summaryrefslogtreecommitdiff
path: root/src/core/selinux-access.c
AgeCommit message (Collapse)Author
2014-11-27selinux: log selinux log messages with LOG_AUTH facilityLennart Poettering
2014-11-27log: rearrange log function namingLennart Poettering
- Rename log_meta() → log_internal(), to follow naming scheme of most other log functions that are usually invoked through macros, but never directly. - Rename log_info_object() to log_object_info(), simply because the object should be before any other parameters, to follow OO-style programming style.
2014-11-27log: add an "error" parameter to all low-level logging calls and intrdouce ↵Lennart Poettering
log_error_errno() as log calls that take error numbers This change has two benefits: - The format string %m will now resolve to the specified error (or to errno if the specified error is 0. This allows getting rid of a ton of strerror() invocations, a function that is not thread-safe. - The specified error can be passed to the journal in the ERRNO= field. Now of course, we just need somebody to convert all cases of this: log_error("Something happened: %s", strerror(-r)); into thus: log_error_errno(-r, "Something happened: %m");
2014-11-26core: make sure we have enough information when doing selinux decisionsLennart Poettering
Let's ask for the security relevant bits in a race-free way, and augment the rest from /proc.
2014-10-28mac: add mac_ prefix to distinguish origin security apisWaLyong Cho
2014-10-27selinux: make sure we do not try to print missing fieldsZbigniew Jędrzejewski-Szmek
UID or GID of 0 is valid, so we cannot use that to distinguish whether calls to sd_bus_creds_get_* succeeded, and the return value from the function is the only way to know about missing fields. Print "n/a" if the fields are missing. CID #1238779
2014-10-23mac: also rename use_{smack,selinux,apparmor}() calls so that they share the ↵Lennart Poettering
new mac_{smack,selinux,apparmor}_xyz() convention
2014-10-08systemctl: add add-wants and add-requires verbsLukas Nykryn
2014-05-15selinux: fix build for non-selinux systemsLennart Poettering
2014-05-14core: no need to pass bus object to selinux access check calls anymoreLennart Poettering
2013-11-28bus: add new sd_bus_creds object to encapsulate process credentialsLennart Poettering
This way we can unify handling of credentials that are attached to messages, or can be queried for bus name owners or connection peers. This also adds the ability to extend incomplete credential information with data from /proc, Also, provide a convenience call that will automatically determine the most appropriate credential object for an incoming message, by using the the attached information if possible, the sending name information if available and otherwise the peer's credentials.
2013-11-21bus: rework message handlers to always take an error argumentLennart Poettering
Message handler callbacks can be simplified drastically if the dispatcher automatically replies to method calls if errors are returned. Thus: add an sd_bus_error argument to all message handlers. When we dispatch a message handler and it returns negative or a set sd_bus_error we send this as message error back to the client. This means errors returned by handlers by default are given back to clients instead of rippling all the way up to the event loop, which is desirable to make things robust. As a side-effect we can now easily turn the SELinux checks into normal function calls, since the method call dispatcher will generate the right error replies automatically now. Also, make sure we always pass the error structure to all property and method handlers as last argument to follow the usual style of passing variables for return values as last argument.
2013-11-21src/core/selinux-access: #include <sys/socket.h>Daniel Mack
Fixes the following build errors on Fedora 20: CC src/core/libsystemd_core_la-selinux-access.lo src/core/selinux-access.c: In function 'get_audit_data': src/core/selinux-access.c:245:22: error: storage size of 'ucred' isn't known struct ucred ucred; ^ src/core/selinux-access.c:259:9: warning: implicit declaration of function 'getsockopt' [-Wimplicit-function-declaration] r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len); ^ src/core/selinux-access.c:259:28: error: 'SOL_SOCKET' undeclared (first use in this function) r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len); ^ src/core/selinux-access.c:259:28: note: each undeclared identifier is reported only once for each function it appears in src/core/selinux-access.c:259:40: error: 'SO_PEERCRED' undeclared (first use in this function) r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len); ^ src/core/selinux-access.c:245:22: warning: unused variable 'ucred' [-Wunused-variable] struct ucred ucred; ^ make[2]: *** [src/core/libsystemd_core_la-selinux-access.lo] Error 1 make[1]: *** [all-recursive] Error 1 make: *** [all] Error 2
2013-11-20core: convert PID 1 to libsystemd-busLennart Poettering
This patch converts PID 1 to libsystemd-bus and thus drops the dependency on libdbus. The only remaining code using libdbus is a test case that validates our bus marshalling against libdbus' marshalling, and this dependency can be turned off. This patch also adds a couple of things to libsystem-bus, that are necessary to make the port work: - Synthesizing of "Disconnected" messages when bus connections are severed. - Support for attaching multiple vtables for the same interface on the same path. This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus calls which used an inappropriate signature. As a side effect we will now generate PropertiesChanged messages which carry property contents, rather than just invalidation information.
2013-10-16macro: clean up usage of gcc attributesLennart Poettering
Always use our own macros, and name all our own macros the same style.
2013-08-14selinux-access: move GPL to LGPL licenceKay Sievers
On Wed, Aug 14, 2013 at 10:31 PM, Daniel J Walsh <dwalsh@redhat.com> wrote: > On 08/14/2013 04:17 PM, Kay Sievers wrote: > > > > this patch added GPL code to systemd, which otherwise is all LGPL. We need > > to make sure we can always split out any code to a separate shared library > > ... > > > > Mind if I switch your src/core/selinux-access.[ch] files to LGPL? > I have no problem with it. Should be LGPL anyways.
2013-05-02Add __attribute__((const, pure, format)) in various placesZbigniew Jędrzejewski-Szmek
I'm assuming that it's fine if a _const_ or _pure_ function calls assert. It is assumed that the assert won't trigger, and even if it does, it can only trigger on the first call with a given set of parameters, and we don't care if the compiler moves the order of calls.
2013-02-13selinux: use a dynamically sized string when generating audit messagesLennart Poettering
https://bugzilla.redhat.com/show_bug.cgi?id=883043
2013-02-07systemd: fix uninitialized memory access in selinuxZbigniew Jędrzejewski-Szmek
==6129== Syscall param socketcall.getsockopt(optlen) points to uninitialised byte(s) ==6129== at 0x312D0F325A: getsockopt (syscall-template.S:81) ==6129== by 0x4615E6: get_audit_data (selinux-access.c:268) ==6129== by 0x461A81: selinux_access_check (selinux-access.c:394) ==6129== by 0x453B23: bus_manager_message_handler (dbus-manager.c:1395) ==6129== by 0x313581D9C4: _dbus_object_tree_dispatch_and_unlock (dbus-object-tree.c:862) ==6129== by 0x313580FC1F: dbus_connection_dispatch (dbus-connection.c:4672) ==6129== by 0x44CD4C: bus_dispatch (dbus.c:528) ==6129== by 0x41292F: manager_loop (manager.c:1573) ==6129== by 0x40CD8E: main (main.c:1735) ==6129== Address 0x7fefff2c0 is on thread 1's stack
2013-01-25selinux: we don't need that many debug messages by defaultLennart Poettering
2013-01-25selinux-access: Delete debugging message logged as an errorColin Walters
I don't see why this should be logged at all, so let's delete it.
2013-01-16systemctl,loginctl,cgls: do not ellipsize cgroup members when --full is ↵Lukas Nykryn
specified New file output.h with output flags and modes. --full parameter also for cgls and loginctl. Include 'all' parameter in flags (show_cgroup_by_path, show_cgroup, show_cgroup_and_extra, show_cgroup_and_extra_by_spec). get_process_cmdline with max_length == 0 will not ellipsize output. Replace LINE_MAX with 0 in some calls of get_process_cmdline. [zj: Default to --full when under pager for clgs. Drop '-f' since it wasn't documented and didn't actually work. Reindent a bit. ]
2012-10-18systemd: use structured logging for unit changesZbigniew Jędrzejewski-Szmek
Information which unit a log entry pertains to enables systemctl status to display more log messages.
2012-10-16SELinux patch still broken, in that we are not checking the correct source ↵Daniel J Walsh
context. This patch does the dbus calls correctly.
2012-10-03selinux: properly free dbus errorLennart Poettering
2012-10-02selinux: remove anything PID1-specific from selinux-access.[ch] so that we ↵Lennart Poettering
can reuse it in logind
2012-10-02audit: turn the audit fd into a static variableLennart Poettering
As audit is pretty much just a special kind of logging we should treat it similar, and manage the audit fd in a static variable. This simplifies the audit fd sharing with the SELinux access checking code quite a bit.
2012-10-02selinux: rework selinux access check logicLennart Poettering
a) Instead of parsing the bus messages inside of selinux-access.c simply pass everything pre-parsed in the functions b) implement the access checking with a macro that resolves to nothing on non-selinux builds c) split out the selinux checks into their own sources selinux-util.[ch] d) this unifies the job creation code behind the D-Bus calls Manager.StartUnit() and Unit.Start().
2012-09-28selinux: fix various problemsDaniel J Walsh
2012-09-24selinux: use standard D-Bus error id for access deniedLennart Poettering
2012-09-21core: call va_end in all casesLukas Nykryn
2012-09-18selinux: rework method tail, make it into a nulstr arrayLennart Poettering
2012-09-18selinux: use existing library calls for audit dataLennart Poettering
2012-09-18selinux: prefer source path over fragment pathLennart Poettering
2012-09-18selinux: add bus service access controlDaniel J Walsh
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This patch adds the ability to look at the calling process that is trying to do dbus calls into systemd, then it checks with the SELinux policy to see if the calling process is allowed to do the activity. The basic idea is we want to allow NetworkManager_t to be able to start and stop ntpd.service, but not necessarly mysqld.service. Similarly we want to allow a root admin webadm_t that can only manage the apache environment. systemctl enable httpd.service, systemctl disable iptables.service bad. To make this code cleaner, we really need to refactor the dbus-manager.c code. This has just become a huge if-then-else blob, which makes doing the correct check difficult. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlBJBi8ACgkQrlYvE4MpobOzTwCdEUikbvRWUCwOb83KlVF0Nuy5 lRAAnjZZNuc19Z+aNxm3k3nwD4p/JYco =yops -----END PGP SIGNATURE-----