core: check valid uid for D-Bus load_connection(s)/set_logging calls

Commit 4c7fa8dfdcbf ("core: drop root requirement for
load_connection(s)/set_logging D-Bus calls") removed the enforcing of
permission in the daemon for such methods since the D-Bus daemon
configuration already does that. That change also allows clients to
send a request and not wait for a response, since we don't have to
check the caller credentials in the daemon.

In the future we might switch to polkit for these methods, breaking
clients that don't wait for a reponse, so it seems better to prevent
from beginning such behavior.

Fixes: 4c7fa8dfdcbf13f3633b565af53896ac79366912
(cherry picked from commit dd27b79c4e726fca4a192b27453221d6942e4717)

1 files changed, 23 insertions, 5 deletions

diff --git a/src/nm-bus-manager.c b/src/nm-bus-manager.c
index 5894d7570d..449de4e68a 100644
--- a/src/nm-bus-manager.c
+++ b/src/nm-bus-manager.c
@@ -533,11 +533,28 @@ nm_bus_manager_get_caller_info_from_message (NMBusManager *self,
 	return _get_caller_info (self, NULL, connection, message, out_sender, out_uid, out_pid);
 }
 
+/**
+ * nm_bus_manager_ensure_uid:
+ *
+ * @self: bus manager instance
+ * @context: D-Bus method invocation
+ * @uid: a user-id
+ * @error_domain: error domain to return on failure
+ * @error_code: error code to return on failure
+ *
+ * Retrieves the uid of the D-Bus method caller and
+ * checks that it matches @uid, unless @uid is G_MAXULONG.
+ * In case of failure the function returns FALSE and finishes
+ * handling the D-Bus method with an error.
+ *
+ * Returns: %TRUE if the check succeeded, %FALSE otherwise
+ */
 gboolean
-nm_bus_manager_ensure_root (NMBusManager          *self,
-                            GDBusMethodInvocation *context,
-                            GQuark error_domain,
-                            int error_code)
+nm_bus_manager_ensure_uid (NMBusManager          *self,
+                           GDBusMethodInvocation *context,
+                           gulong uid,
+                           GQuark error_domain,
+                           int error_code)
 {
 	gulong caller_uid;
 	GError *error = NULL;
@@ -552,7 +569,8 @@ nm_bus_manager_ensure_root (NMBusManager          *self,
 		g_dbus_method_invocation_take_error (context, error);
 		return FALSE;
 	}
-	if (caller_uid != 0) {
+
+	if (uid != G_MAXULONG && caller_uid != uid) {
 		error = g_error_new_literal (error_domain,
 		                             error_code,
 		                             "Permission denied");