SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

logind: respect SD_LOGIND_ROOT_CHECK_INHIBITORS with weak blockers (#34969)

Browse Source 
The check for the old flag was not restored when the weak blocker was
added, add it back. Also skip polkit check for root for the weak
blocker, to keep compatibility with the previous behaviour.

Partially fixes https://github.com/systemd/systemd/issues/34091

Follow-up for 804874d26a
This commit is contained in:
Luca Boccassi
2024-11-02 11:27:28 +00:00
committed by GitHub
parent acc35e5129 93445c2e89
commit c166969137
2 changed files with 21 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/login/logind-dbus.c
+13 -4
View File
@@ -2056,6 +2056,7 @@ static int verify_shutdown_creds(
_cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
bool multiple_sessions, blocked, interactive;
Inhibitor *offending = NULL;
uid_t uid;
int r;
@@ -2076,7 +2077,7 @@ static int verify_shutdown_creds(
return r;
multiple_sessions = r > 0;
blocked = manager_is_inhibited(m, a->inhibit_what, /* block= */ true, NULL, false, true, uid, NULL);
blocked = manager_is_inhibited(m, a->inhibit_what, /* block= */ true, NULL, false, true, uid, &offending);
interactive = flags & SD_LOGIND_INTERACTIVE;
if (multiple_sessions) {
@@ -2095,13 +2096,21 @@ static int verify_shutdown_creds(
}
if (blocked) {
if (!FLAGS_SET(flags, SD_LOGIND_SKIP_INHIBITORS))
PolkitFlags polkit_flags = 0;
/* With a strong inhibitor, if the skip flag is not set, reject outright.
* With a weak inhibitor, if root is asking and the root flag is set, reject outright.
* All else, check polkit first. */
if (!FLAGS_SET(flags, SD_LOGIND_SKIP_INHIBITORS) &&
(offending->mode != INHIBIT_BLOCK_WEAK ||
(uid == 0 && FLAGS_SET(flags, SD_LOGIND_ROOT_CHECK_INHIBITORS))))
return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED,
"Access denied due to active block inhibitor");
/* We want to always ask here, even for root, to only allow bypassing if explicitly allowed
* by polkit */
PolkitFlags polkit_flags = POLKIT_ALWAYS_QUERY;
* by polkit, unless a weak blocker is used, in which case it will be authorized. */
if (offending->mode != INHIBIT_BLOCK_WEAK)
polkit_flags |= POLKIT_ALWAYS_QUERY;
if (interactive)
polkit_flags |= POLKIT_ALLOW_INTERACTIVE;
src/login/logind-inhibit.c
+8 -4
View File
@@ -404,9 +404,9 @@ bool manager_is_inhibited(
bool ignore_inactive,
bool ignore_uid,
uid_t uid,
Inhibitor **offending) {
Inhibitor **ret_offending) {
Inhibitor *i;
Inhibitor *i, *offending = NULL;
struct dual_timestamp ts = DUAL_TIMESTAMP_NULL;
bool inhibited = false;
@@ -437,13 +437,17 @@ bool manager_is_inhibited(
inhibited = true;
if (offending)
*offending = i;
/* Stronger inhibitor wins */
if (!offending || (i->mode < offending->mode))
offending = i;
}
if (since)
*since = ts;
if (ret_offending)
*ret_offending = offending;
return inhibited;
}