morgan/systemd
1
0
Fork 0
mirror of https://github.com/morgan9e/systemd synced 2026-04-14 00:14:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

core: Pass NULL error in dump_impl()

Browse Source 
If mac_selinux_access_check() or bus_verify_bypass_dump_ratelimit_async()
fail, we goto "ratelimited" where we set a custom D-BUS error. In
"ratelimited", we call sd_bus_error_setf() which eventually hits an
assert_return(!bus_error_is_dirty()). Avoid hitting this assertion by
passing NULL as the error to mac_selinux_access_check() and
bus_verify_bypass_dump_ratelimit_async() since we will override the error
immediately anyway if either fails.

We modify both functions as well to allow passing a NULL error and fix
the argument name as well while we're at it.
This commit is contained in:
Daan De Meyer
2024-04-28 19:42:51 +02:00
committed by Luca Boccassi
parent 7d7a3c3535
commit ba4c69a0c6
4 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/core/dbus-manager.c
View File

@@ -1405,11 +1405,11 @@ static int dump_impl(
* operations, and can cause PID1 to stall. So it seems similar enough in terms of security
* considerations and impact, and thus use the same access check for dumps which, given the
* large amount of data to fetch, can stall PID1 for quite some time. */
r = mac_selinux_access_check(message, "reload", error);
r = mac_selinux_access_check(message, "reload", /* error = */ NULL);
if (r < 0)
goto ratelimited;
r = bus_verify_bypass_dump_ratelimit_async(m, message, error);
r = bus_verify_bypass_dump_ratelimit_async(m, message, /* error = */ NULL);
if (r < 0)
goto ratelimited;
if (r == 0)

1
src/core/selinux-access.c
View File

@@ -193,7 +193,6 @@ int mac_selinux_access_check_internal(
assert(message);
assert(permission);
assert(function);
assert(error);
r = access_init(error);
if (r <= 0)

5
src/shared/bus-polkit.c
View File

@@ -529,14 +529,13 @@ int bus_verify_polkit_async_full(
uid_t good_user,
PolkitFlags flags,
Hashmap **registry,
sd_bus_error *ret_error) {
sd_bus_error *error) {
int r;
assert(call);
assert(action);
assert(registry);
assert(ret_error);
log_debug("Trying to acquire polkit authentication for '%s'.", action);
@@ -551,7 +550,7 @@ int bus_verify_polkit_async_full(
/* This is a repeated invocation of this function, hence let's check if we've already got
* a response from polkit for this action */
if (q) {
r = async_polkit_query_check_action(q, action, details, flags, ret_error);
r = async_polkit_query_check_action(q, action, details, flags, error);
if (r != 0) {
log_debug("Found matching previous polkit authentication for '%s'.", action);
return r;

4
src/shared/bus-polkit.h
View File

@@ -16,8 +16,8 @@ typedef enum PolkitFLags {
int bus_test_polkit(sd_bus_message *call, const char *action, const char **details, uid_t good_user, bool *_challenge, sd_bus_error *e);
int bus_verify_polkit_async_full(sd_bus_message *call, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry, sd_bus_error *error);
static inline int bus_verify_polkit_async(sd_bus_message *call, const char *action, const char **details, Hashmap **registry, sd_bus_error *ret_error) {
return bus_verify_polkit_async_full(call, action, details, UID_INVALID, 0, registry, ret_error);
static inline int bus_verify_polkit_async(sd_bus_message *call, const char *action, const char **details, Hashmap **registry, sd_bus_error *error) {
return bus_verify_polkit_async_full(call, action, details, UID_INVALID, 0, registry, error);
}
int varlink_verify_polkit_async_full(Varlink *link, sd_bus *bus, const char *action, const char **details, uid_t good_user, PolkitFlags flags, Hashmap **registry);