| Age | Commit message (Collapse) | Author |
|---|
|
The 'at_console' policy-category allows to apply policy-items to clients
depending on whether they're run from within a valid user-session or not.
We use sd_uid_get_seats() to check whether a user has a valid seat (which
excludes remote-sessions like ssh).
|
|
Make sure to print "dbus-1 to kernel" or "kernel to dbus-1" in policy logs
to better diagnose the situation.
|
|
If a dbus-1 client sends a broadcasted signal via the bus-proxy to kdbus,
the bus-proxy has no idea who the receiver is. Classic dbus-daemon has
bus-access and can perform policy checks for each receiver, but we cant.
Instead, we know the kernel will perform receiver policy checks for
broadcasts, so we can skip the policy check and just push it into the
kernel.
This fixes wpa_supplicant which has DENY rules on receive_type=signal for
non-root. As we never know the target, we always DENY all broadcasts from
wpa_supplicant.
Note that will still perform receiver-policy checks for signals that we
get from the kernel back to us. In those cases, we know the receiver
(which is us).
|
|
The policy debug messages swapped "path=" and "interface=", fix this.
|
|
dbus-1 distinguishes expected and non-expected replies. An expected reply
is a reply that is sent as answer to a previously forwarded method-call
before the timeout fires. Those replies are, by default, forwarded and
DENY policy tags are ignored on them (unless explicitly stated otherwise).
We don't track reply-windows in the bus-proxy as the kernel already does
this. Furthermore, the kernel prohibits any non-expected replies (which
breaks dbus-1, but it was an odd feature, anyway).
Therefore, skip policy checks on replies and always let the kernel deal
with it!
To be correct, we should still process DENY tags marked as
send_expected_reply=true (which is *NOT* the default!). However, so far we
don't parse those attributes, and no-one really uses it, so lets not
implement it for now. It's marked as TODO if anyone feels like fixing it.
|
|
Make sure to extract the log-priority when comparing against
max-log-level, otherwise, we will always drop those messages.
This fixes bus-proxyd to properly send warnings on policy blocks.
|
|
|
|
|
|
|
|
|
|
imply calling session/user instead
This turns "lock-session", "activate", "unlock-session",
"enable-linger", "disable-linger" into commands that take no argument,
optionally in which case the callers session/user is implied.
|
|
needlessly send it if we don't actually need it
|
|
|
|
|
|
|
|
|
|
to the bus owner should be allowed
Hence, copy this behaviour for bus-proxy too.
|
|
|
|
|
|
|
|
determine them from the caller credentials
More specifically, if an operation is requested on a session with an
empty name, the caller's session is used. If an operation is requested
on a seat with an empty name, the seat of the caller's session is used.
Finally, if an operation on the user with UID -1 is requested, the user
of the client's session is used (and not the UID of the client!).
|
|
|
|
Makes "busctl introspect" a lot more fun.
|
|
caller's session status
Similar for user-status and seat-status.
|
|
Among other things, avoid log_struct() unless we really need it.
Also, use "r" as variable to store function errors in, instead of "err".
"r" is pretty much what we use everywhere else, hence using the same
here make sense.
FInally, in the child, when we want to log, make sure to open the
logging framework first, since it is explicitly closed in preparation
for the exec().
|
|
Now that we bump rlimit, we do not really know how many files
we can open. Remove the check.
https://bugzilla.redhat.com/show_bug.cgi?id=1179980
|
|
|
|
https://bugs.freedesktop.org/show_bug.cgi?id=88216
|
|
Make sure to append bloom-filters to all signal-messages, not only
broadcasts.
|
|
Error, DATA expected but got 'mouse:usb:v046dpc24c:name:Logitech G400s Optical
Gaming Mouse:' in '/etc/udev/hwdb.d/70-mouse.hwdb':
Error, MATCH expected but got ' MOUSE_DPI=400@1000 *800@1000 2000@1000
4000@1000' in '/etc/udev/hwdb.d/70-mouse.hwdb':
Introduced in 6366e349
|
|
|
|
|
|
non-fatal
This should be useful for user namespaces.
|
|
|
|
The tool is badly maintained and we shouldn't refence such old cruft.
|
|
|
|
|
|
|
|
|
|
|
|
methods, start the polkit agent on terminals
|
|
|
|
user-status" and "loginctl session-status"
|
|
Devices with dynamic frequency scaling adjust the frequency as needed. For
those we only care about the maximum frequency, not the various in betweens.
https://bugs.freedesktop.org/show_bug.cgi?id=87435#c8
|
|
https://bugs.freedesktop.org/show_bug.cgi?id=87435
|
|
*Autocompletion for dirs, doesn't leave until you press space.
*Added tmpfs, volatile and network-macvlan options.
I tried with the SELinux options with seinfo(setools-console), but too
messy to get it right. Even Daniel Walsh haven't done it yet. :)
|
|
https://bugs.freedesktop.org/show_bug.cgi?id=66396
|
|
|
|
This was subsumed into systemd-analyze back in 142c4ecaa98.
|
|
man machine-info lacks hostnamed chassis type "embedded" as introduced in 218. The following lines should fix this.
|
