From dd5ae4c36c89da5dbe8d1628939b26c00db98753 Mon Sep 17 00:00:00 2001
From: Przemyslaw Kedzierski <p.kedzierski@samsung.com>
Date: Tue, 9 Dec 2014 12:17:24 +0100
Subject: bus-proxy: cloning smack label

When dbus client connects to systemd-bus-proxyd through
Unix domain socket proxy takes client's smack label and sets for itself.

It is done before and independent of dropping privileges.

The reason of such soluton is fact that tests of access rights
performed by lsm may take place inside kernel, not only
in userspace of recipient of message.

The bus-proxyd needs CAP_MAC_ADMIN to manipulate its label.

In case of systemd running in system mode, CAP_MAC_ADMIN
should be added to CapabilityBoundingSet in service file of bus-proxyd.

In case of systemd running in user mode ('systemd --user')
it can be achieved by addition
Capabilities=cap_mac_admin=i and SecureBits=keep-caps
to user@.service file
and setting cap_mac_admin+ei on bus-proxyd binary.
---
 units/systemd-bus-proxyd@.service.in    | 22 ----------------------
 units/systemd-bus-proxyd@.service.m4.in | 22 ++++++++++++++++++++++
 units/user@.service.in                  | 19 -------------------
 units/user@.service.m4.in               | 23 +++++++++++++++++++++++
 4 files changed, 45 insertions(+), 41 deletions(-)
 delete mode 100644 units/systemd-bus-proxyd@.service.in
 create mode 100644 units/systemd-bus-proxyd@.service.m4.in
 delete mode 100644 units/user@.service.in
 create mode 100644 units/user@.service.m4.in

(limited to 'units')

diff --git a/units/systemd-bus-proxyd@.service.in b/units/systemd-bus-proxyd@.service.in
deleted file mode 100644
index 23b5ffa072..0000000000
--- a/units/systemd-bus-proxyd@.service.in
+++ /dev/null
@@ -1,22 +0,0 @@
-#  This file is part of systemd.
-#
-#  systemd is free software; you can redistribute it and/or modify it
-#  under the terms of the GNU Lesser General Public License as published by
-#  the Free Software Foundation; either version 2.1 of the License, or
-#  (at your option) any later version.
-
-[Unit]
-Description=Legacy D-Bus Protocol Compatibility Daemon
-
-[Service]
-# The first argument will be replaced by the service by information on
-# the process requesting the proxy, we need a placeholder to keep the
-# space available for this.
-ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-NotifyAccess=main
-CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP
-PrivateTmp=yes
-PrivateDevices=yes
-PrivateNetwork=yes
-ProtectSystem=full
-ProtectHome=yes
diff --git a/units/systemd-bus-proxyd@.service.m4.in b/units/systemd-bus-proxyd@.service.m4.in
new file mode 100644
index 0000000000..3f3ab64dee
--- /dev/null
+++ b/units/systemd-bus-proxyd@.service.m4.in
@@ -0,0 +1,22 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Legacy D-Bus Protocol Compatibility Daemon
+
+[Service]
+# The first argument will be replaced by the service by information on
+# the process requesting the proxy, we need a placeholder to keep the
+# space available for this.
+ExecStart=@rootlibexecdir@/systemd-bus-proxyd --drop-privileges --address=kernel:path=/sys/fs/kdbus/0-system/bus xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+NotifyAccess=main
+CapabilityBoundingSet=CAP_IPC_OWNER CAP_SETUID CAP_SETGID CAP_SETPCAP m4_ifdef(`HAVE_SMACK', CAP_MAC_ADMIN )
+PrivateTmp=yes
+PrivateDevices=yes
+PrivateNetwork=yes
+ProtectSystem=full
+ProtectHome=yes
diff --git a/units/user@.service.in b/units/user@.service.in
deleted file mode 100644
index 1e21d51aae..0000000000
--- a/units/user@.service.in
+++ /dev/null
@@ -1,19 +0,0 @@
-#  This file is part of systemd.
-#
-#  systemd is free software; you can redistribute it and/or modify it
-#  under the terms of the GNU Lesser General Public License as published by
-#  the Free Software Foundation; either version 2.1 of the License, or
-#  (at your option) any later version.
-
-[Unit]
-Description=User Manager for UID %i
-After=systemd-user-sessions.service
-
-[Service]
-User=%i
-PAMName=systemd-user
-Type=notify
-ExecStart=-@rootlibexecdir@/systemd --user
-Slice=user-%i.slice
-KillMode=mixed
-Delegate=yes
diff --git a/units/user@.service.m4.in b/units/user@.service.m4.in
new file mode 100644
index 0000000000..340c02b59b
--- /dev/null
+++ b/units/user@.service.m4.in
@@ -0,0 +1,23 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=User Manager for UID %i
+After=systemd-user-sessions.service
+
+[Service]
+User=%i
+PAMName=systemd-user
+Type=notify
+ExecStart=-@rootlibexecdir@/systemd --user
+Slice=user-%i.slice
+KillMode=mixed
+Delegate=yes
+m4_ifdef(`HAVE_SMACK',
+Capabilities=cap_mac_admin=i
+SecureBits=keep-caps
+)
-- 
cgit v1.2.3-54-g00ecf