diff options
author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2015-06-06 21:24:45 -0400 |
---|---|---|
committer | Sven Eden <yamakuzure@gmx.net> | 2017-03-14 10:01:47 +0100 |
commit | a075bca51a4e1338ca2bd4ae54ef1955cfbebc73 (patch) | |
tree | 71edae95df27beaa9e84c2f944777f1976c82abb /src/libelogind/sd-bus | |
parent | e5c97b472e43d1a49823df23a1d327aa1c351fcf (diff) |
sd-bus: store selinux context at connection time
This appears to be the right time to do it for SOCK_STREAM
unix sockets.
Also: condition bus_get_owner_creds_dbus1 was reversed. Split
it out to a separate variable for clarity and fix.
https://bugzilla.redhat.com/show_bug.cgi?id=1224211
Diffstat (limited to 'src/libelogind/sd-bus')
-rw-r--r-- | src/libelogind/sd-bus/bus-control.c | 6 | ||||
-rw-r--r-- | src/libelogind/sd-bus/bus-internal.h | 2 | ||||
-rw-r--r-- | src/libelogind/sd-bus/bus-socket.c | 7 | ||||
-rw-r--r-- | src/libelogind/sd-bus/sd-bus.c | 1 |
4 files changed, 13 insertions, 3 deletions
diff --git a/src/libelogind/sd-bus/bus-control.c b/src/libelogind/sd-bus/bus-control.c index 43ddfc651..110390335 100644 --- a/src/libelogind/sd-bus/bus-control.c +++ b/src/libelogind/sd-bus/bus-control.c @@ -979,8 +979,10 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds ** _cleanup_bus_creds_unref_ sd_bus_creds *c = NULL; pid_t pid = 0; int r; + bool do_label = bus->label && (mask & SD_BUS_CREDS_SELINUX_CONTEXT); - if (!bus->ucred_valid && !isempty(bus->label)) + /* Avoid allocating anything if we have no chance of returning useful data */ + if (!bus->ucred_valid && !do_label) return -ENODATA; c = bus_creds_new(); @@ -1004,7 +1006,7 @@ static int bus_get_owner_creds_dbus1(sd_bus *bus, uint64_t mask, sd_bus_creds ** } } - if (!isempty(bus->label) && (mask & SD_BUS_CREDS_SELINUX_CONTEXT)) { + if (do_label) { c->label = strdup(bus->label); if (!c->label) return -ENOMEM; diff --git a/src/libelogind/sd-bus/bus-internal.h b/src/libelogind/sd-bus/bus-internal.h index 1351938c8..2ee0eabc0 100644 --- a/src/libelogind/sd-bus/bus-internal.h +++ b/src/libelogind/sd-bus/bus-internal.h @@ -261,7 +261,7 @@ struct sd_bus { usec_t auth_timeout; struct ucred ucred; - char label[NAME_MAX]; + char *label; uint64_t creds_mask; diff --git a/src/libelogind/sd-bus/bus-socket.c b/src/libelogind/sd-bus/bus-socket.c index 8b15a743c..e182cfacf 100644 --- a/src/libelogind/sd-bus/bus-socket.c +++ b/src/libelogind/sd-bus/bus-socket.c @@ -588,10 +588,17 @@ void bus_socket_setup(sd_bus *b) { } static void bus_get_peercred(sd_bus *b) { + int r; + assert(b); /* Get the peer for socketpair() sockets */ b->ucred_valid = getpeercred(b->input_fd, &b->ucred) >= 0; + + /* Get the SELinux context of the peer */ + r = getpeersec(b->input_fd, &b->label); + if (r < 0 && r != -EOPNOTSUPP) + log_debug_errno(r, "Failed to determine peer security context: %m"); } static int bus_socket_start_auth_client(sd_bus *b) { diff --git a/src/libelogind/sd-bus/sd-bus.c b/src/libelogind/sd-bus/sd-bus.c index e40443976..7005ce34a 100644 --- a/src/libelogind/sd-bus/sd-bus.c +++ b/src/libelogind/sd-bus/sd-bus.c @@ -130,6 +130,7 @@ static void bus_free(sd_bus *b) { if (b->kdbus_buffer) munmap(b->kdbus_buffer, KDBUS_POOL_SIZE); + free(b->label); free(b->rbuffer); free(b->unique_name); free(b->auth_buffer); |