summaryrefslogtreecommitdiff
path: root/src/core/dbus-snapshot.c
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2015-02-18 17:40:57 +0100
committerLennart Poettering <lennart@poettering.net>2015-02-18 18:56:27 +0100
commit1d22e9068c52c1cf935bcdff70b9b9654e3c939e (patch)
tree7dffbb33c9d509fcaef5a38864410c778f187ae4 /src/core/dbus-snapshot.c
parent09c3a9b67d9e2e957bfb5c940e02ec433113549f (diff)
core: rework policykit hookup
- Always issue selinux access check as early as possible, and PK check as late as possible. - Introduce a new policykit action for altering environment - Open most remaining bus calls to unprivileged clients via PK
Diffstat (limited to 'src/core/dbus-snapshot.c')
-rw-r--r--src/core/dbus-snapshot.c9
1 files changed, 8 insertions, 1 deletions
diff --git a/src/core/dbus-snapshot.c b/src/core/dbus-snapshot.c
index 06a58e429e..a1959defce 100644
--- a/src/core/dbus-snapshot.c
+++ b/src/core/dbus-snapshot.c
@@ -21,6 +21,7 @@
#include "selinux-access.h"
#include "unit.h"
+#include "dbus.h"
#include "snapshot.h"
#include "dbus-unit.h"
#include "dbus-snapshot.h"
@@ -37,6 +38,12 @@ int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userd
if (r < 0)
return r;
+ r = bus_verify_manage_units_async(UNIT(s)->manager, message, error);
+ if (r < 0)
+ return r;
+ if (r == 0)
+ return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+
snapshot_remove(s);
return sd_bus_reply_method_return(message, NULL);
@@ -44,7 +51,7 @@ int bus_snapshot_method_remove(sd_bus *bus, sd_bus_message *message, void *userd
const sd_bus_vtable bus_snapshot_vtable[] = {
SD_BUS_VTABLE_START(0),
- SD_BUS_METHOD("Remove", NULL, NULL, bus_snapshot_method_remove, 0),
SD_BUS_PROPERTY("Cleanup", "b", bus_property_get_bool, offsetof(Snapshot, cleanup), SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_METHOD("Remove", NULL, NULL, bus_snapshot_method_remove, SD_BUS_VTABLE_UNPRIVILEGED),
SD_BUS_VTABLE_END
};