SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

creds: go via IPC service when unprivileged and trying to access services

Browse Source 
Fixes: #30191
This commit is contained in:
Lennart Poettering
2024-01-30 17:07:47 +01:00
parent 2c3cbc5c01
commit 19f16c9935
2 changed files with 77 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/creds-util.c
+18 -9
View File
@@ -189,15 +189,24 @@ int read_credential_with_decryption(const char *name, void **ret, size_t *ret_si
if (r < 0)
return log_error_errno(r, "Failed to read encrypted credential data: %m");
r = decrypt_credential_and_warn(
name,
now(CLOCK_REALTIME),
/* tpm2_device= */ NULL,
/* tpm2_signature_path= */ NULL,
getuid(),
&IOVEC_MAKE(data, sz),
CREDENTIAL_ANY_SCOPE,
&ret_iovec);
if (geteuid() != 0)
r = ipc_decrypt_credential(
name,
now(CLOCK_REALTIME),
getuid(),
&IOVEC_MAKE(data, sz),
CREDENTIAL_ANY_SCOPE,
&ret_iovec);
else
r = decrypt_credential_and_warn(
name,
now(CLOCK_REALTIME),
/* tpm2_device= */ NULL,
/* tpm2_signature_path= */ NULL,
getuid(),
&IOVEC_MAKE(data, sz),
CREDENTIAL_ANY_SCOPE,
&ret_iovec);
if (r < 0)
return r;