|
 |
65878a |
From 1ea0879cf79412e27b8becdb2bbc7e0abd301a66 Mon Sep 17 00:00:00 2001
|
|
|
65878a |
From: Lukas Nykryn <lnykryn@redhat.com>
|
|
|
65878a |
Date: Tue, 12 Aug 2014 12:58:47 +0200
|
|
|
65878a |
Subject: [PATCH] selinux: Check access vector for enable and disable perm for
|
|
|
65878a |
each unit file
|
|
|
65878a |
|
|
|
65878a |
---
|
|
|
65878a |
src/core/dbus-manager.c | 28 ++++++++++++++++++++++++----
|
|
|
65878a |
1 file changed, 24 insertions(+), 4 deletions(-)
|
|
|
65878a |
|
|
|
65878a |
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
|
|
|
65878a |
index 6d16c2a..cebc730 100644
|
|
|
65878a |
--- a/src/core/dbus-manager.c
|
|
|
65878a |
+++ b/src/core/dbus-manager.c
|
|
|
65878a |
@@ -1581,6 +1581,7 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
|
|
|
65878a |
dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "SetDefaultTarget")) {
|
|
|
65878a |
|
|
|
65878a |
char **l = NULL;
|
|
|
65878a |
+ char **i;
|
|
|
65878a |
DBusMessageIter iter;
|
|
|
65878a |
UnitFileScope scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
|
|
|
65878a |
UnitFileChange *changes = NULL;
|
|
|
65878a |
@@ -1588,8 +1589,6 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
|
|
|
65878a |
dbus_bool_t runtime, force;
|
|
|
65878a |
int carries_install_info = -1;
|
|
|
65878a |
|
|
|
65878a |
- SELINUX_ACCESS_CHECK(connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
|
|
|
65878a |
-
|
|
|
65878a |
if (!dbus_message_iter_init(message, &iter))
|
|
|
65878a |
goto oom;
|
|
|
65878a |
|
|
|
65878a |
@@ -1601,6 +1600,17 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
|
|
|
65878a |
return bus_send_error_reply(connection, message, NULL, r);
|
|
|
65878a |
}
|
|
|
65878a |
|
|
|
65878a |
+ STRV_FOREACH(i, l) {
|
|
|
65878a |
+ Unit *u;
|
|
|
65878a |
+
|
|
|
65878a |
+ r = manager_load_unit(m, *i, NULL, NULL, &u);
|
|
|
65878a |
+ if (r < 0) {
|
|
|
65878a |
+ dbus_set_error(&error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", *i);
|
|
|
65878a |
+ return bus_send_error_reply(connection, message, &error, -ENOENT);
|
|
|
65878a |
+ }
|
|
|
65878a |
+ SELINUX_UNIT_ACCESS_CHECK(u, connection, message, streq(member, "MaskUnitFiles") ? "disable" : "enable");
|
|
|
65878a |
+ }
|
|
|
65878a |
+
|
|
|
65878a |
if (!dbus_message_iter_next(&iter) ||
|
|
|
65878a |
bus_iter_get_basic_and_next(&iter, DBUS_TYPE_BOOLEAN, &runtime, true) < 0 ||
|
|
|
65878a |
bus_iter_get_basic_and_next(&iter, DBUS_TYPE_BOOLEAN, &force, false) < 0) {
|
|
|
65878a |
@@ -1644,14 +1654,13 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
|
|
|
65878a |
dbus_message_is_method_call(message, "org.freedesktop.systemd1.Manager", "UnmaskUnitFiles")) {
|
|
|
65878a |
|
|
|
65878a |
char **l = NULL;
|
|
|
65878a |
+ char **i;
|
|
|
65878a |
DBusMessageIter iter;
|
|
|
65878a |
UnitFileScope scope = m->running_as == SYSTEMD_SYSTEM ? UNIT_FILE_SYSTEM : UNIT_FILE_USER;
|
|
|
65878a |
UnitFileChange *changes = NULL;
|
|
|
65878a |
unsigned n_changes = 0;
|
|
|
65878a |
dbus_bool_t runtime;
|
|
|
65878a |
|
|
|
65878a |
- SELINUX_ACCESS_CHECK(connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
|
|
|
65878a |
-
|
|
|
65878a |
if (!dbus_message_iter_init(message, &iter))
|
|
|
65878a |
goto oom;
|
|
|
65878a |
|
|
|
65878a |
@@ -1669,6 +1678,17 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
|
|
|
65878a |
return bus_send_error_reply(connection, message, NULL, -EIO);
|
|
|
65878a |
}
|
|
|
65878a |
|
|
|
65878a |
+ STRV_FOREACH(i, l) {
|
|
|
65878a |
+ Unit *u;
|
|
|
65878a |
+
|
|
|
65878a |
+ r = manager_load_unit(m, *i, NULL, NULL, &u);
|
|
|
65878a |
+ if (r < 0) {
|
|
|
65878a |
+ dbus_set_error(&error, BUS_ERROR_NO_SUCH_UNIT, "Unit %s does not exist.", *i);
|
|
|
65878a |
+ return bus_send_error_reply(connection, message, &error, -ENOENT);
|
|
|
65878a |
+ }
|
|
|
65878a |
+ SELINUX_UNIT_ACCESS_CHECK(u, connection, message, streq(member, "UnmaskUnitFiles") ? "enable" : "disable");
|
|
|
65878a |
+ }
|
|
|
65878a |
+
|
|
|
65878a |
if (streq(member, "DisableUnitFiles"))
|
|
|
65878a |
r = unit_file_disable(scope, runtime, NULL, l, &changes, &n_changes);
|
|
|
65878a |
else if (streq(member, "UnmaskUnitFiles"))
|