ENOTSUP);
+ assert_return(ret, -EINVAL);
+ assert_return(!bus_pid_changed(bus), -ECHILD);
+
+ if (!BUS_IS_OPEN(bus->state))
+ return -ENOTCONN;
+
+ if (bus->is_kernel)
+ return bus_get_owner_creds_kdbus(bus, mask, ret);
+ else
+ return bus_get_owner_creds_dbus1(bus, mask, ret);
+}
+
static int add_name_change_match(sd_bus *bus,
uint64_t cookie,
const char *name,
diff --git a/src/libsystemd/sd-bus/bus-kernel.c b/src/libsystemd/sd-bus/bus-kernel.c
index 5b4bbfd..c86ed6a 100644
--- a/src/libsystemd/sd-bus/bus-kernel.c
+++ b/src/libsystemd/sd-bus/bus-kernel.c
@@ -954,24 +954,37 @@ int bus_kernel_connect(sd_bus *b) {
return bus_kernel_take_fd(b);
}
+int bus_kernel_cmd_free(sd_bus *bus, uint64_t offset) {
+ struct kdbus_cmd_free cmd = {
+ .flags = 0,
+ .offset = offset,
+ };
+ int r;
+
+ assert(bus);
+ assert(bus->is_kernel);
+
+ r = ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
+ if (r < 0)
+ return -errno;
+
+ return 0;
+}
+
static void close_kdbus_msg(sd_bus *bus, struct kdbus_msg *k) {
- struct kdbus_cmd_free cmd = {};
struct kdbus_item *d;
assert(bus);
assert(k);
- cmd.offset = (uint8_t *)k - (uint8_t *)bus->kdbus_buffer;
-
KDBUS_ITEM_FOREACH(d, k, items) {
-
if (d->type == KDBUS_ITEM_FDS)
close_many(d->fds, (d->size - offsetof(struct kdbus_item, fds)) / sizeof(int));
else if (d->type == KDBUS_ITEM_PAYLOAD_MEMFD)
safe_close(d->memfd.fd);
}
- (void) ioctl(bus->input_fd, KDBUS_CMD_FREE, &cmd);
+ bus_kernel_cmd_free(bus, (uint8_t*) k - (uint8_t*) bus->kdbus_buffer);
}
int bus_kernel_write_message(sd_bus *bus, sd_bus_message *m, bool hint_sync_call) {
diff --git a/src/libsystemd/sd-bus/bus-kernel.h b/src/libsystemd/sd-bus/bus-kernel.h
index 0db8fd3..0d406fb 100644
--- a/src/libsystemd/sd-bus/bus-kernel.h
+++ b/src/libsystemd/sd-bus/bus-kernel.h
@@ -91,3 +91,5 @@ int bus_kernel_drop_one(int fd);
int bus_kernel_realize_attach_flags(sd_bus *bus);
int bus_kernel_fix_attach_mask(void);
+
+int bus_kernel_cmd_free(sd_bus *bus, uint64_t offset);
More information about the systemd-commits
mailing list