summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/core/audit-fd.c8
-rw-r--r--src/core/dbus-job.c2
-rw-r--r--src/core/dbus-manager.c50
-rw-r--r--src/core/dbus-unit.c2
-rw-r--r--src/core/selinux-access.c98
-rw-r--r--src/core/selinux-access.h17
6 files changed, 69 insertions, 108 deletions
diff --git a/src/core/audit-fd.c b/src/core/audit-fd.c
index 0a8626fbc2..5955bd846e 100644
--- a/src/core/audit-fd.c
+++ b/src/core/audit-fd.c
@@ -19,16 +19,18 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
-#include <stdbool.h>
-#include <errno.h>
+#include <errno.h>
#include "audit-fd.h"
-#include "log.h"
#ifdef HAVE_AUDIT
+#include <stdbool.h>
#include <libaudit.h>
+#include "log.h"
+#include "util.h"
+
static bool initialized = false;
static int audit_fd;
diff --git a/src/core/dbus-job.c b/src/core/dbus-job.c
index 5a746840c8..fdc1dce177 100644
--- a/src/core/dbus-job.c
+++ b/src/core/dbus-job.c
@@ -143,7 +143,7 @@ static DBusHandlerResult bus_job_message_handler(DBusConnection *connection, DBu
Iterator i;
size_t size;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index b1b90787a9..9cdecfc6b8 100644
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -755,7 +755,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "ClearJobs")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
manager_clear_jobs(m);
@@ -765,7 +765,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "ResetFailed")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reload");
+ SELINUX_ACCESS_CHECK(connection, message, "reload");
manager_reset_failed(m);
@@ -804,7 +804,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
Unit *u;
const char *k;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
@@ -887,7 +887,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
Iterator i;
Job *j;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
@@ -946,7 +946,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
char *client;
Set *s;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
s = BUS_CONNECTION_SUBSCRIBED(m, connection);
if (!s) {
@@ -977,7 +977,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Unsubscribe")) {
char *client;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
client = set_remove(BUS_CONNECTION_SUBSCRIBED(m, connection), (char*) bus_message_get_sender_with_fallback(message));
if (!client) {
@@ -996,7 +996,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
char *dump = NULL;
size_t size;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
@@ -1028,7 +1028,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
dbus_bool_t cleanup;
Snapshot *s;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "start");
+ SELINUX_ACCESS_CHECK(connection, message, "start");
if (!dbus_message_get_args(
message,
@@ -1068,7 +1068,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
const char *k;
size_t size;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
@@ -1127,7 +1127,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Reload")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reload");
+ SELINUX_ACCESS_CHECK(connection, message, "reload");
assert(!m->queued_message);
@@ -1145,7 +1145,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Reexecute")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reload");
+ SELINUX_ACCESS_CHECK(connection, message, "reload");
/* We don't send a reply back here, the client should
* just wait for us disconnecting. */
@@ -1154,7 +1154,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Exit")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "halt");
+ SELINUX_ACCESS_CHECK(connection, message, "halt");
if (m->running_as == SYSTEMD_SYSTEM) {
dbus_set_error(&error, BUS_ERROR_NOT_SUPPORTED, "Exit is only supported for user service managers.");
@@ -1169,7 +1169,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Reboot")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
if (m->running_as != SYSTEMD_SYSTEM) {
dbus_set_error(&error, BUS_ERROR_NOT_SUPPORTED, "Reboot is only supported for system managers.");
@@ -1184,7 +1184,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "PowerOff")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "halt");
+ SELINUX_ACCESS_CHECK(connection, message, "halt");
if (m->running_as != SYSTEMD_SYSTEM) {
dbus_set_error(&error, BUS_ERROR_NOT_SUPPORTED, "Powering off is only supported for system managers.");
@@ -1199,7 +1199,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "Halt")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "halt");
+ SELINUX_ACCESS_CHECK(connection, message, "halt");
if (m->running_as != SYSTEMD_SYSTEM) {
dbus_set_error(&error, BUS_ERROR_NOT_SUPPORTED, "Halting is only supported for system managers.");
@@ -1214,7 +1214,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "KExec")) {
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
if (m->running_as != SYSTEMD_SYSTEM) {
dbus_set_error(&error, BUS_ERROR_NOT_SUPPORTED, "kexec is only supported for system managers.");
@@ -1232,7 +1232,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
char *u, *v;
int k;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
if (!dbus_message_get_args(
message,
@@ -1296,7 +1296,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "SetEnvironment")) {
char **l = NULL, **e = NULL;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
r = bus_parse_strv(message, &l);
if (r == -ENOMEM)
@@ -1321,7 +1321,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
} else if (dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "UnsetEnvironment")) {
char **l = NULL, **e = NULL;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
r = bus_parse_strv(message, &l);
if (r == -ENOMEM)
@@ -1347,7 +1347,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
char **l_set = NULL, **l_unset = NULL, **e = NULL, **f = NULL;
DBusMessageIter iter;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "reboot");
+ SELINUX_ACCESS_CHECK(connection, message, "reboot");
if (!dbus_message_iter_init(message, &iter))
goto oom;
@@ -1400,7 +1400,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
Iterator i;
UnitFileList *item;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
reply = dbus_message_new_method_return(message);
if (!reply)
@@ -1449,7 +1449,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
UnitFileState state;
const char *s;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
if (!dbus_message_get_args(
message,
@@ -1488,7 +1488,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
dbus_bool_t runtime, force;
int carries_install_info = -1;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
+ SELINUX_ACCESS_CHECK(connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
if (!dbus_message_iter_init(message, &iter))
goto oom;
@@ -1548,7 +1548,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
unsigned n_changes = 0;
dbus_bool_t runtime;
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
+ SELINUX_ACCESS_CHECK(connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
if (!dbus_message_iter_init(message, &iter))
goto oom;
@@ -1595,7 +1595,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
{ NULL, }
};
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
return bus_default_message_handler(connection, message, NULL, INTERFACES_LIST, bps);
}
diff --git a/src/core/dbus-unit.c b/src/core/dbus-unit.c
index 6bf331ee58..83ee018ff3 100644
--- a/src/core/dbus-unit.c
+++ b/src/core/dbus-unit.c
@@ -526,7 +526,7 @@ static DBusHandlerResult bus_unit_message_handler(DBusConnection *connection, DB
if (streq(dbus_message_get_path(message), "/org/freedesktop/systemd1/unit")) {
/* Be nice to gdbus and return introspection data for our mid-level paths */
- SELINUX_MANAGER_ACCESS_CHECK(m, connection, message, "status");
+ SELINUX_ACCESS_CHECK(connection, message, "status");
if (dbus_message_is_method_call(message, "org.freedesktop.DBus.Introspectable", "Introspect")) {
char *introspection = NULL;
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 9ddc042eca..4b1dc74e93 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -19,30 +19,28 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
-#include "util.h"
-#include "job.h"
-#include "manager.h"
#include "selinux-access.h"
#ifdef HAVE_SELINUX
-#include "dbus.h"
-#include "log.h"
-#include "dbus-unit.h"
-#include "bus-errors.h"
-#include "dbus-common.h"
-#include "audit.h"
-#include "selinux-util.h"
-#include "audit-fd.h"
#include <stdio.h>
#include <string.h>
#include <errno.h>
+#include <limits.h>
#include <selinux/selinux.h>
#include <selinux/avc.h>
#ifdef HAVE_AUDIT
#include <libaudit.h>
#endif
-#include <limits.h>
+#include <dbus.h>
+
+#include "util.h"
+#include "log.h"
+#include "bus-errors.h"
+#include "dbus-common.h"
+#include "audit.h"
+#include "selinux-util.h"
+#include "audit-fd.h"
static bool initialized = false;
@@ -210,7 +208,7 @@ static int access_init(void) {
return r;
}
-static int selinux_init(DBusError *error) {
+static int selinux_access_init(DBusError *error) {
int r;
if (initialized)
@@ -228,6 +226,14 @@ static int selinux_init(DBusError *error) {
return 0;
}
+void selinux_access_free(void) {
+ if (!initialized)
+ return;
+
+ avc_destroy();
+ initialized = false;
+}
+
static int get_audit_data(
DBusConnection *connection,
DBusMessage *message,
@@ -314,7 +320,7 @@ static int get_calling_context(
If the machine is in permissive mode it will return ok. Audit messages will
still be generated if the access would be denied in enforcing mode.
*/
-static int selinux_access_check(
+int selinux_access_check(
DBusConnection *connection,
DBusMessage *message,
const char *path,
@@ -331,13 +337,13 @@ static int selinux_access_check(
assert(permission);
assert(error);
- r = selinux_init(error);
- if (r < 0)
- return r;
-
if (!use_selinux())
return 0;
+ r = selinux_access_init(error);
+ if (r < 0)
+ return r;
+
log_debug("SELinux access check for path=%s permission=%s", strna(path), permission);
audit.uid = audit.loginuid = (uid_t) -1;
@@ -398,69 +404,19 @@ finish:
return r;
}
-int selinux_unit_access_check(
- Unit *u,
- DBusConnection *connection,
- DBusMessage *message,
- const char *permission,
- DBusError *error) {
-
- assert(u);
- assert(connection);
- assert(message);
- assert(permission);
- assert(error);
-
- return selinux_access_check(connection, message, u->source_path ? u->source_path : u->fragment_path, permission, error);
-}
-
-int selinux_manager_access_check(
- Manager *m,
- DBusConnection *connection,
- DBusMessage *message,
- const char *permission,
- DBusError *error) {
-
- assert(m);
- assert(connection);
- assert(message);
- assert(permission);
- assert(error);
-
- return selinux_access_check(connection, message, NULL, permission, error);
-}
-
-void selinux_access_finish(void) {
- if (!initialized)
- return;
-
- avc_destroy();
- initialized = false;
-}
-
#else
-int selinux_unit_access_check(
- Unit *u,
- DBusConnection *connection,
- DBusMessage *message,
- const char *permission,
- DBusError *error) {
-
- return 0;
-}
-
-int selinux_manager_access_check(
- Manager *m,
+int selinux_access_check(
DBusConnection *connection,
DBusMessage *message,
+ const char *path,
const char *permission,
DBusError *error) {
return 0;
}
-void selinux_access_finish(void) {
+void selinux_access_free(void) {
}
#endif
diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
index 5902b2f862..9183cbc9a6 100644
--- a/src/core/selinux-access.h
+++ b/src/core/selinux-access.h
@@ -21,20 +21,22 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
-void selinux_access_finish(void);
-int selinux_manager_access_check(Manager *manager, DBusConnection *connection, DBusMessage *message, const char *permission, DBusError *error);
-int selinux_unit_access_check(Unit *unit, DBusConnection *connection, DBusMessage *message, const char *permission, DBusError *error);
+#include <dbus.h>
+
+void selinux_access_free(void);
+
+int selinux_access_check(DBusConnection *connection, DBusMessage *message, const char *path, const char *permission, DBusError *error);
#ifdef HAVE_SELINUX
-#define SELINUX_MANAGER_ACCESS_CHECK(manager, connection, message, permission) \
+#define SELINUX_ACCESS_CHECK(connection, message, permission) \
do { \
DBusError _error; \
int _r; \
DBusConnection *_c = (connection); \
DBusMessage *_m = (message); \
dbus_error_init(&_error); \
- _r = selinux_manager_access_check((manager), _c, _m, (permission), &_error); \
+ _r = selinux_access_check(_c, _m, NULL, (permission), &_error); \
if (_r < 0) \
return bus_send_error_reply(_c, _m, &_error, _r); \
} while (false)
@@ -45,15 +47,16 @@ int selinux_unit_access_check(Unit *unit, DBusConnection *connection, DBusMessag
int _r; \
DBusConnection *_c = (connection); \
DBusMessage *_m = (message); \
+ Unit *_u = (unit); \
dbus_error_init(&_error); \
- _r = selinux_unit_access_check((unit), _c, _m, (permission), &_error); \
+ _r = selinux_access_check(_c, _m, _u->source_path ?: _u->fragment_path, (permission), &_error); \
if (_r < 0) \
return bus_send_error_reply(_c, _m, &_error, _r); \
} while (false)
#else
-#define SELINUX_MANAGER_ACCESS_CHECK(manager, connection, message, permission) do { } while (false)
+#define SELINUX_ACCESS_CHECK(connection, message, permission) do { } while (false)
#define SELINUX_UNIT_ACCESS_CHECK(unit, connection, message, permission) do { } while (false)
#endif
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-11-15 01:58:06 +0000