| Age | Commit message (Collapse) | Author |
|---|
|
Introduces a new concept of "trusted" vs. "untrusted" busses. For the
latter libsystemd-bus will automatically do per-method access control,
for the former all access is automatically granted. Per-method access
control is encoded in the vtables: by default all methods are only
accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag
is set for a method it is accessible to unprivileged clients too. By
default whether a client is privileged is determined via checking for
its CAP_SYS_ADMIN capability, but this can be altered via the
SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field
of the method.
Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and
SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note
however that read access is unrestricted, as PropertiesChanged messages
might send out the values anyway as an unrestricted broadcast.
By default the system bus is set to "untrusted" and the user bus is
"trusted" since per-method access control on the latter is unnecessary.
On dbus1 busses we check the UID of the caller rather than the
configured capability since the capability cannot be determined without
race. On kdbus the capability is checked if possible from the attached
meta-data of a message and otherwise queried from the sending peer.
This also decorates the vtables of the various daemons we ship with
these flags.
|
|
|
|
(deserialization is still missing, hence this is not hooked up to kdbus)
|
|
The signals appear entirely redundant due to NameOwnerChange, hence
don't do them in the new library, instead leave them for the
compatibility bridge only.
Also, set the serial number for synthesized messages to (uint32_t) -1.
|
|
NameOwnerChange
|
|
We need this so that one incoming kernel message can result in two
high-level bus messages, for the case where we synthesize NameAcquired
and NameOwnerChanged in the same instance.
|
|
matches against NameOwnerChange
|
|
kdbus_cmd_hello now has a new uint64_t flags field for the requested
attachments. Follow that change in libsystemd-bus.
|
|
This way we can unify handling of credentials that are attached to
messages, or can be queried for bus name owners or connection peers.
This also adds the ability to extend incomplete credential information
with data from /proc,
Also, provide a convenience call that will automatically determine the
most appropriate credential object for an incoming message, by using the
the attached information if possible, the sending name information if
available and otherwise the peer's credentials.
|
|
can be freed
|
|
require this anymore
|
|
This patch converts PID 1 to libsystemd-bus and thus drops the
dependency on libdbus. The only remaining code using libdbus is a test
case that validates our bus marshalling against libdbus' marshalling,
and this dependency can be turned off.
This patch also adds a couple of things to libsystem-bus, that are
necessary to make the port work:
- Synthesizing of "Disconnected" messages when bus connections are
severed.
- Support for attaching multiple vtables for the same interface on the
same path.
This patch also fixes the SetDefaultTarget() and GetDefaultTarget() bus
calls which used an inappropriate signature.
As a side effect we will now generate PropertiesChanged messages which
carry property contents, rather than just invalidation information.
|
|
|
|
everywhere
We want to emphasize bus connections as per-thread communication
primitives, hence introduce a concept of a per-thread default bus, and
make use of it everywhere.
|
|
|
|
When issuing a synchronous "systemctl daemon-reload" requests this will
send out a tonload of UnitRemoved+UnitNew signals, that we will queue
locally. When we wait for the message reply, we should be able to queue
those, hence bump the limits on locally queuing messages.
|
|
currently being dispatched
|
|
Also, add support for this to machinectl, so that we can enumerate the
machines that run inside a container. We must go deeper!
|
|
|
|
This way, we do not have to call it manually
|
|
Among other things this also adds a few things necessary for the change:
- Considerably more powerful error returning APIs in libsystemd-bus
- Adapter for connecting an sd_bus to an sd_event
- As I reworked the PolicyKit logic to the new library I also made it
asynchronous, so that PolicyKit requests of one user cannot block out
another user anymore.
- We always use the macro names for common bus error. That way it is
harder to mistype them since the compiler will notice
|
|
Otherwise the callback might unref the bus we are processing and destroy
the object while we are processing it.
|
|
|
|
objects on the bus
This adds a lightweight scheme how to define interfaces in static fixed
arrays which then can be easily registered on a bus connection. This
makes it much easier to write bus services.
This automatically handles implementation of the Properties,
ObjectManager, and Introspection bus interfaces.
|
|
|
|
Yay! Filtering using kernel bloom filter matches works now! Yippieh!
|
|
|
|
We want to allow clients to process an sd_bus_message on a different
thread than it was received on. Since unreffing a bus message might
readd some of its memfds to the memfd cache add some minimal locking
around the cache.
|
|
fork()
|
|
We need this since we might need to invoke the release ioctl for
messages. Since we don't want to add any locking for that we simply keep
a reference to the bus and then rely that the fd stays valid all the
time.
|
|
This is preparation to allow sd_bus_message obejcts to be processed in a
different thread from their originating sd_bus object.
|
|
than a single one
|
|
|
|
|
|
|
|
|
|
within a callback
|
|
|
|
|
|
This is useful so that we can speak D-Bus over a FIFO pair such as
stdin+stdout.
|
|
This function always returns the server side ID. The name suggested it
was actually always the peer's ID, but that's not correct if the call is
called on a server bus context. Hence, let's correct the name a bit.
|
|
|
|
This includes code to parse and split up match strings which will also
be useful to calculate bloom filter masks when the time comes.
|
|
|
|
reply to HELLO
|
|
This way we can hide more than just the hello logic behind this flag,
for example, later on automatic match management.
|
|
backend
|
|
|
|
hello is sent
This alos gets rid of explicit sd_open_fd() and sd_open_address()
constructors in favour of sd_new() + sd_new_start() where the
negotiation parameters may be set it in between.
|
|
|
