sd-bus: store selinux context at connection time
This appears to be the right time to do it for SOCK_STREAM unix sockets. Also: condition bus_get_owner_creds_dbus1 was reversed. Split it out to a separate variable for clarity and fix. https://bugzilla.redhat.com/show_bug.cgi?id=1224211
This commit is contained in:
parent
d868f2a3a1
commit
c4e6556c46
|
@ -979,8 +979,10 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
|
||||||
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
|
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
|
||||||
pid_t pid = 0;
|
pid_t pid = 0;
|
||||||
int r;
|
int r;
|
||||||
|
bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
|
||||||
|
|
||||||
if (!bus->ucred_valid && !isempty(bus->label))
|
/* Avoid allocating anything if we have no chance of returning useful data */
|
||||||
|
if (!bus->ucred_valid && !do_label)
|
||||||
return -ENODATA;
|
return -ENODATA;
|
||||||
|
|
||||||
c = bus_creds_new();
|
c = bus_creds_new();
|
||||||
|
@ -1004,7 +1006,7 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
|
if (do_label) {
|
||||||
c->label = strdup(bus->label);
|
c->label = strdup(bus->label);
|
||||||
if (!c->label)
|
if (!c->label)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
|
|
@ -261,7 +261,7 @@ struct sd_bus {
|
||||||
usec_t auth_timeout;
|
usec_t auth_timeout;
|
||||||
|
|
||||||
struct ucred ucred;
|
struct ucred ucred;
|
||||||
char label[NAME_MAX];
|
char *label;
|
||||||
|
|
||||||
uint64_t creds_mask;
|
uint64_t creds_mask;
|
||||||
|
|
||||||
|
|
|
@ -588,10 +588,17 @@ void bus_socket_setup(sd_bus *b) {
|
||||||
}
|
}
|
||||||
|
|
||||||
static void bus_get_peercred(sd_bus *b) {
|
static void bus_get_peercred(sd_bus *b) {
|
||||||
|
int r;
|
||||||
|
|
||||||
assert(b);
|
assert(b);
|
||||||
|
|
||||||
/* Get the peer for socketpair() sockets */
|
/* Get the peer for socketpair() sockets */
|
||||||
b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
|
b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
|
||||||
|
|
||||||
|
/* Get the SELinux context of the peer */
|
||||||
|
r = getpeersec(b->input_fd, &b->label);
|
||||||
|
if (r < 0 && r != -EOPNOTSUPP)
|
||||||
|
log_debug_errno(r, "Failed to determine peer security context: %m");
|
||||||
}
|
}
|
||||||
|
|
||||||
static int bus_socket_start_auth_client(sd_bus *b) {
|
static int bus_socket_start_auth_client(sd_bus *b) {
|
||||||
|
|
|
@ -116,6 +116,7 @@ static void bus_free(sd_bus *b) {
|
||||||
if (b->kdbus_buffer)
|
if (b->kdbus_buffer)
|
||||||
munmap(b->kdbus_buffer, KDBUS_POOL_SIZE);
|
munmap(b->kdbus_buffer, KDBUS_POOL_SIZE);
|
||||||
|
|
||||||
|
free(b->label);
|
||||||
free(b->rbuffer);
|
free(b->rbuffer);
|
||||||
free(b->unique_name);
|
free(b->unique_name);
|
||||||
free(b->auth_buffer);
|
free(b->auth_buffer);
|
||||||
|
|
Loading…
Reference in a new issue