SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

core: make ProtectHostname= optionally take a hostname

Browse Source 
Closes #35623.
This commit is contained in:
Yu Watanabe
2024-12-16 23:55:44 +09:00
parent 0d298a771a
commit e76fcd0e40
11 changed files with 208 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/dbus-execute.c
+32 -9
View File
@@ -13,6 +13,7 @@
#include "creds-util.h"
#include "dbus-execute.h"
#include "dbus-util.h"
#include "dns-domain.h"
#include "env-util.h"
#include "errno-list.h"
#include "escape.h"
@@ -21,6 +22,7 @@
#include "fd-util.h"
#include "fileio.h"
#include "hexdecoct.h"
#include "hostname-util.h"
#include "iovec-util.h"
#include "ioprio-util.h"
#include "journal-file.h"
@@ -64,7 +66,6 @@ static BUS_DEFINE_PROPERTY_GET_REF(property_get_private_tmp_ex, "s", PrivateTmp,
static BUS_DEFINE_PROPERTY_GET_REF(property_get_private_users_ex, "s", PrivateUsers, private_users_to_string);
static BUS_DEFINE_PROPERTY_GET_REF(property_get_protect_control_groups_ex, "s", ProtectControlGroups, protect_control_groups_to_string);
static BUS_DEFINE_PROPERTY_GET_REF(property_get_private_pids, "s", PrivatePIDs, private_pids_to_string);
static BUS_DEFINE_PROPERTY_GET_REF(property_get_protect_hostname_ex, "s", ProtectHostname, protect_hostname_to_string);
static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_level, "i", int, LOG_PRI);
static BUS_DEFINE_PROPERTY_GET_REF(property_get_syslog_facility, "i", int, LOG_FAC);
static BUS_DEFINE_PROPERTY_GET(property_get_cpu_affinity_from_numa, "b", ExecContext, exec_context_get_cpu_affinity_from_numa);
@@ -1084,6 +1085,20 @@ static int property_get_protect_hostname(
return sd_bus_message_append_basic(reply, 'b', &b);
}
static int property_get_protect_hostname_ex(
sd_bus *bus,
const char *path,
const char *interface,
const char *property,
sd_bus_message *reply,
void *userdata,
sd_bus_error *error) {
ExecContext *c = ASSERT_PTR(userdata);
return sd_bus_message_append(reply, "(ss)", protect_hostname_to_string(c->protect_hostname), c->private_hostname);
}
const sd_bus_vtable bus_exec_vtable[] = {
SD_BUS_VTABLE_START(0),
SD_BUS_PROPERTY("Environment", "as", NULL, offsetof(ExecContext, environment), SD_BUS_VTABLE_PROPERTY_CONST),
@@ -1259,7 +1274,7 @@ const sd_bus_vtable bus_exec_vtable[] = {
SD_BUS_PROPERTY("ProtectProc", "s", property_get_protect_proc, offsetof(ExecContext, protect_proc), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("ProcSubset", "s", property_get_proc_subset, offsetof(ExecContext, proc_subset), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("ProtectHostname", "b", property_get_protect_hostname, offsetof(ExecContext, protect_hostname), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("ProtectHostnameEx", "s", property_get_protect_hostname_ex, offsetof(ExecContext, protect_hostname), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("ProtectHostnameEx", "(ss)", property_get_protect_hostname_ex, 0, SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("MemoryKSM", "b", bus_property_get_tristate, offsetof(ExecContext, memory_ksm), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("NetworkNamespacePath", "s", NULL, offsetof(ExecContext, network_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("IPCNamespacePath", "s", NULL, offsetof(ExecContext, ipc_namespace_path), SD_BUS_VTABLE_PROPERTY_CONST),
@@ -2027,21 +2042,29 @@ int bus_exec_context_set_transient_property(
}
if (streq(name, "ProtectHostnameEx")) {
const char *s;
ProtectHostname t;
const char *s, *h = NULL;
r = sd_bus_message_read(message, "s", &s);
r = sd_bus_message_read(message, "(ss)", &s, &h);
if (r < 0)
return r;
t = protect_hostname_from_string(s);
if (t < 0)
if (!isempty(h) && !hostname_is_valid(h, /* flags = */ 0))
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid hostname in %s setting: %s", name, h);
ProtectHostname t = protect_hostname_from_string(s);
if (t < 0 || (t == PROTECT_HOSTNAME_NO && !isempty(h)))
return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid %s setting: %s", name, s);
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
c->protect_hostname = t;
(void) unit_write_settingf(u, flags, name, "ProtectHostname=%s",
protect_hostname_to_string(c->protect_hostname));
r = free_and_strdup(&c->private_hostname, empty_to_null(h));
if (r < 0)
return r;
(void) unit_write_settingf(u, flags, name, "ProtectHostname=%s%s%s",
protect_hostname_to_string(c->protect_hostname),
c->private_hostname ? ":" : "",
strempty(c->private_hostname));
}
return 1;