If BusPolicy= was passed, the parser function will have created
an ExecContext->bus_endpoint object, along with policy information.
In that case, create a kdbus endpoint, and pass its path name to the
namespace logic, to it will be mounted over the actual 'bus' node.
At endpoint creation time, no policy is updloaded. That is done after
fork(), through a separate call. This is necessary because we don't
know the real uid of the process earlier than that.
If a path to a previously created custom kdbus endpoint is passed in,
bind-mount a new devtmpfs that contains a 'bus' node, which in turn in
bind-mounted with the custom endpoint. This tmpfs then mounted over the
kdbus subtree that refers to the current bus.
This way, we can fake the bus node in order to lock down services with
a kdbus custom endpoint policy.
Add a new directive called BusPolicy to define custom endpoint policies. If
one such directive is given, an endpoint object in the service's ExecContext is
created and the given policy is added to it.
Custom endpoints are alternative connection points to a bus, allowing
specific policy to be uploaded.
Add two functions to bus-kernel. One to create such endpoints, and another
one for setting a policy for them.
This factors out one conditional branch that has grown way too big, and
makes the code more readable by using return statements rather than jump
labels.
This way, the list of arguments to that function gets more comprehensive,
and we can get around passing lots of NULL and 0 arguments from socket.c,
swap.c and mount.c.
It also allows for splitting up the code in exec_spawn().
While at it, make ExecContext const in execute.c.
If a name was passed in as function argument, trust it, and don't do utf-8
encoding for them. Callers are obliged to check the names themselves, and
escape them in case they use anything they got from the outside world.
As memfds are now created by proper kernel API, and not by our functions, we
can't rely on names being escaped/unescaped according to our current logic.
Thus, the only safe way is to remove the escaping and when reading names,
just escape names that are not properly encoded in UTF-8.
Also, remove assert(name) lines from the memfd creation functions, as we
explictly allow name to be NULL.
Remove the sd_ prefix from internal functions and get rid of the sd_memfd
type. As a memfd is now just a native file descriptor, we can get rid of our
own wrapper type, and also use close() and dup() on them directly.
Add a new config 'Activating' directive which denotes whether a busname
is actually registered on the bus. It defaults to 'yes'.
If set to 'no', the .busname unit only uploads policy, which will remain
active as long as the unit is running.
Bring some arrays that are used for DEFINE_STRING_TABLE_LOOKUP() in the
same order than the enums they reference.
Also, pass the corresponding _MAX value to the array initalizer where
appropriate.
Activator connections may upload policy when registering to the bus.
This patch contains code to translate between BusNamePolicy objects and
the kdbus specific items.
Bring kdbus.h in sync with recent policy related changes. Most notably,
KDBUS_MAKE_POLICY_OPEN is now gone. The rest doesn't matter for systemd
at this point, as the policy functionality was not yet used.
There are three directives to specify bus name polices in .busname
files:
* AllowUser [username] [access]
* AllowGroup [groupname] [access]
* AllowWorld [access]
Where [access] is one of
* 'see': The user/group/world is allowed to see a name on the bus
* 'talk': The user/group/world is allowed to talk to a name
* 'own': The user/group/world is allowed to own a name
There is no user added yet in this commit.
When the manager receives a SIGUSR2 signal, it opens a memory stream
with open_memstream(), uses the returned file handle for logging, and
dumps the logged content with log_dump().
However, the char* buffer is only safe to use after the file handle has
been flushed with fflush, as the man pages states:
When the stream is closed (fclose(3)) or flushed (fflush(3)), the
locations pointed to by ptr and sizeloc are updated to contain,
respectively, a pointer to the buffer and the current size of the
buffer.
These values remain valid only as long as the caller performs no
further output on the stream. If further output is performed, then the
stream must again be flushed before trying to access these variables.
Without that call, dump remains NULL and the daemon crashes in
log_dump().
When a busname unit enters BUSNAME_FAILURE_SERVICE_FAILED_PERMANENT, the
serialization will not be able to look up the result as string via
busname_result_to_string(). This leads to an assertion trap during
daemon-reexec.
get_next_elapse() will always fill 'next' with values when it
returns >= 0. Hence, the compiler is wrong about this warning.
Initialize 'next' nevertheless.
src/systemctl/systemctl.c: In function ‘list_timers’:
src/systemctl/systemctl.c:953:43: warning: ‘next.monotonic’ may be used
uninitialized in this function [-Wmaybe-uninitialized]
converted = nw.realtime - (nw.monotonic - next.monotonic);
^
In file included from ./src/shared/log.h:30:0,
from src/systemctl/systemctl.c:46:
./src/shared/macro.h:137:38: warning: ‘next.realtime’ may be used
uninitialized in this function [-Wmaybe-uninitialized]
_a < _b ? _a : _b; \
^
src/systemctl/systemctl.c:933:32: note: ‘next.realtime’ was declared here
dual_timestamp next;
^
Use 'if defined()', not 'ifdef defined()'. Fixes the following warning.
CC src/shared/architecture.lo
In file included from src/shared/architecture.c:24:0:
src/shared/architecture.h:89:17: warning: extra tokens at end of #ifdef
directive [enabled by default]
# ifdef defined(WORDS_BIGENDIAN)
^
gcc (4.8.2, arm) does not understand that journal_file_append_field()
will always set 'fo' when it returns 0, so this warning is bogus.
Anyway, fix it by initialiting fo = NULL.
gcc (4.8.2, arm) doesn't understand that vtable_property_get_userdata()
will always set 'u' when it returns > 0. Hence, the warning is bogus,
but anyway.
src/libsystemd/sd-bus/bus-objects.c:510:19: warning: 'u' may be used uninitialized in this function [-Wmaybe-uninitialized]
(and yes, indeed, even the reported line numbers are bogus in this case)
Two new things here:
a) struct kdbus_notify_name_change now carries two struct
kdbus_notify_id_change
b) a new KDBUS_CMD_BYEBYE ioctl that has no user yet in systemd
systemd-bus-driverd is a small daemon that connects to kdbus and
implements the org.freedesktop.DBus interface. IOW, it provides the bus
functions traditionally taken care for by dbus-daemon.
Calls are proxied to kdbus, either via libsystemd-bus (were applicable)
or with the open-coded use of ioctl().
Note that the implementation is not yet finished as the functions to
add and remove matches and to start services by name are still missing.
The name list and query functions now work differently in kdbus, as the
result is stored in the connection's pool, rather than being copied back
through the ioctl buffer. That also safes us some logic, as we don't
have to resize the communication buffer in a loop with growing buffer
sizes.
Due to this, KDBUS_CMD_MSG_RELEASE was renamed to KDBUS_CMD_FREE, as it
is now used outside the message logic as well.
Augment systemd-stdio-bridge a bit to make it a 1:1 bridge from legacy
DBus clients to kdbus. In particular,
* allow setting the bus path of the upstream bus as command line
argument
* use sd_listen_fds() for systemd's socket activation
* omit calling sd_bus_negotiate_fds() when upstream bus is kdbus
* reply to bus send errors with proper dbus error messages
* treat -ECONNRESET as expected end-of-connection condition
kdbus returns -EALREADY if the requesting connection is already the
owner of a name, and -EEXIST if the name already exists and the
connection is not able to take it over.
Also, n->flags needs a translation as well to match the SD_BUS_* enum
values.
Flags used to request a name from kdbus are not identical to what DBus
and sd_bus use internally. Introduce a simple function to do the
translation for us. It's factored out to a separate function so the
dbus-driver instance can make use of it as well.
In particular, KDBUS_ITEM_NEXT is now called KDBUS_PART_NEXT, and
KDBUS_ITEM_FOREACH was renamed to KDBUS_PART_FOREACH and takes one more
argument to make it more flexible.
Fixes the following build errors on Fedora 20:
CC src/core/libsystemd_core_la-selinux-access.lo
src/core/selinux-access.c: In function 'get_audit_data':
src/core/selinux-access.c:245:22: error: storage size of 'ucred' isn't known
struct ucred ucred;
^
src/core/selinux-access.c:259:9: warning: implicit declaration of function 'getsockopt' [-Wimplicit-function-declaration]
r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len);
^
src/core/selinux-access.c:259:28: error: 'SOL_SOCKET' undeclared (first use in this function)
r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len);
^
src/core/selinux-access.c:259:28: note: each undeclared identifier is reported only once for each function it appears in
src/core/selinux-access.c:259:40: error: 'SO_PEERCRED' undeclared (first use in this function)
r = getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &ucred, &len);
^
src/core/selinux-access.c:245:22: warning: unused variable 'ucred' [-Wunused-variable]
struct ucred ucred;
^
make[2]: *** [src/core/libsystemd_core_la-selinux-access.lo] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2
Daniel Mack