|
 |
803fb7 |
From d491fd1068446f74992e76154e5e9d57bd67e7ac Mon Sep 17 00:00:00 2001
|
|
|
803fb7 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
803fb7 |
Date: Sat, 6 Jun 2015 21:24:45 -0400
|
|
|
803fb7 |
Subject: [PATCH] sd-bus: store selinux context at connection time
|
|
|
803fb7 |
|
|
|
803fb7 |
This appears to be the right time to do it for SOCK_STREAM
|
|
|
803fb7 |
unix sockets.
|
|
|
803fb7 |
|
|
|
803fb7 |
Also: condition bus_get_owner_creds_dbus1 was reversed. Split
|
|
|
803fb7 |
it out to a separate variable for clarity and fix.
|
|
|
803fb7 |
|
|
|
803fb7 |
https://bugzilla.redhat.com/show_bug.cgi?id=1224211
|
|
|
803fb7 |
|
|
|
803fb7 |
Cherry-picked from: c4e6556
|
|
|
803fb7 |
Related: #1230190
|
|
|
803fb7 |
---
|
|
|
803fb7 |
src/libsystemd/sd-bus/bus-control.c | 6 ++++--
|
|
|
803fb7 |
src/libsystemd/sd-bus/bus-internal.h | 2 +-
|
|
|
803fb7 |
src/libsystemd/sd-bus/bus-socket.c | 7 +++++++
|
|
|
803fb7 |
src/libsystemd/sd-bus/sd-bus.c | 1 +
|
|
|
803fb7 |
4 files changed, 13 insertions(+), 3 deletions(-)
|
|
|
803fb7 |
|
|
|
803fb7 |
diff --git a/src/libsystemd/sd-bus/bus-control.c b/src/libsystemd/sd-bus/bus-control.c
|
|
|
803fb7 |
index 06e5b4fd9..8b84b9496 100644
|
|
|
803fb7 |
--- a/src/libsystemd/sd-bus/bus-control.c
|
|
|
803fb7 |
+++ b/src/libsystemd/sd-bus/bus-control.c
|
|
|
803fb7 |
@@ -945,8 +945,10 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
|
|
|
803fb7 |
_cleanup_bus_creds_unref_ sd_bus_creds *c = NULL;
|
|
|
803fb7 |
pid_t pid = 0;
|
|
|
803fb7 |
int r;
|
|
|
803fb7 |
+ bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT);
|
|
|
803fb7 |
|
|
|
803fb7 |
- if (!bus->ucred_valid && !isempty(bus->label))
|
|
|
803fb7 |
+ /* Avoid allocating anything if we have no chance of returning useful data */
|
|
|
803fb7 |
+ if (!bus->ucred_valid && !do_label)
|
|
|
803fb7 |
return -ENODATA;
|
|
|
803fb7 |
|
|
|
803fb7 |
c = bus_creds_new();
|
|
|
803fb7 |
@@ -970,7 +972,7 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds **
|
|
|
803fb7 |
}
|
|
|
803fb7 |
}
|
|
|
803fb7 |
|
|
|
803fb7 |
- if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) {
|
|
|
803fb7 |
+ if (do_label) {
|
|
|
803fb7 |
c->label = strdup(bus->label);
|
|
|
803fb7 |
if (!c->label)
|
|
|
803fb7 |
return -ENOMEM;
|
|
|
803fb7 |
diff --git a/src/libsystemd/sd-bus/bus-internal.h b/src/libsystemd/sd-bus/bus-internal.h
|
|
|
803fb7 |
index e9f1a816a..071b3da79 100644
|
|
|
803fb7 |
--- a/src/libsystemd/sd-bus/bus-internal.h
|
|
|
803fb7 |
+++ b/src/libsystemd/sd-bus/bus-internal.h
|
|
|
803fb7 |
@@ -262,7 +262,7 @@ struct sd_bus {
|
|
|
803fb7 |
usec_t auth_timeout;
|
|
|
803fb7 |
|
|
|
803fb7 |
struct ucred ucred;
|
|
|
803fb7 |
- char label[NAME_MAX];
|
|
|
803fb7 |
+ char *label;
|
|
|
803fb7 |
|
|
|
803fb7 |
uint64_t creds_mask;
|
|
|
803fb7 |
|
|
|
803fb7 |
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
|
|
|
803fb7 |
index abd9ece01..d00cd014e 100644
|
|
|
803fb7 |
--- a/src/libsystemd/sd-bus/bus-socket.c
|
|
|
803fb7 |
+++ b/src/libsystemd/sd-bus/bus-socket.c
|
|
|
803fb7 |
@@ -600,10 +600,17 @@ void bus_socket_setup(sd_bus *b) {
|
|
|
803fb7 |
}
|
|
|
803fb7 |
|
|
|
803fb7 |
static void bus_get_peercred(sd_bus *b) {
|
|
|
803fb7 |
+ int r;
|
|
|
803fb7 |
+
|
|
|
803fb7 |
assert(b);
|
|
|
803fb7 |
|
|
|
803fb7 |
/* Get the peer for socketpair() sockets */
|
|
|
803fb7 |
b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0;
|
|
|
803fb7 |
+
|
|
|
803fb7 |
+ /* Get the SELinux context of the peer */
|
|
|
803fb7 |
+ r = getpeersec(b->input_fd, &b->label);
|
|
|
803fb7 |
+ if (r < 0 && r != -EOPNOTSUPP)
|
|
|
803fb7 |
+ log_debug_errno(r, "Failed to determine peer security context: %m");
|
|
|
803fb7 |
}
|
|
|
803fb7 |
|
|
|
803fb7 |
static int bus_socket_start_auth_client(sd_bus *b) {
|
|
|
803fb7 |
diff --git a/src/libsystemd/sd-bus/sd-bus.c b/src/libsystemd/sd-bus/sd-bus.c
|
|
|
803fb7 |
index cac9b6560..b0a323792 100644
|
|
|
803fb7 |
--- a/src/libsystemd/sd-bus/sd-bus.c
|
|
|
803fb7 |
+++ b/src/libsystemd/sd-bus/sd-bus.c
|
|
|
803fb7 |
@@ -121,6 +121,7 @@ static void bus_free(sd_bus *b) {
|
|
|
803fb7 |
if (b->kdbus_buffer)
|
|
|
803fb7 |
munmap(b->kdbus_buffer, KDBUS_POOL_SIZE);
|
|
|
803fb7 |
|
|
|
803fb7 |
+ free(b->label);
|
|
|
803fb7 |
free(b->rbuffer);
|
|
|
803fb7 |
free(b->unique_name);
|
|
|
803fb7 |
free(b->auth_buffer);
|