From 231cab5c5e589fa24b2baa6f77ef234fea386cc3 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 15 May 2025 09:30:12 +0200
Subject: [PATCH 1/2] core: always handle method call params via
 sd_varlink_dispatch(), even if we accept none

This results in much more precise errors for the clients, and is what we
do everywhere else these days.
---
 src/core/manager-varlink.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/core/manager-varlink.c b/src/core/manager-varlink.c
index c124b2fc9f..3c7e746640 100644
--- a/src/core/manager-varlink.c
+++ b/src/core/manager-varlink.c
@@ -158,8 +158,9 @@ int vl_method_describe_manager(sd_varlink *link, sd_json_variant *parameters, sd
 
         assert(parameters);
 
-        if (sd_json_variant_elements(parameters) > 0)
-                return sd_varlink_error_invalid_parameter(link, parameters);
+        r = sd_varlink_dispatch(link, parameters, /* dispatch_table= */ NULL, /* userdata= */ NULL);
+        if (r != 0)
+                return r;
 
         r = sd_json_buildo(&v,
                         SD_JSON_BUILD_PAIR_CALLBACK("Context", manager_context_build_json, manager),

From 8d7d2edcbbec9d996c1c5e4eb20844e257534e38 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 15 May 2025 09:30:37 +0200
Subject: [PATCH 2/2] bus-polkit: add a generic vtable for methods with no
 params, but with polkit

---
 src/hostname/hostnamed.c       | 7 +------
 src/resolve/resolved-varlink.c | 7 +------
 src/shared/bus-polkit.c        | 5 +++++
 src/shared/bus-polkit.h        | 4 ++++
 4 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 5f95e52f7f..7246770479 100644
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -1797,11 +1797,6 @@ static int connect_bus(Context *c) {
 }
 
 static int vl_method_describe(sd_varlink *link, sd_json_variant *parameters, sd_varlink_method_flags_t flags, void *userdata) {
-        static const sd_json_dispatch_field dispatch_table[] = {
-                VARLINK_DISPATCH_POLKIT_FIELD,
-                {}
-        };
-
         Context *c = ASSERT_PTR(userdata);
         bool privileged;
         int r;
@@ -1809,7 +1804,7 @@ static int vl_method_describe(sd_varlink *link, sd_json_variant *parameters, sd_
         assert(link);
         assert(parameters);
 
-        r = sd_varlink_dispatch(link, parameters, dispatch_table, /* userdata= */ NULL);
+        r = sd_varlink_dispatch(link, parameters, dispatch_table_polkit_only, /* userdata= */ NULL);
         if (r != 0)
                 return r;
 
diff --git a/src/resolve/resolved-varlink.c b/src/resolve/resolved-varlink.c
index cf9569e667..5b534b1d93 100644
--- a/src/resolve/resolved-varlink.c
+++ b/src/resolve/resolved-varlink.c
@@ -1189,17 +1189,12 @@ static int vl_method_resolve_record(sd_varlink *link, sd_json_variant *parameter
 }
 
 static int verify_polkit(sd_varlink *link, sd_json_variant *parameters, const char *action) {
-        static const sd_json_dispatch_field dispatch_table[] = {
-                VARLINK_DISPATCH_POLKIT_FIELD,
-                {}
-        };
-
         int r;
         Manager *m = ASSERT_PTR(sd_varlink_get_userdata(ASSERT_PTR(link)));
 
         assert(action);
 
-        r = sd_varlink_dispatch(link, parameters, dispatch_table, /* userdata = */ NULL);
+        r = sd_varlink_dispatch(link, parameters, dispatch_table_polkit_only, /* userdata= */ NULL);
         if (r != 0)
                 return r;
 
diff --git a/src/shared/bus-polkit.c b/src/shared/bus-polkit.c
index 97d81e743c..99d99a5bbb 100644
--- a/src/shared/bus-polkit.c
+++ b/src/shared/bus-polkit.c
@@ -886,3 +886,8 @@ bool varlink_has_polkit_action(sd_varlink *link, const char *action, const char
         return false;
 #endif
 }
+
+const sd_json_dispatch_field dispatch_table_polkit_only[] = {
+        VARLINK_DISPATCH_POLKIT_FIELD,
+        {}
+};
diff --git a/src/shared/bus-polkit.h b/src/shared/bus-polkit.h
index 284583f2a1..7f6f21b51e 100644
--- a/src/shared/bus-polkit.h
+++ b/src/shared/bus-polkit.h
@@ -35,6 +35,10 @@ static inline int varlink_verify_polkit_async(sd_varlink *link, sd_bus *bus, con
                 .type = SD_JSON_VARIANT_BOOLEAN,                 \
         }
 
+/* A dispatch table that only accepts (but ignores) the Polkit field, and refuses everything else. This can
+ * be used wherever methods do not accept any parameters but shall be access controlled via Polkit. */
+extern const sd_json_dispatch_field dispatch_table_polkit_only[];
+
 /* Generates the right Varlink introspection field for the allowInteractiveAuthentication field above. To be used in Varlink IDL definitions. */
 #define VARLINK_DEFINE_POLKIT_INPUT                                     \
         SD_VARLINK_FIELD_COMMENT("Controls whether interactive authentication (via polkit) shall be allowed. If unspecified defaults to false."), \