dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-04 15:10:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

varlink: add common helper that refuse method calls from unpriv clients

Browse Source
This commit is contained in:
Lennart Poettering
2025-03-26 12:34:34 -04:00
committed by Yu Watanabe
parent 0f2373f214
commit a7d58b7d3d
4 changed files with 21 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/libsystemd/sd-varlink/varlink-util.c
View File

@@ -181,3 +181,19 @@ int varlink_server_new(
*ret = TAKE_PTR(s);
return 0;
}
int varlink_check_privileged_peer(sd_varlink *vl) {
int r;
assert(vl);
uid_t uid;
r = sd_varlink_get_peer_uid(vl, &uid);
if (r < 0)
return log_debug_errno(r, "Failed to get peer UID: %m");
if (uid != 0)
return sd_varlink_error(vl, SD_VARLINK_ERROR_PERMISSION_DENIED, /* parameters= */ NULL);
return 0;
}

2
src/libsystemd/sd-varlink/varlink-util.h
View File

@@ -26,3 +26,5 @@ int varlink_server_new(
sd_varlink_server **ret,
sd_varlink_server_flags_t flags,
void *userdata);
int varlink_check_privileged_peer(sd_varlink *vl);

7
src/login/logind-varlink.c
View File

@@ -241,12 +241,9 @@ static int vl_method_create_session(sd_varlink *link, sd_json_variant *parameter
p.remote = p.remote_user || p.remote_host;
/* Before we continue processing this, let's ensure the peer is privileged */
uid_t peer_uid;
r = sd_varlink_get_peer_uid(link, &peer_uid);
r = varlink_check_privileged_peer(link);
if (r < 0)
return log_debug_errno(r, "Failed to get peer UID: %m");
if (peer_uid != 0)
return sd_varlink_error(link, SD_VARLINK_ERROR_PERMISSION_DENIED, /* parameters= */ NULL);
return r;
if (!pidref_is_set(&p.pid)) {
r = varlink_get_peer_pidref(link, &p.pid);

5
src/nsresourced/nsresourcework.c
View File

@@ -1197,7 +1197,6 @@ static int vl_method_add_mount_to_user_namespace(sd_varlink *link, sd_json_varia
};
int r, mnt_id = 0;
struct stat userns_st;
uid_t peer_uid;
assert(link);
assert(parameters);
@@ -1207,11 +1206,9 @@ static int vl_method_add_mount_to_user_namespace(sd_varlink *link, sd_json_varia
return r;
/* Allowlisting arbitrary mounts is a privileged operation */
r = sd_varlink_get_peer_uid(link, &peer_uid);
r = varlink_check_privileged_peer(link);
if (r < 0)
return r;
if (peer_uid != 0)
return sd_varlink_error(link, SD_VARLINK_ERROR_PERMISSION_DENIED, NULL);
r = sd_varlink_dispatch(link, parameters, parameter_dispatch_table, &p);
if (r != 0)