diff options
| -rw-r--r-- | src/machine/image-dbus.c | 62 | ||||
| -rw-r--r-- | src/machine/machine-dbus.c | 58 | ||||
| -rw-r--r-- | src/machine/machined-dbus.c | 22 | ||||
| -rw-r--r-- | src/machine/org.freedesktop.machine1.policy.in | 22 | ||||
| -rw-r--r-- | src/shared/machine-image.h | 2 |
5 files changed, 147 insertions, 19 deletions
diff --git a/src/machine/image-dbus.c b/src/machine/image-dbus.c index f5c7d4d880..0d4ebde92b 100644 --- a/src/machine/image-dbus.c +++ b/src/machine/image-dbus.c @@ -35,12 +35,25 @@ int bus_image_method_remove( sd_bus_error *error) { Image *image = userdata; + Manager *m = image->userdata; int r; assert(bus); assert(message); assert(image); + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-images", + false, + &m->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = image_remove(image); if (r < 0) return r; @@ -55,6 +68,7 @@ int bus_image_method_rename( sd_bus_error *error) { Image *image = userdata; + Manager *m = image->userdata; const char *new_name; int r; @@ -69,6 +83,18 @@ int bus_image_method_rename( if (!image_name_is_valid(new_name)) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Image name '%s' is invalid.", new_name); + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-images", + false, + &m->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = image_rename(image, new_name); if (r < 0) return r; @@ -83,6 +109,7 @@ int bus_image_method_clone( sd_bus_error *error) { Image *image = userdata; + Manager *m = image->userdata; const char *new_name; int r, read_only; @@ -97,6 +124,18 @@ int bus_image_method_clone( if (!image_name_is_valid(new_name)) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Image name '%s' is invalid.", new_name); + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-images", + false, + &m->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = image_clone(image, new_name, read_only); if (r < 0) return r; @@ -111,6 +150,7 @@ int bus_image_method_mark_read_only( sd_bus_error *error) { Image *image = userdata; + Manager *m = image->userdata; int r, read_only; assert(bus); @@ -120,6 +160,18 @@ int bus_image_method_mark_read_only( if (r < 0) return r; + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-images", + false, + &m->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = image_read_only(image, read_only); if (r < 0) return r; @@ -139,10 +191,10 @@ const sd_bus_vtable image_vtable[] = { SD_BUS_PROPERTY("Limit", "t", NULL, offsetof(Image, limit), 0), SD_BUS_PROPERTY("UsageExclusive", "t", NULL, offsetof(Image, usage_exclusive), 0), SD_BUS_PROPERTY("LimitExclusive", "t", NULL, offsetof(Image, limit_exclusive), 0), - SD_BUS_METHOD("Remove", NULL, NULL, bus_image_method_remove, 0), - SD_BUS_METHOD("Rename", "s", NULL, bus_image_method_rename, 0), - SD_BUS_METHOD("Clone", "sb", NULL, bus_image_method_clone, 0), - SD_BUS_METHOD("MarkReadOnly", "b", NULL, bus_image_method_mark_read_only, 0), + SD_BUS_METHOD("Remove", NULL, NULL, bus_image_method_remove, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Rename", "s", NULL, bus_image_method_rename, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Clone", "sb", NULL, bus_image_method_clone, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("MarkReadOnly", "b", NULL, bus_image_method_mark_read_only, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_VTABLE_END }; @@ -207,6 +259,8 @@ int image_object_find(sd_bus *bus, const char *path, const char *interface, void if (r <= 0) return r; + image->userdata = m; + r = hashmap_put(m->image_cache, image->name, image); if (r < 0) { image_unref(image); diff --git a/src/machine/machine-dbus.c b/src/machine/machine-dbus.c index 216c9c1d0d..405c072b90 100644 --- a/src/machine/machine-dbus.c +++ b/src/machine/machine-dbus.c @@ -128,6 +128,18 @@ int bus_machine_method_terminate(sd_bus *bus, sd_bus_message *message, void *use assert(message); assert(m); + r = bus_verify_polkit_async( + message, + CAP_KILL, + "org.freedesktop.machine1.manage-machines", + false, + &m->manager->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = machine_stop(m); if (r < 0) return r; @@ -161,6 +173,18 @@ int bus_machine_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata if (signo <= 0 || signo >= _NSIG) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid signal %i", signo); + r = bus_verify_polkit_async( + message, + CAP_KILL, + "org.freedesktop.machine1.manage-machines", + false, + &m->manager->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + r = machine_kill(m, who, signo); if (r < 0) return r; @@ -554,6 +578,18 @@ int bus_machine_method_bind_mount(sd_bus *bus, sd_bus_message *message, void *us else if (!path_is_absolute(dest) || !path_is_safe(dest)) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path must be absolute and not contain ../."); + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-machines", + false, + &m->manager->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + /* One day, when bind mounting /proc/self/fd/n works across * namespace boundaries we should rework this logic to make * use of it... */ @@ -800,6 +836,18 @@ int bus_machine_method_copy(sd_bus *bus, sd_bus_message *message, void *userdata else if (!path_is_absolute(dest) || !path_is_safe(dest)) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Destination path must be absolute and not contain ../."); + r = bus_verify_polkit_async( + message, + CAP_SYS_ADMIN, + "org.freedesktop.machine1.manage-machines", + false, + &m->manager->polkit_registry, + error); + if (r < 0) + return r; + if (r == 0) + return 1; /* Will call us back */ + copy_from = strstr(sd_bus_message_get_member(message), "CopyFrom"); if (copy_from) { @@ -916,15 +964,15 @@ const sd_bus_vtable machine_vtable[] = { SD_BUS_PROPERTY("RootDirectory", "s", NULL, offsetof(Machine, root_directory), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("NetworkInterfaces", "ai", property_get_netif, 0, SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("State", "s", property_get_state, 0, 0), - SD_BUS_METHOD("Terminate", NULL, NULL, bus_machine_method_terminate, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), - SD_BUS_METHOD("Kill", "si", NULL, bus_machine_method_kill, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), + SD_BUS_METHOD("Terminate", NULL, NULL, bus_machine_method_terminate, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("Kill", "si", NULL, bus_machine_method_kill, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("GetAddresses", NULL, "a(iay)", bus_machine_method_get_addresses, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("GetOSRelease", NULL, "a{ss}", bus_machine_method_get_os_release, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("OpenPTY", NULL, "hs", bus_machine_method_open_pty, 0), SD_BUS_METHOD("OpenLogin", NULL, "hs", bus_machine_method_open_login, SD_BUS_VTABLE_UNPRIVILEGED), - SD_BUS_METHOD("BindMount", "ssbb", NULL, bus_machine_method_bind_mount, 0), - SD_BUS_METHOD("CopyFrom", "ss", NULL, bus_machine_method_copy, 0), - SD_BUS_METHOD("CopyTo", "ss", NULL, bus_machine_method_copy, 0), + SD_BUS_METHOD("BindMount", "ssbb", NULL, bus_machine_method_bind_mount, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CopyFrom", "ss", NULL, bus_machine_method_copy, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CopyTo", "ss", NULL, bus_machine_method_copy, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_VTABLE_END }; diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c index 155146b938..7a9ac2f349 100644 --- a/src/machine/machined-dbus.c +++ b/src/machine/machined-dbus.c @@ -622,6 +622,7 @@ static int method_remove_image(sd_bus *bus, sd_bus_message *message, void *userd if (r == 0) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_IMAGE, "No image '%s' known", name); + i->userdata = userdata; return bus_image_method_remove(bus, message, i, error); } @@ -646,6 +647,7 @@ static int method_rename_image(sd_bus *bus, sd_bus_message *message, void *userd if (r == 0) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_IMAGE, "No image '%s' known", old_name); + i->userdata = userdata; return bus_image_method_rename(bus, message, i, error); } @@ -668,6 +670,7 @@ static int method_clone_image(sd_bus *bus, sd_bus_message *message, void *userda if (r == 0) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_IMAGE, "No image '%s' known", old_name); + i->userdata = userdata; return bus_image_method_clone(bus, message, i, error); } @@ -690,6 +693,7 @@ static int method_mark_image_read_only(sd_bus *bus, sd_bus_message *message, voi if (r == 0) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_IMAGE, "No image '%s' known", name); + i->userdata = userdata; return bus_image_method_mark_read_only(bus, message, i, error); } @@ -704,19 +708,19 @@ const sd_bus_vtable manager_vtable[] = { SD_BUS_METHOD("CreateMachineWithNetwork", "sayssusaia(sv)", "o", method_create_machine_with_network, 0), SD_BUS_METHOD("RegisterMachine", "sayssus", "o", method_register_machine, 0), SD_BUS_METHOD("RegisterMachineWithNetwork", "sayssusai", "o", method_register_machine_with_network, 0), - SD_BUS_METHOD("TerminateMachine", "s", NULL, method_terminate_machine, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), - SD_BUS_METHOD("KillMachine", "ssi", NULL, method_kill_machine, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), + SD_BUS_METHOD("TerminateMachine", "s", NULL, method_terminate_machine, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("KillMachine", "ssi", NULL, method_kill_machine, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("GetMachineAddresses", "s", "a(iay)", method_get_machine_addresses, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("GetMachineOSRelease", "s", "a{ss}", method_get_machine_os_release, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_METHOD("OpenMachinePTY", "s", "hs", method_open_machine_pty, 0), SD_BUS_METHOD("OpenMachineLogin", "s", "hs", method_open_machine_login, SD_BUS_VTABLE_UNPRIVILEGED), - SD_BUS_METHOD("BindMountMachine", "sssbb", NULL, method_bind_mount_machine, 0), - SD_BUS_METHOD("CopyFromMachine", "sss", NULL, method_copy_machine, 0), - SD_BUS_METHOD("CopyToMachine", "sss", NULL, method_copy_machine, 0), - SD_BUS_METHOD("RemoveImage", "s", NULL, method_remove_image, 0), - SD_BUS_METHOD("RenameImage", "ss", NULL, method_rename_image, 0), - SD_BUS_METHOD("CloneImage", "ssb", NULL, method_clone_image, 0), - SD_BUS_METHOD("MarkImageReadOnly", "sb", NULL, method_mark_image_read_only, 0), + SD_BUS_METHOD("BindMountMachine", "sssbb", NULL, method_bind_mount_machine, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CopyFromMachine", "sss", NULL, method_copy_machine, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CopyToMachine", "sss", NULL, method_copy_machine, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("RemoveImage", "s", NULL, method_remove_image, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("RenameImage", "ss", NULL, method_rename_image, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("CloneImage", "ssb", NULL, method_clone_image, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_METHOD("MarkImageReadOnly", "sb", NULL, method_mark_image_read_only, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_SIGNAL("MachineNew", "so", 0), SD_BUS_SIGNAL("MachineRemoved", "so", 0), SD_BUS_VTABLE_END diff --git a/src/machine/org.freedesktop.machine1.policy.in b/src/machine/org.freedesktop.machine1.policy.in index 43478a84d6..02714e83ae 100644 --- a/src/machine/org.freedesktop.machine1.policy.in +++ b/src/machine/org.freedesktop.machine1.policy.in @@ -18,7 +18,27 @@ <action id="org.freedesktop.machine1.login"> <_description>Log into a local container</_description> - <_message>Authentication is required to log into a local container</_message> + <_message>Authentication is required to log into a local container.</_message> + <defaults> + <allow_any>auth_admin</allow_any> + <allow_inactive>auth_admin</allow_inactive> + <allow_active>auth_admin_keep</allow_active> + </defaults> + </action> + + <action id="org.freedesktop.machine1.manage-machines"> + <_description>Manage local virtual machines and containers</_description> + <_message>Authentication is required to manage local virtual machines and containers.</_message> + <defaults> + <allow_any>auth_admin</allow_any> + <allow_inactive>auth_admin</allow_inactive> + <allow_active>auth_admin_keep</allow_active> + </defaults> + </action> + + <action id="org.freedesktop.machine1.manage-images"> + <_description>Manage local virtual machine and container images</_description> + <_message>Authentication is required to manage local virtual machine and container images.</_message> <defaults> <allow_any>auth_admin</allow_any> <allow_inactive>auth_admin</allow_inactive> diff --git a/src/shared/machine-image.h b/src/shared/machine-image.h index 75fa5f4533..314fd6da58 100644 --- a/src/shared/machine-image.h +++ b/src/shared/machine-image.h @@ -45,6 +45,8 @@ typedef struct Image { uint64_t usage_exclusive; uint64_t limit; uint64_t limit_exclusive; + + void *userdata; } Image; Image *image_unref(Image *i); |