system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-09-29 21:04:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #33503 from poettering/hostnamed-polkit-fixes

Browse source 
hostnamed: minor corrects to Varlink polkit handling
This commit is contained in:
Lennart Poettering 2024-06-27 12:47:46 +02:00 committed by GitHub
parent 24f0d6110c 6678b9acc6
commit db2b897a86
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 12 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
src/hostname/hostnamed.c
View file

@ -1621,11 +1621,13 @@ static int vl_method_describe(Varlink *link, sd_json_variant *parameters, Varlin
if (r != 0)
return r;
r = varlink_verify_polkit_async(
r = varlink_verify_polkit_async_full(
link,
c->bus,
"org.freedesktop.hostname1.get-hardware-serial",
/* details= */ NULL,
UID_INVALID,
POLKIT_DONT_REPLY,
&c->polkit_registry);
if (r == 0)
return 0; /* No authorization for now, but the async polkit stuff will call us again when it has it */
@ -1634,9 +1636,6 @@ static int vl_method_describe(Varlink *link, sd_json_variant *parameters, Varlin
* the product ID which we'll check explicitly. */
privileged = r > 0;
if (sd_json_variant_elements(parameters) > 0)
return varlink_error_invalid_parameter(link, parameters);
_cleanup_(sd_json_variant_unrefp) sd_json_variant *v = NULL;
r = build_describe_response(c, privileged, &v);
if (r < 0)

12
src/shared/bus-polkit.c
View file

@ -786,11 +786,13 @@ int varlink_verify_polkit_async_full(
if (r != 0)
log_debug("Found matching previous polkit authentication for '%s'.", action);
if (r < 0) {
/* Reply with a nice error */
if (sd_bus_error_has_name(&error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED))
(void) varlink_error(link, VARLINK_ERROR_INTERACTIVE_AUTHENTICATION_REQUIRED, NULL);
else if (ERRNO_IS_NEG_PRIVILEGE(r))
(void) varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
if (!FLAGS_SET(flags, POLKIT_DONT_REPLY)) {
/* Reply with a nice error */
if (sd_bus_error_has_name(&error, SD_BUS_ERROR_INTERACTIVE_AUTHORIZATION_REQUIRED))
(void) varlink_error(link, VARLINK_ERROR_INTERACTIVE_AUTHENTICATION_REQUIRED, NULL);
else if (ERRNO_IS_NEG_PRIVILEGE(r))
(void) varlink_error(link, VARLINK_ERROR_PERMISSION_DENIED, NULL);
}
return r;
}

1
src/shared/bus-polkit.h
View file

@ -11,6 +11,7 @@ typedef enum PolkitFLags {
POLKIT_ALLOW_INTERACTIVE = 1 << 0, /* Allow interactive auth (typically not required, because can be derived from bus message/link automatically) */
POLKIT_ALWAYS_QUERY = 1 << 1, /* Query polkit even if client is privileged */
POLKIT_DEFAULT_ALLOW = 1 << 2, /* If polkit is not around, assume "allow" rather than the usual "deny" */
POLKIT_DONT_REPLY = 1 << 3, /* Varlink: don't immediately propagate polkit error to the Varlink client */
} PolkitFlags;
int bus_test_polkit(sd_bus_message *call, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);

1
src/shared/varlink-io.systemd.Hostname.c
View file

@ -4,6 +4,7 @@
static VARLINK_DEFINE_METHOD(
Describe,
VARLINK_DEFINE_INPUT(allowInteractiveAuthentication, VARLINK_BOOL, VARLINK_NULLABLE),
VARLINK_DEFINE_OUTPUT(Hostname, VARLINK_STRING, 0),
VARLINK_DEFINE_OUTPUT(StaticHostname, VARLINK_STRING, VARLINK_NULLABLE),
VARLINK_DEFINE_OUTPUT(PrettyHostname, VARLINK_STRING, VARLINK_NULLABLE),