SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolved: add missing polkit checks on FlushCaches and ResetServerFeatures D-Bus methods

Browse Source 
The FlushCaches and ResetServerFeatures D-Bus methods perform
destructive operations (flushing all DNS caches and resetting server
feature negotiation including DNS-over-TLS state) without any
authorization check. The corresponding Varlink methods already enforce
polkit via verify_polkit(), but the D-Bus handlers were not updated.

Add bus_verify_polkit_async() calls to both methods, matching the
pattern used by ResetStatistics. Add the corresponding policy actions
to the polkit policy file.
This commit is contained in:
TristanInSec
2026-05-19 08:29:34 +02:00
committed by Lennart Poettering
parent 9a8e2f17ef
commit aa76d81122
2 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/resolve/org.freedesktop.resolve1.policy
+22
View File
@@ -205,4 +205,26 @@
<annotate key="org.freedesktop.policykit.owner">unix-user:systemd-resolve</annotate>
</action>
<action id="org.freedesktop.resolve1.flush-caches">
<description gettext-domain="systemd">Flush DNS caches</description>
<message gettext-domain="systemd">Authentication is required to flush DNS caches.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.owner">unix-user:systemd-resolve</annotate>
</action>
<action id="org.freedesktop.resolve1.reset-server-features">
<description gettext-domain="systemd">Reset server features</description>
<message gettext-domain="systemd">Authentication is required to reset server features.</message>
<defaults>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>auth_admin_keep</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.owner">unix-user:systemd-resolve</annotate>
</action>
</policyconfig>
src/resolve/resolved-bus.c
+24
View File
@@ -1842,9 +1842,21 @@ static int bus_method_get_link(sd_bus_message *message, void *userdata, sd_bus_e
static int bus_method_flush_caches(sd_bus_message *message, void *userdata, sd_bus_error *error) {
Manager *m = ASSERT_PTR(userdata);
int r;
assert(message);
r = bus_verify_polkit_async(
message,
"org.freedesktop.resolve1.flush-caches",
/* details= */ NULL,
&m->polkit_registry,
error);
if (r < 0)
return r;
if (r == 0)
return 1; /* Polkit will call us back */
bus_client_log(message, "cache flush");
manager_flush_caches(m, LOG_INFO);
@@ -1854,9 +1866,21 @@ static int bus_method_flush_caches(sd_bus_message *message, void *userdata, sd_b
static int bus_method_reset_server_features(sd_bus_message *message, void *userdata, sd_bus_error *error) {
Manager *m = ASSERT_PTR(userdata);
int r;
assert(message);
r = bus_verify_polkit_async(
message,
"org.freedesktop.resolve1.reset-server-features",
/* details= */ NULL,
&m->polkit_registry,
error);
if (r < 0)
return r;
if (r == 0)
return 1; /* Polkit will call us back */
bus_client_log(message, "server feature reset");
(void) dns_stream_disconnect_all(m);