morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

various: turn off SO_PASSRIGHTS where fds are not expected

Browse Source
This commit is contained in:
Mike Yuan
2025-06-06 22:00:52 +02:00
parent ed6b7b6ace
commit 85352c095e
7 changed files with 37 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/core/manager.c
View File

@@ -1136,6 +1136,10 @@ static int manager_setup_user_lookup_fd(Manager *m) {
if (socketpair(AF_UNIX, SOCK_DGRAM|SOCK_CLOEXEC, 0, m->user_lookup_fds) < 0)
return log_error_errno(errno, "Failed to allocate user lookup socket: %m");
r = setsockopt_int(m->user_lookup_fds[0], SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r))
log_warning_errno(r, "Failed to turn off SO_PASSRIGHTS on user lookup socket, ignoring: %m");
(void) fd_increase_rxbuf(m->user_lookup_fds[0], MANAGER_SOCKET_RCVBUF_SIZE);
}
@@ -1176,7 +1180,11 @@ static int manager_setup_handoff_timestamp_fd(Manager *m) {
r = setsockopt_int(m->handoff_timestamp_fds[0], SOL_SOCKET, SO_PASSCRED, true);
if (r < 0)
return log_error_errno(r, "SO_PASSCRED failed: %m");
return log_error_errno(r, "Failed to enable SO_PASSCRED on handoff timestamp socket: %m");
r = setsockopt_int(m->handoff_timestamp_fds[0], SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0 && !ERRNO_IS_NEG_NOT_SUPPORTED(r))
log_warning_errno(r, "Failed to turn off SO_PASSRIGHTS on handoff timestamp socket, ignoring: %m");
/* Mark the receiving socket as O_NONBLOCK (but leave sending side as-is) */
r = fd_nonblock(m->handoff_timestamp_fds[0], true);
@@ -1223,7 +1231,7 @@ static int manager_setup_pidref_transport_fd(Manager *m) {
r = setsockopt_int(m->pidref_transport_fds[0], SOL_SOCKET, SO_PASSPIDFD, true);
if (ERRNO_IS_NEG_NOT_SUPPORTED(r))
log_debug("SO_PASSPIDFD is not supported for pidref socket, ignoring.");
log_debug_errno(r, "SO_PASSPIDFD is not supported for pidref socket, ignoring.");
else if (r < 0)
log_warning_errno(r, "Failed to enable SO_PASSPIDFD for pidref socket, ignoring: %m");

12
src/journal/journald-stream.c
View File

@@ -647,10 +647,6 @@ int stdout_stream_install(Manager *m, int fd, StdoutStream **ret) {
if (r < 0)
return log_ratelimit_error_errno(r, JOURNAL_LOG_RATELIMIT, "Failed to determine peer credentials: %m");
r = setsockopt_int(fd, SOL_SOCKET, SO_PASSCRED, true);
if (r < 0)
return log_error_errno(r, "SO_PASSCRED failed: %m");
if (mac_selinux_use()) {
r = getpeersec(fd, &stream->label);
if (r < 0 && r != -EOPNOTSUPP)
@@ -918,6 +914,14 @@ int manager_open_stdout_socket(Manager *m, const char *stdout_socket) {
} else
(void) fd_nonblock(m->stdout_fd, true);
r = setsockopt_int(m->stdout_fd, SOL_SOCKET, SO_PASSCRED, true);
if (r < 0)
return log_error_errno(r, "Failed to enable SO_PASSCRED: %m");
r = setsockopt_int(m->stdout_fd, SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0)
log_debug_errno(r, "Failed to turn off SO_PASSRIGHTS, ignoring: %m");
r = sd_event_add_io(m->event, &m->stdout_event_source, m->stdout_fd, EPOLLIN, stdout_stream_new, m);
if (r < 0)
return log_error_errno(r, "Failed to add stdout server fd to event source: %m");

11
src/journal/journald-syslog.c
View File

@@ -504,17 +504,22 @@ int manager_open_syslog_socket(Manager *m, const char *syslog_socket) {
r = setsockopt_int(m->syslog_fd, SOL_SOCKET, SO_PASSCRED, true);
if (r < 0)
return log_error_errno(r, "SO_PASSCRED failed: %m");
return log_error_errno(r, "Failed to enable SO_PASSCRED: %m");
r = setsockopt_int(m->syslog_fd, SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0)
log_debug_errno(r, "Failed to turn off SO_PASSRIGHTS, ignoring: %m");
if (mac_selinux_use()) {
r = setsockopt_int(m->syslog_fd, SOL_SOCKET, SO_PASSSEC, true);
if (r < 0)
log_full_errno(ERRNO_IS_NEG_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r, "SO_PASSSEC failed, ignoring: %m");
log_full_errno(ERRNO_IS_NEG_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r,
"Failed to enable SO_PASSSEC, ignoring: %m");
}
r = setsockopt_int(m->syslog_fd, SOL_SOCKET, SO_TIMESTAMP, true);
if (r < 0)
return log_error_errno(r, "SO_TIMESTAMP failed: %m");
return log_error_errno(r, "Failed to enable SO_TIMESTAMP: %m");
r = sd_event_add_io(m->event, &m->syslog_event_source, m->syslog_fd, EPOLLIN, manager_process_datagram, m);
if (r < 0)

4
src/nspawn/nspawn.c
View File

@@ -3716,6 +3716,10 @@ static int setup_notify_child(const void *directory) {
if (r < 0)
log_debug_errno(r, "Failed to enable SO_PASSPIDFD, ignoring: %m");
r = setsockopt_int(fd, SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0)
log_debug_errno(r, "Failed to turn off SO_PASSRIGHTS, ignoring: %m");
return TAKE_FD(fd);
}

2
src/shared/ask-password-api.c
View File

@@ -819,6 +819,8 @@ static int create_socket(const char *askpwdir, char **ret) {
if (r < 0)
return r;
(void) setsockopt_int(fd, SOL_SOCKET, SO_PASSRIGHTS, false);
*ret = TAKE_PTR(path);
return TAKE_FD(fd);
}

4
src/udev/udev-ctrl.c
View File

@@ -59,6 +59,10 @@ int udev_ctrl_new_from_fd(UdevCtrl **ret, int fd) {
if (r < 0)
log_warning_errno(r, "Failed to set SO_PASSCRED, ignoring: %m");
r = setsockopt_int(fd >= 0 ? fd : sock, SOL_SOCKET, SO_PASSRIGHTS, false);
if (r < 0)
log_debug_errno(r, "Failed to turn off SO_PASSRIGHTS, ignoring: %m");
uctrl = new(UdevCtrl, 1);
if (!uctrl)
return -ENOMEM;

1
units/syslog.socket
View File

@@ -27,6 +27,7 @@ ListenDatagram=/run/systemd/journal/syslog
SocketMode=0666
PassCredentials=yes
PassSecurity=yes
AcceptFileDescriptors=no
ReceiveBuffer=8M
# The default syslog implementation should make syslog.service a