dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-11 01:25:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

core: connect to sockets in credential directories

Browse Source 
Recursive credential directory loading intentionally
includes socket entries, but load_credential()
only enabled AF_UNIX socket handling for absolute paths.

Let the recursive directory path request socket
connections explicitly, and update the stale comment for directory-fd reads.

Signed-off-by: dongshengyuan <dongshengyuan@uniontech.com>
(cherry picked from commit 944b160007)
(cherry picked from commit 3b3b4692a8)
This commit is contained in:
dongshengyuan
2026-07-06 14:05:28 +08:00
committed by Luca Boccassi
parent 8acfd12985
commit 05eb6a7738
1 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/core/exec-credential.c
View File

@@ -619,7 +619,8 @@ static int load_credential(
LoadCredentialArguments *args,
const char *id,
int read_dfd,
const char *path) {
const char *path,
bool connect_socket) {
ReadFullFileFlags flags = READ_FULL_FILE_SECURE|READ_FULL_FILE_FAIL_WHEN_LARGER;
_cleanup_strv_free_ char **search_path = NULL;
@@ -639,10 +640,8 @@ static int load_credential(
assert(path);
if (read_dfd >= 0) {
/* If a directory fd is specified, then read the file directly from that dir. In this case we
* won't do AF_UNIX stuff (we simply don't want to recursively iterate down a tree of AF_UNIX
* IPC sockets). It's OK if a file vanishes here in the time we enumerate it and intend to
* open it. */
/* If a directory fd is specified, then read the credential directly from that dir. It's OK
* if an entry vanishes in the time between enumeration and opening it. */
if (!filename_is_valid(path)) /* safety check */
return -EINVAL;
@@ -657,13 +656,7 @@ static int load_credential(
if (!path_is_valid(path)) /* safety check */
return -EINVAL;
flags |= READ_FULL_FILE_CONNECT_SOCKET;
/* Pass some minimal info about the unit and the credential name we are looking to acquire
* via the source socket address in case we read off an AF_UNIX socket. */
if (asprintf(&bindname, "@%" PRIx64 "/unit/%s/%s", random_u64(), args->context->unit, id) < 0)
return -ENOMEM;
connect_socket = true;
missing_ok = false;
source = path;
@@ -686,6 +679,15 @@ static int load_credential(
} else
maxsz = CREDENTIAL_SIZE_MAX;
if (connect_socket) {
flags |= READ_FULL_FILE_CONNECT_SOCKET;
/* Pass some minimal info about the unit and the credential name we are looking to acquire
* via the source socket address in case we read off an AF_UNIX socket. */
if (asprintf(&bindname, "@%" PRIx64 "/unit/%s/%s", random_u64(), args->context->unit, id) < 0)
return -ENOMEM;
}
if (search_path)
STRV_FOREACH(d, search_path) {
_cleanup_free_ char *j = NULL;
@@ -774,7 +776,8 @@ static int load_cred_recurse_dir_cb(
r = load_credential(args,
sub_id,
dir_fd, de->d_name);
dir_fd, de->d_name,
de->d_type == DT_SOCK);
if (r < 0)
return r;
@@ -844,7 +847,8 @@ static int acquire_credentials(
/* Regular file (incl. a credential passed in from higher up) */
r = load_credential(&args,
lc->id,
AT_FDCWD, lc->path);
AT_FDCWD, lc->path,
/* connect_socket= */ false);
else
/* Directory */
r = recurse_dir(sub_fd,