summaryrefslogtreecommitdiff
path: root/src/login/logind-seat-dbus.c
Commit message (Collapse)AuthorAgeFilesLines
* basic: rename util.h to logarithm.hZbigniew Jędrzejewski-Szmek2022-11-081-1/+0
| | | | | util.h is now about logarithms only, so we can rename it. Many files included util.h for no apparent reason… Those includes are dropped.
* tree-wide: use ASSERT_PTR moreDavid Tardon2022-09-131-20/+10
|
* list: declare iterator of LIST_FOREACH() in the loopYu Watanabe2022-03-191-1/+0
|
* logind: Use new macrosNishal Kulkarni2021-12-191-12/+10
| | | | | | Migrate logind to use the new macros to declare a D-Bus method or signal. Replaced SD_BUS_METHOD_WITH_NAMES with SD_BUS_METHOD_WITH_ARGS. Replaced SD_BUS_SIGNAL_WITH_NAMES with SD_BUS_SIGNAL_WITH_ARGS.
* tree-wide: sd_bus_error_setf → set_bus_error_setZbigniew Jędrzejewski-Szmek2021-04-071-1/+1
| | | | strdup() is more efficient than asprintf().
* logind: Restore chvt as non-root user without polkitJoshua Watt2021-02-161-36/+5
| | | | | | | | | | | | | | | 4acf0cfd2f ("logind: check PolicyKit before allowing VT switch") broke the ability to write user sessions that run graphical sessions (e.g. weston/X11). This was partially amended in 19bb87fbfa ("login: allow non-console sessions to change vt") by changing the default PolicyKit policy so that non-root users with a session are again allowed to switch the VT. This makes the policy when PolKit is not enabled (as on many embedded systems) closer the default PolKit policy and allows launching graphical sessions as a non-root user. Closes #17473 Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* logind: clarify what the second argument of session_stop() means when calling itLennart Poettering2020-09-111-1/+1
|
* tree-wide: define iterator inside of the macroZbigniew Jędrzejewski-Szmek2020-09-081-2/+1
|
* shared: split out property get helpersLennart Poettering2020-06-301-0/+1
| | | | No code changes, just some refactoring.
* logind: convert to the new schemeZbigniew Jędrzejewski-Szmek2020-05-051-36/+43
|
* Merge pull request #15396 from keszybz/dbus-api-docsLennart Poettering2020-04-171-2/+14
|\ | | | | D-bus API docs
| * logind: add dbus parameter namesZbigniew Jędrzejewski-Szmek2020-04-121-2/+14
| |
* | sd-login: get rid of seat_can_multi_session()Zbigniew Jędrzejewski-Szmek2020-04-171-2/+2
|/ | | | | | | | | Follow-up for fa2cf64a917d31605d40d34e98ce9e2e066064fa. Backwards-compat is retained. A short note is added in docs, in case people see sd_seat_can_multi_session() mentioned somewhere and wonder what happened to it. Also see https://github.com/systemd/systemd/pull/15337#issuecomment-610369404.
* logind: check PolicyKit before allowing VT switchLennart Poettering2020-01-221-1/+57
| | | | | | Let's lock this down a bit. Effectively nothing much changes, since the default PK policy will allow users on the VT to change VT. Only users with no local VT session won't be able to switch VTs.
* shared: split out polkit stuff from bus-util.c → bus-polkit.cLennart Poettering2020-01-221-0/+1
| | | | | | It's enough, complex stuff to warrant its own source file. No other changes, just splitting out.
* tree-wide: drop string.h when string-util.h or friends are includedYu Watanabe2019-11-041-1/+0
|
* logind: fix emission of PropertiesChanged on seatsZbigniew Jędrzejewski-Szmek2019-10-211-2/+0
| | | | | | | | | | | | The story is the same as in 471cffcfb0e005b7c4044b3b52cc4f25d217efac: device_attach() → seat_send_changed() → sd_bus_emit_properties_changed_strv() → emit_properties_changed_on_interface() → node_vtable_get_userdata() → seat_object_find(), which returns 0 because message == NULL. But when we are emitting a signal, message is always NULL. Removing the overeager check and assert in the called function allow the signal to be emitted. Fixes #13769.
* tree-wide: get rid of strappend()Lennart Poettering2019-07-121-1/+1
| | | | | It's a special case of strjoin(), so no need to keep both. In particular as typing strjoin() is even shoert than strappend().
* logind: split out dbus header files into their ownLennart Poettering2019-05-241-0/+3
| | | | | | | | | Previously, logind's logind-session.h would define prototypes for logind-session.c and logind-session-dbus.c. Split that out, so that there's a separate logind-session-dbus.h for that. Similar for seats and users as well as the manager itself. This changes no code, just rearranges where protoypes are located.
* logind: make "self" and "auto" magic strings when operating on seats + sessionsLennart Poettering2019-05-241-26/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the operations one can do on sessions so far accepted an empty session name as a shortcut for the caller's session. This is quite useful traditionally, but much less useful than it used to be, since most user code now (rightfully) runs in --user context, not in a session. With this change we tweak the logic a bit: we introduce the two special session and seat names "self" and "auto". The former refers to the session/seat the client is in, and is hence mostly equivalent to te empty string "" as before. However, the latter refers to the session/seat the client is in if that exists, with a fallback of the user's display session if not. Clients can hence reference "auto" instead of the empty string if they really don't want to think much about sessions. Why "self" btw? Previously, we'd already expose a special dbus object with the path /org/freedesktop/login1/session/self (and similar for the seat), matching what the empty string did for bus calls that took a session name. With this scheme we reuse this identifier and introduce "auto" in a similar way. Of course this means real-life seats and sessions can never be named "self" or "auto", but they aren't anyway: valid seat names have to start with "seat" anyway, and sessions are generated server-side as either a numeric value or "c" suffixed with a counter ID. Fixes: #12399
* util: drop missing.h from util.hYu Watanabe2018-12-041-0/+1
|
* tree-wide: replace 'unsigned int' with 'unsigned'Yu Watanabe2018-10-191-1/+1
|
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-3/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* login: use BUS_DEFINE_PROPERTY_GET* macrosYu Watanabe2018-05-151-54/+4
|
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* tree-wide: use TAKE_PTR() and TAKE_FD() macrosYu Watanabe2018-04-051-2/+1
|
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* logind: "self" objects which do not apply - return specific error messagesAlan Jenkins2017-11-141-17/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's confusing that the bus API has aliases like "session/self" that return an error based on ENXIO, when it also has methods that return e.g. NO_SESSION_FOR_PID for the same problem. The latter kind of error includes more specifically helpful messages. "user/self" is the odd one out; it returns a generic UnknownObject error when it is not applicable to the caller. It's not clear whether this was intentional, but at first I thought it was more correct. More specifically, user_object_find() was returning 0 for "user/self", in the same situations (more or less) where user_node_enumerator() was omitting "user/self". I thought that was a good idea, because returning e.g. -ENXIO instead suggested that there _is_ something specific on that path. And it could be confused with errors of the method being called. Therefore I suggested changing the enumerator, always admitting that there is a handler for the path "foo/self", but returning a specific error when queried. However this interacts poorly with tools like D-Feet or `busctl`. In either tool, looking at logind would show an error message, and then go on to omit "user/self" in the normal listing. These tools are very useful, so we don't want to interfere with them. I think we can change the error codes without causing problems. The self objects were not listed in the documentation. They have been suggested to other projects - but without reference to error reporting. "seat/self" is used by various Wayland compositors for VT switching, but they don't appear to reference specific errors. We _could_ insist on the link between enumeration and UnknownObject, and standardize on that as the error for the aliases. But I'm not aware of any practical complaints, that we returned an error from an object that didn't exist. Instead, let's unify the codepaths for "user/self" vs GetUserByPid(0) etc. We will return the most helpful error message we can think of, if the object does not exist. E.g. for "session/self", we might return an error that the caller does not belong to a session. If one of the compositors is ever simplified to use "session/self" in initialization, users would be able to trigger such errors (e.g. run `gnome-shell` inside gnome-terminal). The message text will most likely be logged. The user might not know what the "session" is, but at least we'll be pointing towards the right questions. I think it should also be clearer for development / debugging. Unifying the code paths is also slightly helpful for auditing / marking calls to sd_bus_creds_get_session() in subsequent commits.
* logind: don't include session lists in PropertyChanged messagesLennart Poettering2016-05-051-1/+1
| | | | | | | | | | | | | | | | | If we have a lot of simultaneous sessions we really shouldn't send the full list of active sessions with each PropertyChanged message for user and seat objects, as that can become quite substantial data, we probably shouldn't dump on the bus on each login and logout. Note that the global list of sessions doesn't send out changes like this either, it only supports requesting the session list with ListSessions(). If cients want to get notified about sessions coming and going they should subscribe to SessionNew and SessionRemoved signals, and clients generally do that already. This is kind of an API break, but then again the fact that this was included was never documented.
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* tree-wide: expose "p"-suffix unref calls in public APIs to make gcc cleanup easyLennart Poettering2015-11-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | GLIB has recently started to officially support the gcc cleanup attribute in its public API, hence let's do the same for our APIs. With this patch we'll define an xyz_unrefp() call for each public xyz_unref() call, to make it easy to use inside a __attribute__((cleanup())) expression. Then, all code is ported over to make use of this. The new calls are also documented in the man pages, with examples how to use them (well, I only added docs where the _unref() call itself already had docs, and the examples, only cover sd_bus_unrefp() and sd_event_unrefp()). This also renames sd_lldp_free() to sd_lldp_unref(), since that's how we tend to call our destructors these days. Note that this defines no public macro that wraps gcc's attribute and makes it easier to use. While I think it's our duty in the library to make our stuff easy to use, I figure it's not our duty to make gcc's own features easy to use on its own. Most likely, client code which wants to make use of this should define its own: #define _cleanup_(function) __attribute__((cleanup(function))) Or similar, to make the gcc feature easier to use. Making this logic public has the benefit that we can remove three header files whose only purpose was to define these functions internally. See #2008.
* util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering2015-10-271-0/+1
|
* user-util: move UID/GID related macros from macro.h to user-util.hLennart Poettering2015-10-271-4/+5
|
* bus-util: support details in CheckAuthorization callsMichael Chapman2015-09-061-0/+1
| | | | | | Extra details for an action can be supplied when calling polkit's CheckAuthorization method. Details are a list of key/value string pairs. Custom policy can use these details when making authorization decisions.
* sd-bus: drop bus parameter from message callback prototypeLennart Poettering2015-04-291-10/+5
| | | | | | This should simplify the prototype a bit. The bus parameter is redundant in most cases, and in the few where it matters it can be derived from the message via sd_bus_message_get_bus().
* logind: open up most bus calls for unpriviliged processes, using PolicyKitLennart Poettering2015-02-181-2/+15
| | | | | | Also, allow clients to alter their own objects without any further priviliges. i.e. this allows clients to kill and lock their own sessions without involving PK.
* logind: hide 'self' links if not availableDavid Herrmann2015-01-181-3/+20
| | | | | | | If the caller does not run in a session/seat or has no tracked user, hide the /org/freedesktop/login1/.../self links in introspection data. Otherwise, "busctl tree org.freedesktop.login1" tries to query those nodes even though it cant.
* logind: when a bus call is done on a session, user or seat, optionally ↵Lennart Poettering2015-01-091-10/+8
| | | | | | | | | | determine them from the caller credentials More specifically, if an operation is requested on a session with an empty name, the caller's session is used. If an operation is requested on a seat with an empty name, the seat of the caller's session is used. Finally, if an operation on the user with UID -1 is requested, the user of the client's session is used (and not the UID of the client!).
* logind: include "self" object links in dbus introspectionLennart Poettering2015-01-091-0/+4
| | | | Makes "busctl introspect" a lot more fun.
* logind: remove spurious include of <sys/capability.h>Filipe Brandenburger2014-12-251-1/+0
| | | | | | | | | | They do not use any functions from libcap directly. The CAP_* constants in use through these files come from "missing.h" which will import <linux/capability.h> and complement it with CAP_* constants not defined by the current kernel headers. The "missing.h" header is imported through "util.h" which gets imported in "logind.h". Tested that "systemd-logind" builds cleanly and works after this change.
* sd-bus: move common errors src/shared/bus-errors.h → ↵Lennart Poettering2014-12-101-1/+1
| | | | | | src/libsystemd/sd-bus/bus-common-errors.h Stuff in src/shared/ should not use stuff from src/libsystemd/ really.
* sd-bus: introduce sd_bus_slot objects encapsulating callbacks or vtables ↵Lennart Poettering2014-05-151-1/+1
| | | | | | | | | | | attached to a bus connection This makes callback behaviour more like sd-event or sd-resolve, and creates proper object for unregistering callbacks. Taking the refernce to the slot is optional. If not taken life time of the slot will be bound to the underlying bus object (or in the case of an async call until the reply has been recieved).
* bus: replace sd_bus_label_{escape,unescape}() by new ↵Lennart Poettering2014-03-111-2/+3
| | | | | | | | | | | sd_bus_path_{encode,decode}() The new calls work similarly, but enforce a that a common, fixed bus path prefix is used. This follows discussions with Simon McVittie on IRC that it should be a good idea to make sure that people don't use the escaping applied here too wildly as anything other than the last label of a bus path.
* Introduce strv_consume which takes ownershipZbigniew Jędrzejewski-Szmek2014-03-041-4/+2
| | | | This mirrors set_consume and makes the common use a bit nicer.
* logind: always kill session when termination is requestedZbigniew Jędrzejewski-Szmek2014-02-111-1/+1
| | | | | KillUserProcesses=yes/no should be ignored when termination is explicitly requested.
* logind: introduce session "positions"David Herrmann2014-01-201-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | logind has no concept of session ordering. Sessions have a unique name, some attributes about the capabilities and that's already it. There is currently no stable+total order on sessions. If we use the logind API to switch between sessions, we are faced with an unordered list of sessions we have no clue of. This used to be no problem on seats with VTs or on seats with only a single active session. However, with the introduction of multi-session capability for seats without VTs, we need to find a way to order sessions in a stable way. This patch introduces session "positions". A position is a simple integer assigned to a session which is never changed implicitly (currently, we also don't change it explicitly, but that may be changed someday). For seats with VTs, we force the position to be the same as the VTnr. Without VTs, we simply find the lowest unassigned number and use it as position. If position-assignment fails or if, for any reason, we decide to not assign a position to a session, the position is set to 0 (which is treated as invalid position). During session_load() or if two sessions have the same VTnr, we may end up with two sessions with the same position (this shouldn't happen, but lets be fail-safe in case some other part of the stack fails). This case is dealt with gracefully by ignoring any session but the first session assigned to the position. Thus, session->pos is a hint, seat->positions[i] is the definite position-assignment. Always verify both match in case you need to modify them! Additionally, we introduce SwitchTo(unsigned int) on the seat-dbus-API. You can call it with any integer value != 0 and logind will try to switch to the request position. If you implement a compositor or any other session-controller, you simply watch for ctrl+alt+F1 to F12 and call SwitchTo(Fx). logind will figure a way out deal with this number. For convenience, we also introduce SwitchToNext/Previous(). It should be called on ctrl+alt+Left/Right (like the kernel-console used to support). Note that the public API (SwitchTo*()) is *not* bound to the underlying logic that is implemented now. We don't export "session-positions" on the dbus/C API! They are an implementation detail. Instead, the SwitchTo*() API is supposed to be a hint to let logind choose the session-switching logic. Any foreground session-controller is free to enumerate/order existing sessions according to their needs and call Session.Activate() manually. But the SwitchTo*() API provides a uniform behavior across session-controllers. Background: Session-switching keys depend on the active keymap. The XKB specification provides the XKB_KEY_XF86Switch_VT_1-12 key-symbols which have to be mapped by all keymaps to allow session-switching. It is usually bound to ctrl+alt+Fx but may be set differently. A compositor passes any keyboard input to XKB before passing it to clients. In case a key-press invokes the XKB_KEY_XF86Switch_VT_x action, the keypress is *not* forwarded to clients, but instead a session-switch is scheduled. This actually prevents us from handling these keys outside of the session. If an active compositor has a keymap with a different mapping of these keys, and logind itself tries to catch these combinations, we end up with the key-press sent to the compositor's clients *and* handled by logind. This is *bad* and we must avoid this. The only situation where a background process is allowed to handle key-presses is debugging and emergency-keys. In these cases, we don't care for keymap mismatches and accept the double-event. Another exception is unmapped keys like PowerOff/Suspend (even though this one is controversial).
* bus: decorate the various object vtables with SD_BUS_VTABLE_PROPERTY_CONST ↵Lennart Poettering2013-12-221-3/+3
| | | | where appropriate
* bus: introduce "trusted" bus concept and encode access control in object vtablesLennart Poettering2013-12-101-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduces a new concept of "trusted" vs. "untrusted" busses. For the latter libsystemd-bus will automatically do per-method access control, for the former all access is automatically granted. Per-method access control is encoded in the vtables: by default all methods are only accessible to privileged clients. If the SD_BUS_VTABLE_UNPRIVILEGED flag is set for a method it is accessible to unprivileged clients too. By default whether a client is privileged is determined via checking for its CAP_SYS_ADMIN capability, but this can be altered via the SD_BUS_VTABLE_CAPABILITY() macro that can be ORed into the flags field of the method. Writable properties are also subject to SD_BUS_VTABLE_UNPRIVILEGED and SD_BUS_VTABLE_CAPABILITY() for controlling write access to them. Note however that read access is unrestricted, as PropertiesChanged messages might send out the values anyway as an unrestricted broadcast. By default the system bus is set to "untrusted" and the user bus is "trusted" since per-method access control on the latter is unnecessary. On dbus1 busses we check the UID of the caller rather than the configured capability since the capability cannot be determined without race. On kdbus the capability is checked if possible from the attached meta-data of a message and otherwise queried from the sending peer. This also decorates the vtables of the various daemons we ship with these flags.
View Lorry Controller Status