diff options
| author | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2016-11-21 20:56:55 +0000 |
|---|---|---|
| committer | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2016-11-28 12:11:41 +0000 |
| commit | 373cc47c7c50adb1b624526cfa452d52954621a5 (patch) | |
| tree | f27305cd14ef4727a79572145c47d9f79f959ec8 /bus/selinux.c | |
| parent | 5503511f91a66f0888937690e95d85100bcde4e4 (diff) | |
| download | dbus-373cc47c7c50adb1b624526cfa452d52954621a5.tar.gz | |
Do not auto-activate services if we could not send a message
We specifically do not check recipient policies, because
the recipient policy is based on properties of the
recipient process (in particular, its uid), which we do
not necessarily know until we have already started it.
In this initial implementation we do not check LSMs either,
because we cannot know what LSM context the recipient process
is going to have. However, LSM support will need to be added
to make this feature useful, because StartServiceByName is
normally allowed in non-LSM environments, and is more
powerful than auto-activation anyway.
The StartServiceByName method does not go through this check,
because if access to that method has been granted, then
it's somewhat obvious that you can start arbitrary services.
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98666
Diffstat (limited to 'bus/selinux.c')
| -rw-r--r-- | bus/selinux.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/bus/selinux.c b/bus/selinux.c index 16791c83..e484be68 100644 --- a/bus/selinux.c +++ b/bus/selinux.c @@ -553,6 +553,7 @@ bus_selinux_allows_send (DBusConnection *sender, const char *member, const char *error_name, const char *destination, + BusActivationEntry *activation_entry, DBusError *error) { #ifdef HAVE_SELINUX @@ -566,6 +567,10 @@ bus_selinux_allows_send (DBusConnection *sender, if (!selinux_enabled) return TRUE; + /* We do not mediate activation attempts yet. */ + if (activation_entry) + return TRUE; + if (!sender || !dbus_connection_get_unix_process_id (sender, &spid)) spid = 0; if (!proposed_recipient || !dbus_connection_get_unix_process_id (proposed_recipient, &tpid)) @@ -633,7 +638,8 @@ bus_selinux_allows_send (DBusConnection *sender, } sender_sid = bus_connection_get_selinux_id (sender); - /* A NULL proposed_recipient means the bus itself. */ + + /* A NULL proposed_recipient with no activation entry means the bus itself. */ if (proposed_recipient) recipient_sid = bus_connection_get_selinux_id (proposed_recipient); else |