summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLennart Poettering <lennart@poettering.net>2012-03-13 00:00:27 +0100
committerLennart Poettering <lennart@poettering.net>2012-03-13 00:00:27 +0100
commit54ecda32c60c6f2548f74703bfd324694393edaa (patch)
treed9747c30a1985b3b95497450ca1c2678a9079d08 /src
parentfa734f4da837abe6c893e75c95be78527db72c0f (diff)
socket: add option for SO_PASSEC
https://bugzilla.redhat.com/show_bug.cgi?id=798760 (Note that this work is not complete yet, as the kernel seems to send us useless data with SCM_SECURITY enabled)
Diffstat (limited to 'src')
-rw-r--r--src/dbus-socket.c2
-rw-r--r--src/journal/journald.c10
-rw-r--r--src/load-fragment-gperf.gperf.m41
-rw-r--r--src/missing.h4
-rw-r--r--src/socket.c8
-rw-r--r--src/socket.h1
6 files changed, 26 insertions, 0 deletions
diff --git a/src/dbus-socket.c b/src/dbus-socket.c
index 9fef6769f0..2e3342cb55 100644
--- a/src/dbus-socket.c
+++ b/src/dbus-socket.c
@@ -52,6 +52,7 @@
" <property name=\"Transparent\" type=\"b\" access=\"read\"/>\n" \
" <property name=\"Broadcast\" type=\"b\" access=\"read\"/>\n" \
" <property name=\"PassCredentials\" type=\"b\" access=\"read\"/>\n" \
+ " <property name=\"PassSecurity\" type=\"b\" access=\"read\"/>\n" \
" <property name=\"Mark\" type=\"i\" access=\"read\"/>\n" \
" <property name=\"MaxConnections\" type=\"u\" access=\"read\"/>\n" \
" <property name=\"NAccepted\" type=\"u\" access=\"read\"/>\n" \
@@ -114,6 +115,7 @@ static const BusProperty bus_socket_properties[] = {
{ "Transparent", bus_property_append_bool, "b", offsetof(Socket, transparent) },
{ "Broadcast", bus_property_append_bool, "b", offsetof(Socket, broadcast) },
{ "PassCredentials",bus_property_append_bool, "b", offsetof(Socket, pass_cred) },
+ { "PassSecurity", bus_property_append_bool, "b", offsetof(Socket, pass_sec) },
{ "Mark", bus_property_append_int, "i", offsetof(Socket, mark) },
{ "MaxConnections", bus_property_append_unsigned, "u", offsetof(Socket, max_connections) },
{ "NConnections", bus_property_append_unsigned, "u", offsetof(Socket, n_connections) },
diff --git a/src/journal/journald.c b/src/journal/journald.c
index 73f8ed6ae8..375f5aa6ca 100644
--- a/src/journal/journald.c
+++ b/src/journal/journald.c
@@ -2253,6 +2253,11 @@ static int open_syslog_socket(Server *s) {
}
one = 1;
+ r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
+ if (r < 0)
+ log_warning("SO_PASSSEC failed: %m");
+
+ one = 1;
r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_TIMESTAMP, &one, sizeof(one));
if (r < 0) {
log_error("SO_TIMESTAMP failed: %m");
@@ -2309,6 +2314,11 @@ static int open_native_socket(Server*s) {
}
one = 1;
+ r = setsockopt(s->syslog_fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one));
+ if (r < 0)
+ log_warning("SO_PASSSEC failed: %m");
+
+ one = 1;
r = setsockopt(s->native_fd, SOL_SOCKET, SO_TIMESTAMP, &one, sizeof(one));
if (r < 0) {
log_error("SO_TIMESTAMP failed: %m");
diff --git a/src/load-fragment-gperf.gperf.m4 b/src/load-fragment-gperf.gperf.m4
index 44ce4bbbc4..4b02e3157e 100644
--- a/src/load-fragment-gperf.gperf.m4
+++ b/src/load-fragment-gperf.gperf.m4
@@ -186,6 +186,7 @@ Socket.FreeBind, config_parse_bool, 0,
Socket.Transparent, config_parse_bool, 0, offsetof(Socket, transparent)
Socket.Broadcast, config_parse_bool, 0, offsetof(Socket, broadcast)
Socket.PassCredentials, config_parse_bool, 0, offsetof(Socket, pass_cred)
+Socket.PassSecurity, config_parse_bool, 0, offsetof(Socket, pass_sec)
Socket.TCPCongestion, config_parse_string, 0, offsetof(Socket, tcp_congestion)
Socket.MessageQueueMaxMessages, config_parse_long, 0, offsetof(Socket, mq_maxmsg)
Socket.MessageQueueMessageSize, config_parse_long, 0, offsetof(Socket, mq_msgsize)
diff --git a/src/missing.h b/src/missing.h
index 213ef2f6a6..095bf1fe04 100644
--- a/src/missing.h
+++ b/src/missing.h
@@ -180,4 +180,8 @@ static inline pid_t gettid(void) {
return (pid_t) syscall(SYS_gettid);
}
+#ifndef SCM_SECURITY
+#define SCM_SECURITY 0x03
+#endif
+
#endif
diff --git a/src/socket.c b/src/socket.c
index aeedcbd7f3..ecaf3d2148 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -417,6 +417,7 @@ static void socket_dump(Unit *u, FILE *f, const char *prefix) {
"%sTransparent: %s\n"
"%sBroadcast: %s\n"
"%sPassCredentials: %s\n"
+ "%sPassSecurity: %s\n"
"%sTCPCongestion: %s\n",
prefix, socket_state_to_string(s->state),
prefix, socket_result_to_string(s->result),
@@ -429,6 +430,7 @@ static void socket_dump(Unit *u, FILE *f, const char *prefix) {
prefix, yes_no(s->transparent),
prefix, yes_no(s->broadcast),
prefix, yes_no(s->pass_cred),
+ prefix, yes_no(s->pass_sec),
prefix, strna(s->tcp_congestion));
if (s->control_pid > 0)
@@ -676,6 +678,12 @@ static void socket_apply_socket_options(Socket *s, int fd) {
log_warning("SO_PASSCRED failed: %m");
}
+ if (s->pass_sec) {
+ int one = 1;
+ if (setsockopt(fd, SOL_SOCKET, SO_PASSSEC, &one, sizeof(one)) < 0)
+ log_warning("SO_PASSSEC failed: %m");
+ }
+
if (s->priority >= 0)
if (setsockopt(fd, SOL_SOCKET, SO_PRIORITY, &s->priority, sizeof(s->priority)) < 0)
log_warning("SO_PRIORITY failed: %m");
diff --git a/src/socket.h b/src/socket.h
index 6f2af7cd61..6470d8b63e 100644
--- a/src/socket.h
+++ b/src/socket.h
@@ -129,6 +129,7 @@ struct Socket {
bool transparent;
bool broadcast;
bool pass_cred;
+ bool pass_sec;
int priority;
int mark;
size_t receive_buffer;