From d0309467650be331362ec4196d720a791e3e7c23 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 9 Oct 2024 06:08:11 +0900 Subject: [PATCH 1/4] core/dbus: move bus_verify_xyz() to dbus-util.c --- src/core/dbus-manager.c | 1 + src/core/dbus-util.c | 44 +++++++++++++++++++++++++++++++++++++++++ src/core/dbus-util.h | 6 ++++++ src/core/dbus.c | 43 ---------------------------------------- src/core/dbus.h | 6 ------ 5 files changed, 51 insertions(+), 49 deletions(-) diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c index 91c10a4e00..3538296d64 100644 --- a/src/core/dbus-manager.c +++ b/src/core/dbus-manager.c @@ -22,6 +22,7 @@ #include "dbus-scope.h" #include "dbus-service.h" #include "dbus-unit.h" +#include "dbus-util.h" #include "dbus.h" #include "env-util.h" #include "fd-util.h" diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c index b871d89368..28cb095cb2 100644 --- a/src/core/dbus-util.c +++ b/src/core/dbus-util.c @@ -177,6 +177,50 @@ int bus_verify_manage_units_async_full( error); } +int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async( + call, + "org.freedesktop.systemd1.manage-units", + /* details= */ NULL, + &m->polkit_registry, + error); +} + +int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async( + call, + "org.freedesktop.systemd1.manage-unit-files", + /* details= */ NULL, + &m->polkit_registry, + error); +} + +int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async( + call, + "org.freedesktop.systemd1.reload-daemon", + /* details= */ NULL, + &m->polkit_registry, error); +} + +int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async( + call, + "org.freedesktop.systemd1.set-environment", + /* details= */ NULL, + &m->polkit_registry, + error); +} + +int bus_verify_bypass_dump_ratelimit_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_polkit_async( + call, + "org.freedesktop.systemd1.bypass-dump-ratelimit", + /* details= */ NULL, + &m->polkit_registry, + error); +} + /* ret_format_str is an accumulator, so if it has any pre-existing content, new options will be appended to it */ int bus_read_mount_options( sd_bus_message *message, diff --git a/src/core/dbus-util.h b/src/core/dbus-util.h index 0fc3a94961..5eb4e836c7 100644 --- a/src/core/dbus-util.h +++ b/src/core/dbus-util.h @@ -250,7 +250,13 @@ static inline int bus_set_transient_usec(Unit *u, const char *name, usec_t *p, s static inline int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t *p, sd_bus_message *message, UnitWriteFlags flags, sd_bus_error *error) { return bus_set_transient_usec_internal(u, name, p, true, message, flags, error); } + int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error); +int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error); +int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error); +int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error); +int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error); +int bus_verify_bypass_dump_ratelimit_async(Manager *m, sd_bus_message *call, sd_bus_error *error); int bus_read_mount_options(sd_bus_message *message, sd_bus_error *error, MountOptions **ret_options, char **ret_format_str, const char *separator); diff --git a/src/core/dbus.c b/src/core/dbus.c index b6480937ee..2692dde151 100644 --- a/src/core/dbus.c +++ b/src/core/dbus.c @@ -1172,49 +1172,6 @@ int bus_track_coldplug(Manager *m, sd_bus_track **t, bool recursive, char **l) { return bus_track_add_name_many(*t, l); } -int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.manage-units", - /* details= */ NULL, - &m->polkit_registry, - error); -} - -int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.manage-unit-files", - /* details= */ NULL, - &m->polkit_registry, - error); -} - -int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.reload-daemon", - /* details= */ NULL, - &m->polkit_registry, error); -} - -int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.set-environment", - /* details= */ NULL, - &m->polkit_registry, - error); -} -int bus_verify_bypass_dump_ratelimit_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.bypass-dump-ratelimit", - /* details= */ NULL, - &m->polkit_registry, - error); -} - uint64_t manager_bus_n_queued_write(Manager *m) { uint64_t c = 0; sd_bus *b; diff --git a/src/core/dbus.h b/src/core/dbus.h index ae75404076..d00c14d3b7 100644 --- a/src/core/dbus.h +++ b/src/core/dbus.h @@ -23,12 +23,6 @@ int bus_track_coldplug(Manager *m, sd_bus_track **t, bool recursive, char **l); int bus_foreach_bus(Manager *m, sd_bus_track *subscribed2, int (*send_message)(sd_bus *bus, void *userdata), void *userdata); -int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error); -int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error); -int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error); -int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error); -int bus_verify_bypass_dump_ratelimit_async(Manager *m, sd_bus_message *call, sd_bus_error *error); - int bus_forward_agent_released(Manager *m, const char *path); uint64_t manager_bus_n_queued_write(Manager *m); From 0881cf3d511b8614307bb08f2dec374e55195232 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 9 Oct 2024 06:28:06 +0900 Subject: [PATCH 2/4] core/dbus: introduce bus_verify_manage_units_async_impl() Then, make bus_verify_manage_units_async() and _full() inline. Co-authored-by: Renjaya Raga Zenta --- src/core/dbus-util.c | 44 +++++++++++++++++++++++++------------------- src/core/dbus-util.h | 10 ++++++++-- 2 files changed, 33 insertions(+), 21 deletions(-) diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c index 28cb095cb2..2f13555f8f 100644 --- a/src/core/dbus-util.c +++ b/src/core/dbus-util.c @@ -150,39 +150,45 @@ int bus_set_transient_usec_internal( return 1; } -int bus_verify_manage_units_async_full( - Unit *u, +int bus_verify_manage_units_async_impl( + Manager *manager, + const char *id, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error) { - const char *details[9] = { - "unit", u->id, - "verb", verb, + const char *details[9]; + size_t n_details = 0; + + assert(manager); + assert(call); + + if (id) { + details[n_details++] = "unit"; + details[n_details++] = id; + } + + if (verb) { + details[n_details++] = "verb"; + details[n_details++] = verb; }; if (polkit_message) { - details[4] = "polkit.message"; - details[5] = polkit_message; - details[6] = "polkit.gettext_domain"; - details[7] = GETTEXT_PACKAGE; + details[n_details++] = "polkit.message"; + details[n_details++] = polkit_message; + details[n_details++] = "polkit.gettext_domain"; + details[n_details++] = GETTEXT_PACKAGE; } - return bus_verify_polkit_async( - call, - "org.freedesktop.systemd1.manage-units", - details, - &u->manager->polkit_registry, - error); -} + assert(n_details < ELEMENTSOF(details)); + details[n_details] = NULL; -int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { return bus_verify_polkit_async( call, "org.freedesktop.systemd1.manage-units", - /* details= */ NULL, - &m->polkit_registry, + n_details > 0 ? details : NULL, + &manager->polkit_registry, error); } diff --git a/src/core/dbus-util.h b/src/core/dbus-util.h index 5eb4e836c7..471c64acb6 100644 --- a/src/core/dbus-util.h +++ b/src/core/dbus-util.h @@ -251,8 +251,14 @@ static inline int bus_set_transient_usec_fix_0(Unit *u, const char *name, usec_t return bus_set_transient_usec_internal(u, name, p, true, message, flags, error); } -int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error); -int bus_verify_manage_units_async(Manager *m, sd_bus_message *call, sd_bus_error *error); +int bus_verify_manage_units_async_impl(Manager *manager, const char *id, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error); +static inline int bus_verify_manage_units_async_full(Unit *u, const char *verb, const char *polkit_message, sd_bus_message *call, sd_bus_error *error) { + assert(u); + return bus_verify_manage_units_async_impl(u->manager, u->id, verb, polkit_message, call, error); +} +static inline int bus_verify_manage_units_async(Manager *manager, sd_bus_message *call, sd_bus_error *error) { + return bus_verify_manage_units_async_impl(manager, NULL, NULL, NULL, call, error); +} int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error); int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error); int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error); From dc995a9b23645aaf74bf6db072c3d7c7c35b082d Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 9 Oct 2024 06:57:06 +0900 Subject: [PATCH 3/4] core/dbus: add assertions --- src/core/dbus-util.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/core/dbus-util.c b/src/core/dbus-util.c index 2f13555f8f..b44afc4258 100644 --- a/src/core/dbus-util.c +++ b/src/core/dbus-util.c @@ -193,6 +193,9 @@ int bus_verify_manage_units_async_impl( } int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + assert(m); + assert(call); + return bus_verify_polkit_async( call, "org.freedesktop.systemd1.manage-unit-files", @@ -202,6 +205,9 @@ int bus_verify_manage_unit_files_async(Manager *m, sd_bus_message *call, sd_bus_ } int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + assert(m); + assert(call); + return bus_verify_polkit_async( call, "org.freedesktop.systemd1.reload-daemon", @@ -210,6 +216,9 @@ int bus_verify_reload_daemon_async(Manager *m, sd_bus_message *call, sd_bus_erro } int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + assert(m); + assert(call); + return bus_verify_polkit_async( call, "org.freedesktop.systemd1.set-environment", @@ -219,6 +228,9 @@ int bus_verify_set_environment_async(Manager *m, sd_bus_message *call, sd_bus_er } int bus_verify_bypass_dump_ratelimit_async(Manager *m, sd_bus_message *call, sd_bus_error *error) { + assert(m); + assert(call); + return bus_verify_polkit_async( call, "org.freedesktop.systemd1.bypass-dump-ratelimit", From 3a437f52b8874a947e4dd3fea9476a847d959d92 Mon Sep 17 00:00:00 2001 From: Renjaya Raga Zenta Date: Tue, 1 Oct 2024 11:34:51 +0700 Subject: [PATCH 4/4] core/dbus: pass transient unit name metadata to polkit Fixes #17224 --- src/core/dbus-manager.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c index 3538296d64..54d4a1c1b8 100644 --- a/src/core/dbus-manager.c +++ b/src/core/dbus-manager.c @@ -30,6 +30,7 @@ #include "format-util.h" #include "initrd-util.h" #include "install.h" +#include "locale-util.h" #include "log.h" #include "manager-dump.h" #include "os-util.h" @@ -1083,7 +1084,13 @@ static int method_start_transient_unit(sd_bus_message *message, void *userdata, if (mode < 0) return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Job mode %s is invalid.", smode); - r = bus_verify_manage_units_async(m, message, error); + r = bus_verify_manage_units_async_impl( + m, + name, + "start", + N_("Authentication is required to start transient '$(unit)'."), + message, + error); if (r < 0) return r; if (r == 0)