|
 |
923a60 |
From d0986e46b74de3b131fccbf79bd00de5ff054f71 Mon Sep 17 00:00:00 2001
|
|
|
923a60 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
923a60 |
Date: Sat, 6 Jun 2015 18:59:27 -0400
|
|
|
923a60 |
Subject: [PATCH] sd-bus: do not use per-datagram auxiliary information
|
|
|
923a60 |
|
|
|
923a60 |
SELinux information cannot be retrieved this way, since we are
|
|
|
923a60 |
using stream unix sockets and SCM_SECURITY does not work for
|
|
|
923a60 |
them.
|
|
|
923a60 |
|
|
|
923a60 |
SCM_CREDENTIALS use dropped to be consistent. We also should
|
|
|
923a60 |
get this information at connection time.
|
|
|
923a60 |
|
|
|
923a60 |
https://bugzilla.redhat.com/show_bug.cgi?id=1224211
|
|
|
923a60 |
"SCM_SECURITY was only added for datagram sockets."
|
|
|
923a60 |
|
|
|
923a60 |
Cherry-picked from: d868f2a
|
|
|
923a60 |
Related: #1230190
|
|
|
923a60 |
---
|
|
|
923a60 |
src/libsystemd/sd-bus/bus-socket.c | 70 +++++-------------------------
|
|
|
923a60 |
1 file changed, 12 insertions(+), 58 deletions(-)
|
|
|
923a60 |
|
|
|
923a60 |
diff --git a/src/libsystemd/sd-bus/bus-socket.c b/src/libsystemd/sd-bus/bus-socket.c
|
|
|
923a60 |
index 52883fa8cd..abd9ece016 100644
|
|
|
923a60 |
--- a/src/libsystemd/sd-bus/bus-socket.c
|
|
|
923a60 |
+++ b/src/libsystemd/sd-bus/bus-socket.c
|
|
|
923a60 |
@@ -501,9 +501,7 @@ static int bus_socket_read_auth(sd_bus *b) {
|
|
|
923a60 |
void *p;
|
|
|
923a60 |
union {
|
|
|
923a60 |
struct cmsghdr cmsghdr;
|
|
|
923a60 |
- uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX) +
|
|
|
923a60 |
- CMSG_SPACE(sizeof(struct ucred)) +
|
|
|
923a60 |
- CMSG_SPACE(NAME_MAX)]; /*selinux label */
|
|
|
923a60 |
+ uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
|
|
|
923a60 |
} control;
|
|
|
923a60 |
struct cmsghdr *cmsg;
|
|
|
923a60 |
bool handle_cmsg = false;
|
|
|
923a60 |
@@ -556,8 +554,8 @@ static int bus_socket_read_auth(sd_bus *b) {
|
|
|
923a60 |
|
|
|
923a60 |
b->rbuffer_size += k;
|
|
|
923a60 |
|
|
|
923a60 |
- if (handle_cmsg) {
|
|
|
923a60 |
- for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
|
|
|
923a60 |
+ if (handle_cmsg)
|
|
|
923a60 |
+ for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
|
|
|
923a60 |
if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
cmsg->cmsg_type == SCM_RIGHTS) {
|
|
|
923a60 |
int j;
|
|
|
923a60 |
@@ -568,31 +566,9 @@ static int bus_socket_read_auth(sd_bus *b) {
|
|
|
923a60 |
j = (cmsg->cmsg_len - CMSG_LEN(0)) / sizeof(int);
|
|
|
923a60 |
close_many((int*) CMSG_DATA(cmsg), j);
|
|
|
923a60 |
return -EIO;
|
|
|
923a60 |
-
|
|
|
923a60 |
- } else if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
- cmsg->cmsg_type == SCM_CREDENTIALS &&
|
|
|
923a60 |
- cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
|
|
|
923a60 |
-
|
|
|
923a60 |
- /* Ignore bogus data, which we might
|
|
|
923a60 |
- * get on socketpair() sockets */
|
|
|
923a60 |
- if (((struct ucred*) CMSG_DATA(cmsg))->pid != 0) {
|
|
|
923a60 |
- memcpy(&b->ucred, CMSG_DATA(cmsg), sizeof(struct ucred));
|
|
|
923a60 |
- b->ucred_valid = true;
|
|
|
923a60 |
- }
|
|
|
923a60 |
-
|
|
|
923a60 |
- } else if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
- cmsg->cmsg_type == SCM_SECURITY) {
|
|
|
923a60 |
-
|
|
|
923a60 |
- size_t l;
|
|
|
923a60 |
-
|
|
|
923a60 |
- l = cmsg->cmsg_len - CMSG_LEN(0);
|
|
|
923a60 |
- if (l > 0) {
|
|
|
923a60 |
- memcpy(&b->label, CMSG_DATA(cmsg), l);
|
|
|
923a60 |
- b->label[l] = 0;
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
+ } else
|
|
|
923a60 |
+ log_debug("Got unexpected auxiliary data with level=%d and type=%d",
|
|
|
923a60 |
+ cmsg->cmsg_level, cmsg->cmsg_type);
|
|
|
923a60 |
|
|
|
923a60 |
r = bus_socket_auth_verify(b);
|
|
|
923a60 |
if (r != 0)
|
|
|
923a60 |
@@ -945,9 +921,7 @@ int bus_socket_read_message(sd_bus *bus) {
|
|
|
923a60 |
void *b;
|
|
|
923a60 |
union {
|
|
|
923a60 |
struct cmsghdr cmsghdr;
|
|
|
923a60 |
- uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX) +
|
|
|
923a60 |
- CMSG_SPACE(sizeof(struct ucred)) +
|
|
|
923a60 |
- CMSG_SPACE(NAME_MAX)]; /*selinux label */
|
|
|
923a60 |
+ uint8_t buf[CMSG_SPACE(sizeof(int) * BUS_FDS_MAX)];
|
|
|
923a60 |
} control;
|
|
|
923a60 |
struct cmsghdr *cmsg;
|
|
|
923a60 |
bool handle_cmsg = false;
|
|
|
923a60 |
@@ -995,8 +969,8 @@ int bus_socket_read_message(sd_bus *bus) {
|
|
|
923a60 |
|
|
|
923a60 |
bus->rbuffer_size += k;
|
|
|
923a60 |
|
|
|
923a60 |
- if (handle_cmsg) {
|
|
|
923a60 |
- for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg)) {
|
|
|
923a60 |
+ if (handle_cmsg)
|
|
|
923a60 |
+ for (cmsg = CMSG_FIRSTHDR(&mh); cmsg; cmsg = CMSG_NXTHDR(&mh, cmsg))
|
|
|
923a60 |
if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
cmsg->cmsg_type == SCM_RIGHTS) {
|
|
|
923a60 |
int n, *f;
|
|
|
923a60 |
@@ -1021,29 +995,9 @@ int bus_socket_read_message(sd_bus *bus) {
|
|
|
923a60 |
memcpy(f + bus->n_fds, CMSG_DATA(cmsg), n * sizeof(int));
|
|
|
923a60 |
bus->fds = f;
|
|
|
923a60 |
bus->n_fds += n;
|
|
|
923a60 |
- } else if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
- cmsg->cmsg_type == SCM_CREDENTIALS &&
|
|
|
923a60 |
- cmsg->cmsg_len == CMSG_LEN(sizeof(struct ucred))) {
|
|
|
923a60 |
-
|
|
|
923a60 |
- /* Ignore bogus data, which we might
|
|
|
923a60 |
- * get on socketpair() sockets */
|
|
|
923a60 |
- if (((struct ucred*) CMSG_DATA(cmsg))->pid != 0) {
|
|
|
923a60 |
- memcpy(&bus->ucred, CMSG_DATA(cmsg), sizeof(struct ucred));
|
|
|
923a60 |
- bus->ucred_valid = true;
|
|
|
923a60 |
- }
|
|
|
923a60 |
-
|
|
|
923a60 |
- } else if (cmsg->cmsg_level == SOL_SOCKET &&
|
|
|
923a60 |
- cmsg->cmsg_type == SCM_SECURITY) {
|
|
|
923a60 |
-
|
|
|
923a60 |
- size_t l;
|
|
|
923a60 |
- l = cmsg->cmsg_len - CMSG_LEN(0);
|
|
|
923a60 |
- if (l > 0) {
|
|
|
923a60 |
- memcpy(&bus->label, CMSG_DATA(cmsg), l);
|
|
|
923a60 |
- bus->label[l] = 0;
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
- }
|
|
|
923a60 |
+ } else
|
|
|
923a60 |
+ log_debug("Got unexpected auxiliary data with level=%d and type=%d",
|
|
|
923a60 |
+ cmsg->cmsg_level, cmsg->cmsg_type);
|
|
|
923a60 |
|
|
|
923a60 |
r = bus_socket_read_message_need(bus, &need);
|
|
|
923a60 |
if (r < 0)
|