summaryrefslogtreecommitdiff
path: root/src/core/dbus-job.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-02-18 17:40:57 +0100
committerLennart Poettering <lennart@poettering.net>2015-02-18 18:56:27 +0100
commit1d22e9068c52c1cf935bcdff70b9b9654e3c939e (patch)
tree7dffbb33c9d509fcaef5a38864410c778f187ae4 /src/core/dbus-job.c
parent09c3a9b67d9e2e957bfb5c940e02ec433113549f (diff)
core: rework policykit hookup
- Always issue selinux access check as early as possible, and PK check as late as possible. - Introduce a new policykit action for altering environment - Open most remaining bus calls to unprivileged clients via PK
Diffstat (limited to 'src/core/dbus-job.c')
-rw-r--r--src/core/dbus-job.c31
1 files changed, 11 insertions, 20 deletions
diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index 8b5ea2566d..fa1d1f3389 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -29,22 +29,6 @@
static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_type, job_type, JobType);
static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_state, job_state, JobState);
-static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) {
- int r;
-
- if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message)))
- return 0; /* One of the job owners is calling us */
-
- r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN);
- if (r < 0)
- return r;
- if (r == 0)
- return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action");
-
- /* Root has called us */
- return 0;
-}
-
static int property_get_unit(
sd_bus *bus,
const char *path,
@@ -76,14 +60,21 @@ int bus_job_method_cancel(sd_bus *bus, sd_bus_message *message, void *userdata,
assert(message);
assert(j);
- r = verify_sys_admin_or_owner_sync(message, j, error);
- if (r < 0)
- return r;
-
r = mac_selinux_unit_access_check(j->unit, message, "stop", error);
if (r < 0)
return r;
+ /* Access is granted to the job owner */
+ if (!sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) {
+
+ /* And for everybody else consult PolicyKit */
+ r = bus_verify_manage_units_async(j->unit->manager, message, error);
+ if (r < 0)
+ return r;
+ if (r == 0)
+ return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+ }
+
job_finish_and_invalidate(j, JOB_CANCELED, true);
return sd_bus_reply_method_return(message, NULL);