Commit b22bdc39 authored by Simon McVittie's avatar Simon McVittie Committed by Simon McVittie

policy: Add max_fds, min_fds qualifiers for send, receive rules

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101848Reviewed-by: Thiago Macieira's avatarThiago Macieira <thiago@kde.org>
[smcv: Revert an incorrect comment change]
Signed-off-by: Simon McVittie's avatarSimon McVittie <smcv@collabora.com>
parent f876edd3
...@@ -1276,6 +1276,43 @@ start_busconfig_child (BusConfigParser *parser, ...@@ -1276,6 +1276,43 @@ start_busconfig_child (BusConfigParser *parser,
} }
} }
/*
* Parse an attribute named name, whose content is content, or NULL if
* missing. It is meant to be a (long) integer between min and max inclusive.
* If it is missing, use def as the default value (which does not
* necessarily need to be between min and max).
*/
static dbus_bool_t
parse_int_attribute (const char *name,
const char *content,
long min,
long max,
long def,
long *value,
DBusError *error)
{
DBusString parse_string;
*value = def;
if (content == NULL)
return TRUE;
_dbus_string_init_const (&parse_string, content);
if (!_dbus_string_parse_int (&parse_string, 0, value, NULL) ||
*value < min || *value > max)
{
dbus_set_error (error, DBUS_ERROR_FAILED,
"Bad value \"%s\" for %s attribute, must be an "
"integer in range %ld to %ld inclusive",
content, name, min, max);
return FALSE;
}
return TRUE;
}
static dbus_bool_t static dbus_bool_t
append_rule_from_element (BusConfigParser *parser, append_rule_from_element (BusConfigParser *parser,
const char *element_name, const char *element_name,
...@@ -1311,6 +1348,10 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1311,6 +1348,10 @@ append_rule_from_element (BusConfigParser *parser,
/* Group: message-matching modifiers that can go on send_ or receive_ */ /* Group: message-matching modifiers that can go on send_ or receive_ */
const char *eavesdrop; const char *eavesdrop;
const char *max_fds_attr;
long max_fds = DBUS_MAXIMUM_MESSAGE_UNIX_FDS;
const char *min_fds_attr;
long min_fds = 0;
/* TRUE if any message-matching modifier is present */ /* TRUE if any message-matching modifier is present */
dbus_bool_t any_message_attribute; dbus_bool_t any_message_attribute;
...@@ -1340,6 +1381,8 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1340,6 +1381,8 @@ append_rule_from_element (BusConfigParser *parser,
"receive_path", &receive_path, "receive_path", &receive_path,
"receive_type", &receive_type, "receive_type", &receive_type,
"eavesdrop", &eavesdrop, "eavesdrop", &eavesdrop,
"max_fds", &max_fds_attr,
"min_fds", &min_fds_attr,
"send_requested_reply", &send_requested_reply, "send_requested_reply", &send_requested_reply,
"receive_requested_reply", &receive_requested_reply, "receive_requested_reply", &receive_requested_reply,
"own", &own, "own", &own,
...@@ -1373,7 +1416,9 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1373,7 +1416,9 @@ append_rule_from_element (BusConfigParser *parser,
(!any_send_attribute && eavesdrop != NULL)); (!any_send_attribute && eavesdrop != NULL));
any_message_attribute = (any_send_attribute || any_message_attribute = (any_send_attribute ||
any_receive_attribute || any_receive_attribute ||
eavesdrop != NULL); eavesdrop != NULL ||
max_fds_attr != NULL ||
min_fds_attr != NULL);
if (!(any_send_attribute || if (!(any_send_attribute ||
any_receive_attribute || any_receive_attribute ||
...@@ -1518,7 +1563,19 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1518,7 +1563,19 @@ append_rule_from_element (BusConfigParser *parser,
"send_requested_reply", send_requested_reply); "send_requested_reply", send_requested_reply);
return FALSE; return FALSE;
} }
/* Matching only messages with DBUS_MAXIMUM_MESSAGE_UNIX_FDS or fewer
* fds is the same as matching all messages, so we always set a maximum,
* but perhaps an unrealistically high one. */
if (!parse_int_attribute ("max_fds", max_fds_attr,
0, DBUS_MAXIMUM_MESSAGE_UNIX_FDS,
DBUS_MAXIMUM_MESSAGE_UNIX_FDS, &max_fds,
error) ||
!parse_int_attribute ("min_fds", min_fds_attr,
0, DBUS_MAXIMUM_MESSAGE_UNIX_FDS, 0, &min_fds,
error))
return FALSE;
rule = bus_policy_rule_new (BUS_POLICY_RULE_SEND, allow); rule = bus_policy_rule_new (BUS_POLICY_RULE_SEND, allow);
if (rule == NULL) if (rule == NULL)
goto nomem; goto nomem;
...@@ -1550,6 +1607,9 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1550,6 +1607,9 @@ append_rule_from_element (BusConfigParser *parser,
rule->d.send.member = _dbus_strdup (send_member); rule->d.send.member = _dbus_strdup (send_member);
rule->d.send.error = _dbus_strdup (send_error); rule->d.send.error = _dbus_strdup (send_error);
rule->d.send.destination = _dbus_strdup (send_destination); rule->d.send.destination = _dbus_strdup (send_destination);
rule->d.send.max_fds = max_fds;
rule->d.send.min_fds = min_fds;
if (send_path && rule->d.send.path == NULL) if (send_path && rule->d.send.path == NULL)
goto nomem; goto nomem;
if (send_interface && rule->d.send.interface == NULL) if (send_interface && rule->d.send.interface == NULL)
...@@ -1611,7 +1671,16 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1611,7 +1671,16 @@ append_rule_from_element (BusConfigParser *parser,
"receive_requested_reply", receive_requested_reply); "receive_requested_reply", receive_requested_reply);
return FALSE; return FALSE;
} }
if (!parse_int_attribute ("max_fds", max_fds_attr,
0, DBUS_MAXIMUM_MESSAGE_UNIX_FDS,
DBUS_MAXIMUM_MESSAGE_UNIX_FDS, &max_fds,
error) ||
!parse_int_attribute ("min_fds", min_fds_attr,
0, DBUS_MAXIMUM_MESSAGE_UNIX_FDS, 0, &min_fds,
error))
return FALSE;
rule = bus_policy_rule_new (BUS_POLICY_RULE_RECEIVE, allow); rule = bus_policy_rule_new (BUS_POLICY_RULE_RECEIVE, allow);
if (rule == NULL) if (rule == NULL)
goto nomem; goto nomem;
...@@ -1628,6 +1697,8 @@ append_rule_from_element (BusConfigParser *parser, ...@@ -1628,6 +1697,8 @@ append_rule_from_element (BusConfigParser *parser,
rule->d.receive.member = _dbus_strdup (receive_member); rule->d.receive.member = _dbus_strdup (receive_member);
rule->d.receive.error = _dbus_strdup (receive_error); rule->d.receive.error = _dbus_strdup (receive_error);
rule->d.receive.origin = _dbus_strdup (receive_sender); rule->d.receive.origin = _dbus_strdup (receive_sender);
rule->d.receive.max_fds = max_fds;
rule->d.receive.min_fds = min_fds;
if (receive_path && rule->d.receive.path == NULL) if (receive_path && rule->d.receive.path == NULL)
goto nomem; goto nomem;
......
...@@ -29,6 +29,7 @@ ...@@ -29,6 +29,7 @@
#include <dbus/dbus-list.h> #include <dbus/dbus-list.h>
#include <dbus/dbus-hash.h> #include <dbus/dbus-hash.h>
#include <dbus/dbus-internals.h> #include <dbus/dbus-internals.h>
#include <dbus/dbus-message-internal.h>
BusPolicyRule* BusPolicyRule*
bus_policy_rule_new (BusPolicyRuleType type, bus_policy_rule_new (BusPolicyRuleType type,
...@@ -1063,6 +1064,20 @@ bus_client_policy_check_can_send (BusClientPolicy *policy, ...@@ -1063,6 +1064,20 @@ bus_client_policy_check_can_send (BusClientPolicy *policy,
} }
} }
if (rule->d.send.min_fds > 0 ||
rule->d.send.max_fds < DBUS_MAXIMUM_MESSAGE_UNIX_FDS)
{
unsigned int n_fds = _dbus_message_get_n_unix_fds (message);
if (n_fds < rule->d.send.min_fds || n_fds > rule->d.send.max_fds)
{
_dbus_verbose (" (policy) skipping rule because message has %u fds "
"and that is outside range [%u,%u]",
n_fds, rule->d.send.min_fds, rule->d.send.max_fds);
continue;
}
}
/* Use this rule */ /* Use this rule */
allowed = rule->allow; allowed = rule->allow;
*log = rule->d.send.log; *log = rule->d.send.log;
...@@ -1263,7 +1278,22 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy, ...@@ -1263,7 +1278,22 @@ bus_client_policy_check_can_receive (BusClientPolicy *policy,
} }
} }
} }
if (rule->d.receive.min_fds > 0 ||
rule->d.receive.max_fds < DBUS_MAXIMUM_MESSAGE_UNIX_FDS)
{
unsigned int n_fds = _dbus_message_get_n_unix_fds (message);
if (n_fds < rule->d.receive.min_fds || n_fds > rule->d.receive.max_fds)
{
_dbus_verbose (" (policy) skipping rule because message has %u fds "
"and that is outside range [%u,%u]",
n_fds, rule->d.receive.min_fds,
rule->d.receive.max_fds);
continue;
}
}
/* Use this rule */ /* Use this rule */
allowed = rule->allow; allowed = rule->allow;
(*toggles)++; (*toggles)++;
......
...@@ -70,6 +70,8 @@ struct BusPolicyRule ...@@ -70,6 +70,8 @@ struct BusPolicyRule
char *member; char *member;
char *error; char *error;
char *destination; char *destination;
unsigned int max_fds;
unsigned int min_fds;
unsigned int eavesdrop : 1; unsigned int eavesdrop : 1;
unsigned int requested_reply : 1; unsigned int requested_reply : 1;
unsigned int log : 1; unsigned int log : 1;
...@@ -86,6 +88,8 @@ struct BusPolicyRule ...@@ -86,6 +88,8 @@ struct BusPolicyRule
char *member; char *member;
char *error; char *error;
char *origin; char *origin;
unsigned int max_fds;
unsigned int min_fds;
unsigned int eavesdrop : 1; unsigned int eavesdrop : 1;
unsigned int requested_reply : 1; unsigned int requested_reply : 1;
} receive; } receive;
......
...@@ -55,6 +55,7 @@ void _dbus_message_get_unix_fds (DBusMessage *message, ...@@ -55,6 +55,7 @@ void _dbus_message_get_unix_fds (DBusMessage *message,
const int **fds, const int **fds,
unsigned *n_fds); unsigned *n_fds);
unsigned int _dbus_message_get_n_unix_fds (DBusMessage *message);
void _dbus_message_lock (DBusMessage *message); void _dbus_message_lock (DBusMessage *message);
void _dbus_message_unlock (DBusMessage *message); void _dbus_message_unlock (DBusMessage *message);
dbus_bool_t _dbus_message_add_counter (DBusMessage *message, dbus_bool_t _dbus_message_add_counter (DBusMessage *message,
......
...@@ -45,6 +45,22 @@ ...@@ -45,6 +45,22 @@
* @{ * @{
*/ */
/**
* Gets the number of unix fds attached to this message.
*
* @param message the message
* @returns the number of file descriptors
*/
unsigned int
_dbus_message_get_n_unix_fds (DBusMessage *message)
{
#ifdef HAVE_UNIX_FD_PASSING
return message->n_unix_fds;
#else
return 0;
#endif
}
#ifdef DBUS_ENABLE_EMBEDDED_TESTS #ifdef DBUS_ENABLE_EMBEDDED_TESTS
/** /**
* Reads arguments from a message iterator given a variable argument * Reads arguments from a message iterator given a variable argument
......
...@@ -906,6 +906,13 @@ rules in the config file allow it).</para> ...@@ -906,6 +906,13 @@ rules in the config file allow it).</para>
recipient, and any broadcast message). recipient, and any broadcast message).
</para> </para>
<para>
The <literal>eavesdrop</literal>, <literal>min_fds</literal> and
<literal>max_fds</literal> attributes are modifiers that can be applied
to either <literal>send_</literal>* or <literal>receive_</literal>*
rules, and are documented below.
</para>
<para>send_destination and receive_sender rules mean that messages may not be <para>send_destination and receive_sender rules mean that messages may not be
sent to or received from the *owner* of the given name, not that sent to or received from the *owner* of the given name, not that
they may not be sent *to that name*. That is, if a connection they may not be sent *to that name*. That is, if a connection
...@@ -969,6 +976,19 @@ the rule matches only when the reply was not ...@@ -969,6 +976,19 @@ the rule matches only when the reply was not
requested. [send|receive]_requested_reply="true" indicates that the rule applies requested. [send|receive]_requested_reply="true" indicates that the rule applies
always, regardless of pending reply state.</para> always, regardless of pending reply state.</para>
<para>
The <literal>min_fds</literal> and <literal>max_fds</literal> attributes
modify either <literal>send_</literal>* or <literal>receive_</literal>*
rules. A rule with the <literal>min_fds</literal> attribute only matches
messages if they have at least that many Unix file descriptors attached.
Conversely, a rule with the <literal>max_fds</literal> attribute only
matches messages if they have no more than that many file descriptors
attached. In practice, rules with these attributes will most commonly
take the form
<literal>&lt;allow send_destination="&hellip;" max_fds="0"/&gt;</literal>,
<literal>&lt;deny send_destination="&hellip;" min_fds="1"/&gt;</literal> or
<literal>&lt;deny receive_sender="*" min_fds="1"/&gt;</literal>.
</para>
<para> <para>
Rules with the <literal>user</literal> or <literal>group</literal> Rules with the <literal>user</literal> or <literal>group</literal>
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment