Attachment 116266 Details for Bug 76358 – sessionmonitor-systemd: Use sd_uid_get_state() to check session activity

[patch] sessionmonitor-systemd: Use sd_uid_get_state() to check session activity

sessionmonitor-systemd-Use-sduidgetstate-to-check-.patch (text/plain), 2.77 KB, created by Philip Withnall on 2015-06-03 13:18:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Philip Withnall

Created: 2015-06-03 13:18:43 UTC

Size: 2.77 KB

patch

obsolete

>From c32c06e814586431c4604461bf467f0ff73f909b Mon Sep 17 00:00:00 2001
>From: Philip Withnall <philip.withnall@collabora.co.uk>
>Date: Tue, 2 Jun 2015 16:19:51 +0100
>Subject: [PATCH] sessionmonitor-systemd: Use sd_uid_get_state() to check
> session activity
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>Content-Transfer-Encoding: 8bit
>
>Instead of using sd_pid_get_session() then sd_session_is_active() to
>determine whether the user is active, use sd_uid_get_state() directly.
>This gets the maximum of the states of all the userâs sessions, rather
>than the state of the session containing the subject process. Since the
>user is the security boundary, this is fine.
>
>This change is necessary for `systemd --user` sessions, where most user
>code will be forked off user@.service, rather than running inside the
>logind session (whether that be a foreground/active or background/online
>session).
>
>Policy-wise, the change is from checking whether the subject process is
>in an active session; to checking whether the subject process is owned
>by a user with at least one active session.
>
>https://bugs.freedesktop.org/show_bug.cgi?id=76358
>---
> .../polkitbackendsessionmonitor-systemd.c          | 33 +++++++++++++++++++++-
> 1 file changed, 32 insertions(+), 1 deletion(-)
>
>diff --git a/src/polkitbackend/polkitbackendsessionmonitor-systemd.c b/src/polkitbackend/polkitbackendsessionmonitor-systemd.c
>index 9995f87..2a6c739 100644
>--- a/src/polkitbackend/polkitbackendsessionmonitor-systemd.c
>+++ b/src/polkitbackend/polkitbackendsessionmonitor-systemd.c
>@@ -389,6 +389,37 @@ gboolean
> polkit_backend_session_monitor_is_session_active (PolkitBackendSessionMonitor *monitor,
>                                                   PolkitSubject               *session)
> {
>-  return sd_session_is_active (polkit_unix_session_get_session_id (POLKIT_UNIX_SESSION (session)));
>+  const char *session_id;
>+  char *state;
>+  uid_t uid;
>+  gboolean is_active = FALSE;
>+
>+  session_id = polkit_unix_session_get_session_id (POLKIT_UNIX_SESSION (session));
>+
>+  g_debug ("Checking whether session %s is active.", session_id);
>+
>+  /* Check whether *any* of the user's current sessions are active. */
>+  if (sd_session_get_uid (session_id, &uid) < 0)
>+    goto fallback;
>+
>+  g_debug ("Session %s has UID %u.", session_id, uid);
>+
>+  if (sd_uid_get_state (uid, &state) < 0)
>+    goto fallback;
>+
>+  g_debug ("UID %u has state %s.", uid, state);
>+
>+  is_active = (g_strcmp0 (state, "active") == 0);
>+  free (state);
>+
>+  return is_active;
>+
>+fallback:
>+  /* Fall back to checking the session. This is not ideal, since the user
>+   * might have multiple sessions, and we cannot guarantee to have chosen
>+   * the active one.
>+   *
>+   * See: https://bugs.freedesktop.org/show_bug.cgi?id=76358. */
>+  return sd_session_is_active (session_id);
> }
> 
>-- 
>2.1.0

Actions: View | Splinter Review

Attachments on bug 76358: 116248 | 116266

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.