Attachment 126648 Details for Bug 97821 – Proposed patch against 1.10.8

[patch] Proposed patch against 1.10.8

0003-Process-group-id.patch (text/plain), 16.46 KB, created by Slava Monich on 2016-09-20 10:19:17 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Slava Monich

Created: 2016-09-20 10:19:17 UTC

Size: 16.46 KB

patch

obsolete

>diff --git a/bus/connection.c b/bus/connection.c
>index 95e20a6..1eadd46 100644
>--- a/bus/connection.c
>+++ b/bus/connection.c
>@@ -960,7 +960,7 @@ bus_connection_get_unix_groups  (DBusConnection   *connection,
>                                  int              *n_groups,
>                                  DBusError        *error)
> {
>-  unsigned long uid;
>+  unsigned long uid, gid;
> 
>   *groups = NULL;
>   *n_groups = 0;
>@@ -977,11 +977,41 @@ bus_connection_get_unix_groups  (DBusConnection   *connection,
>         {
>           _dbus_verbose ("Got %d groups for UID %lu\n",
>                          *n_groups, uid);
>-          return TRUE;
>         }
>     }
>-  else
>-    return TRUE; /* successfully got 0 groups */
>+
>+  if (_dbus_connection_get_unix_group (connection, &gid))
>+    {
>+      int i, found;
>+
>+      for (i = 0, found = -1; i < *n_groups; i++)
>+        {
>+          if ((*groups)[i] == gid)
>+            {
>+              found = i;
>+              break;
>+            }
>+        }
>+
>+      if (found < 0)
>+        {
>+          unsigned long *group_ids = dbus_new (unsigned long, *n_groups + 1);
>+
>+          if (group_ids)
>+            {
>+              if (*groups)
>+                {
>+                  memcpy (group_ids + 1, *groups, *n_groups * sizeof (unsigned long));
>+                  dbus_free (*groups);
>+                }
>+              group_ids[0] = gid;
>+              *groups = group_ids;
>+              *n_groups = *n_groups + 1;
>+            }
>+        }
>+    }
>+
>+    return TRUE;
> }
> 
> dbus_bool_t
>diff --git a/dbus/dbus-auth.c b/dbus/dbus-auth.c
>index f222787..a034b87 100644
>--- a/dbus/dbus-auth.c
>+++ b/dbus/dbus-auth.c
>@@ -765,6 +765,13 @@ sha1_handle_second_client_response (DBusAuth         *auth,
>                                          DBUS_CREDENTIAL_UNIX_PROCESS_ID,
>                                          auth->credentials))
>     goto out_3;
>+
>+  /* Copy group ID from the socket credentials if it's there
>+   */
>+  if (!_dbus_credentials_add_credential (auth->authorized_identity,
>+                                         DBUS_CREDENTIAL_UNIX_GROUP_ID,
>+                                         auth->credentials))
>+    goto out_3;
>   
>   if (!send_ok (auth))
>     goto out_3;
>@@ -1138,6 +1145,11 @@ handle_server_data_external_mech (DBusAuth         *auth,
>         return FALSE;
> 
>       if (!_dbus_credentials_add_credential (auth->authorized_identity,
>+                                             DBUS_CREDENTIAL_UNIX_GROUP_ID,
>+                                             auth->credentials))
>+        return FALSE;
>+
>+      if (!_dbus_credentials_add_credential (auth->authorized_identity,
>                                              DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID,
>                                              auth->credentials))
>         return FALSE;
>@@ -1251,6 +1263,13 @@ handle_server_data_anonymous_mech (DBusAuth         *auth,
>                                          auth->credentials))
>     return FALSE;
>   
>+  /* Copy group ID from the socket credentials
>+   */
>+  if (!_dbus_credentials_add_credential (auth->authorized_identity,
>+                                         DBUS_CREDENTIAL_UNIX_GROUP_ID,
>+                                         auth->credentials))
>+    return FALSE;
>+
>   /* Anonymous is always allowed */
>   if (!send_ok (auth))
>     return FALSE;
>diff --git a/dbus/dbus-connection-internal.h b/dbus/dbus-connection-internal.h
>index 4835732..a980e78 100644
>--- a/dbus/dbus-connection-internal.h
>+++ b/dbus/dbus-connection-internal.h
>@@ -117,6 +117,9 @@ void              _dbus_connection_set_pending_fds_function       (DBusConnectio
> DBUS_PRIVATE_EXPORT
> dbus_bool_t       _dbus_connection_get_linux_security_label       (DBusConnection  *connection,
>                                                                    char           **label_p);
>+DBUS_PRIVATE_EXPORT
>+dbus_bool_t       _dbus_connection_get_unix_group                 (DBusConnection *connection,
>+                                                                   unsigned long  *gid);
> 
> /* if DBUS_ENABLE_STATS */
> DBUS_PRIVATE_EXPORT
>diff --git a/dbus/dbus-connection.c b/dbus/dbus-connection.c
>index 81b3a83..2cf386d 100644
>--- a/dbus/dbus-connection.c
>+++ b/dbus/dbus-connection.c
>@@ -5243,6 +5243,28 @@ dbus_connection_get_unix_user (DBusConnection *connection,
>   return result;
> }
> 
>+dbus_bool_t
>+_dbus_connection_get_unix_group (DBusConnection *connection,
>+                                 unsigned long  *gid)
>+{
>+  dbus_bool_t result;
>+
>+  _dbus_return_val_if_fail (connection != NULL, FALSE);
>+  _dbus_return_val_if_fail (gid != NULL, FALSE);
>+
>+  CONNECTION_LOCK (connection);
>+
>+  if (!_dbus_transport_try_to_authenticate (connection->transport))
>+    result = FALSE;
>+  else
>+    result = _dbus_transport_get_unix_group (connection->transport, gid);
>+
>+  CONNECTION_UNLOCK (connection);
>+
>+  return result;
>+}
>+
>+
> /**
>  * Gets the process ID of the connection if any.
>  * Returns #TRUE if the pid is filled in.
>diff --git a/dbus/dbus-credentials.c b/dbus/dbus-credentials.c
>index 151bb00..650c599 100644
>--- a/dbus/dbus-credentials.c
>+++ b/dbus/dbus-credentials.c
>@@ -48,6 +48,7 @@
> struct DBusCredentials {
>   int refcount;
>   dbus_uid_t unix_uid;
>+  dbus_gid_t unix_gid;
>   dbus_pid_t pid;
>   char *windows_sid;
>   char *linux_security_label;
>@@ -78,6 +79,7 @@ _dbus_credentials_new (void)
>   
>   creds->refcount = 1;
>   creds->unix_uid = DBUS_UID_UNSET;
>+  creds->unix_gid = DBUS_GID_UNSET;
>   creds->pid = DBUS_PID_UNSET;
>   creds->windows_sid = NULL;
>   creds->linux_security_label = NULL;
>@@ -173,6 +175,21 @@ _dbus_credentials_add_unix_uid(DBusCredentials    *credentials,
> }
> 
> /**
>+ * Add a UNIX group ID to the credentials.
>+ *
>+ * @param credentials the object
>+ * @param gid the group ID
>+ * @returns #FALSE if no memory
>+ */
>+dbus_bool_t
>+_dbus_credentials_add_unix_gid(DBusCredentials    *credentials,
>+                               dbus_gid_t          gid)
>+{
>+  credentials->unix_gid = gid;
>+  return TRUE;
>+}
>+
>+/**
>  * Add a Windows user SID to the credentials.
>  *
>  * @param credentials the object
>@@ -261,6 +278,8 @@ _dbus_credentials_include (DBusCredentials    *credentials,
>       return credentials->pid != DBUS_PID_UNSET;
>     case DBUS_CREDENTIAL_UNIX_USER_ID:
>       return credentials->unix_uid != DBUS_UID_UNSET;
>+    case DBUS_CREDENTIAL_UNIX_GROUP_ID:
>+      return credentials->unix_gid != DBUS_GID_UNSET;
>     case DBUS_CREDENTIAL_WINDOWS_SID:
>       return credentials->windows_sid != NULL;
>     case DBUS_CREDENTIAL_LINUX_SECURITY_LABEL:
>@@ -300,6 +319,19 @@ _dbus_credentials_get_unix_uid (DBusCredentials    *credentials)
> }
> 
> /**
>+ * Gets the UNIX group ID in the credentials, or #DBUS_GID_UNSET if
>+ * the credentials object doesn't contain a group ID.
>+ *
>+ * @param credentials the object
>+ * @returns UNIX group ID
>+ */
>+dbus_gid_t
>+_dbus_credentials_get_unix_gid (DBusCredentials    *credentials)
>+{
>+  return credentials->unix_gid;
>+}
>+
>+/**
>  * Gets the Windows user SID in the credentials, or #NULL if
>  * the credentials object doesn't contain a Windows user SID.
>  *
>@@ -368,6 +400,8 @@ _dbus_credentials_are_superset (DBusCredentials    *credentials,
>      possible_subset->pid == credentials->pid) &&
>     (possible_subset->unix_uid == DBUS_UID_UNSET ||
>      possible_subset->unix_uid == credentials->unix_uid) &&
>+    (possible_subset->unix_gid == DBUS_GID_UNSET ||
>+     possible_subset->unix_gid == credentials->unix_gid) &&
>     (possible_subset->windows_sid == NULL ||
>      (credentials->windows_sid && strcmp (possible_subset->windows_sid,
>                                           credentials->windows_sid) == 0)) &&
>@@ -393,6 +427,7 @@ _dbus_credentials_are_empty (DBusCredentials    *credentials)
>   return
>     credentials->pid == DBUS_PID_UNSET &&
>     credentials->unix_uid == DBUS_UID_UNSET &&
>+    credentials->unix_gid == DBUS_GID_UNSET &&
>     credentials->windows_sid == NULL &&
>     credentials->linux_security_label == NULL &&
>     credentials->adt_audit_data == NULL;
>@@ -432,6 +467,9 @@ _dbus_credentials_add_credentials (DBusCredentials    *credentials,
>                                       DBUS_CREDENTIAL_UNIX_USER_ID,
>                                       other_credentials) &&
>     _dbus_credentials_add_credential (credentials,
>+                                      DBUS_CREDENTIAL_UNIX_GROUP_ID,
>+                                      other_credentials) &&
>+    _dbus_credentials_add_credential (credentials,
>                                       DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID,
>                                       other_credentials) &&
>     _dbus_credentials_add_credential (credentials,
>@@ -471,6 +509,12 @@ _dbus_credentials_add_credential (DBusCredentials    *credentials,
>       if (!_dbus_credentials_add_unix_uid (credentials, other_credentials->unix_uid))
>         return FALSE;
>     }
>+  else if (which == DBUS_CREDENTIAL_UNIX_GROUP_ID &&
>+           other_credentials->unix_gid != DBUS_GID_UNSET)
>+    {
>+      if (!_dbus_credentials_add_unix_gid (credentials, other_credentials->unix_gid))
>+        return FALSE;
>+    }
>   else if (which == DBUS_CREDENTIAL_WINDOWS_SID &&
>            other_credentials->windows_sid != NULL)
>     {
>@@ -504,6 +548,7 @@ _dbus_credentials_clear (DBusCredentials    *credentials)
> {
>   credentials->pid = DBUS_PID_UNSET;
>   credentials->unix_uid = DBUS_UID_UNSET;
>+  credentials->unix_gid = DBUS_GID_UNSET;
>   dbus_free (credentials->windows_sid);
>   credentials->windows_sid = NULL;
>   dbus_free (credentials->linux_security_label);
>diff --git a/dbus/dbus-credentials.h b/dbus/dbus-credentials.h
>index 6bf6c2b..8aa2b92 100644
>--- a/dbus/dbus-credentials.h
>+++ b/dbus/dbus-credentials.h
>@@ -33,6 +33,7 @@ DBUS_BEGIN_DECLS
> typedef enum {
>   DBUS_CREDENTIAL_UNIX_PROCESS_ID,
>   DBUS_CREDENTIAL_UNIX_USER_ID,
>+  DBUS_CREDENTIAL_UNIX_GROUP_ID,
>   DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID,
>   DBUS_CREDENTIAL_LINUX_SECURITY_LABEL,
>   DBUS_CREDENTIAL_WINDOWS_SID
>@@ -53,6 +54,9 @@ DBUS_PRIVATE_EXPORT
> dbus_bool_t      _dbus_credentials_add_unix_uid             (DBusCredentials    *credentials,
>                                                              dbus_uid_t          uid);
> DBUS_PRIVATE_EXPORT
>+dbus_bool_t      _dbus_credentials_add_unix_gid             (DBusCredentials    *credentials,
>+                                                             dbus_gid_t          gid);
>+DBUS_PRIVATE_EXPORT
> dbus_bool_t      _dbus_credentials_add_windows_sid          (DBusCredentials    *credentials,
>                                                              const char         *windows_sid);
> dbus_bool_t      _dbus_credentials_add_linux_security_label (DBusCredentials    *credentials,
>@@ -68,6 +72,8 @@ dbus_pid_t       _dbus_credentials_get_pid                  (DBusCredentials
> DBUS_PRIVATE_EXPORT
> dbus_uid_t       _dbus_credentials_get_unix_uid             (DBusCredentials    *credentials);
> DBUS_PRIVATE_EXPORT
>+dbus_gid_t       _dbus_credentials_get_unix_gid             (DBusCredentials    *credentials);
>+DBUS_PRIVATE_EXPORT
> const char*      _dbus_credentials_get_windows_sid          (DBusCredentials    *credentials);
> const char *     _dbus_credentials_get_linux_security_label (DBusCredentials    *credentials);
> void *           _dbus_credentials_get_adt_audit_data       (DBusCredentials    *credentials);
>diff --git a/dbus/dbus-sysdeps-unix.c b/dbus/dbus-sysdeps-unix.c
>index 50ca60a..724c737 100644
>--- a/dbus/dbus-sysdeps-unix.c
>+++ b/dbus/dbus-sysdeps-unix.c
>@@ -1816,6 +1816,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>   struct iovec iov;
>   char buf;
>   dbus_uid_t uid_read;
>+  dbus_gid_t gid_read;
>   dbus_pid_t pid_read;
>   int bytes_read;
> 
>@@ -1835,6 +1836,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>   _DBUS_STATIC_ASSERT (sizeof (gid_t) <= sizeof (dbus_gid_t));
> 
>   uid_read = DBUS_UID_UNSET;
>+  gid_read = DBUS_GID_UNSET;
>   pid_read = DBUS_PID_UNSET;
> 
>   _DBUS_ASSERT_ERROR_IS_CLEAR (error);
>@@ -1921,6 +1923,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>       {
>         pid_read = cr.pid;
>         uid_read = cr.uid;
>+        gid_read = cr.gid;
>       }
> #elif defined(HAVE_UNPCBID) && defined(LOCAL_PEEREID)
>     /* Another variant of the above - used on NetBSD
>@@ -1942,6 +1945,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>       {
>         pid_read = cr.unp_pid;
>         uid_read = cr.unp_euid;
>+        gid_read = cr.unp_egid;
>       }
> #elif defined(HAVE_CMSGCRED)
>     /* We only check for HAVE_CMSGCRED, but we're really assuming that the
>@@ -1966,6 +1970,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>             cred = (struct cmsgcred *) CMSG_DATA (cmsgp);
>             pid_read = cred->cmcred_pid;
>             uid_read = cred->cmcred_euid;
>+            gid_read = cred->cmcred_gid;
>             break;
>           }
>       }
>@@ -1979,6 +1984,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>       {
>         pid_read = ucred_getpid (ucred);
>         uid_read = ucred_geteuid (ucred);
>+        gid_read = ucred_getegid (ucred);
> #ifdef HAVE_ADT
>         /* generate audit session data based on socket ucred */
>         adt_session_data_t *adth = NULL;
>@@ -2044,6 +2050,7 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>     if (getpeereid (client_fd.fd, &euid, &egid) == 0)
>       {
>         uid_read = euid;
>+        gid_read = egid;
>       }
>     else
>       {
>@@ -2072,9 +2079,11 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>   _dbus_verbose ("Credentials:"
>                  "  pid "DBUS_PID_FORMAT
>                  "  uid "DBUS_UID_FORMAT
>+                 "  gid "DBUS_GID_FORMAT
>                  "\n",
> 		 pid_read,
>-		 uid_read);
>+		 uid_read,
>+		 gid_read);
> 
>   if (pid_read != DBUS_PID_UNSET)
>     {
>@@ -2094,6 +2103,15 @@ _dbus_read_credentials_socket  (DBusSocket       client_fd,
>         }
>     }
> 
>+  if (gid_read != DBUS_GID_UNSET)
>+    {
>+      if (!_dbus_credentials_add_unix_gid (credentials, gid_read))
>+        {
>+          _DBUS_SET_OOM (error);
>+          return FALSE;
>+        }
>+    }
>+
>   if (!add_linux_security_label_to_credentials (client_fd.fd, credentials))
>     {
>       _DBUS_SET_OOM (error);
>@@ -2557,6 +2575,8 @@ _dbus_credentials_add_from_current_process (DBusCredentials *credentials)
>     return FALSE;
>   if (!_dbus_credentials_add_unix_uid(credentials, _dbus_geteuid()))
>     return FALSE;
>+  if (!_dbus_credentials_add_unix_gid(credentials, getegid()))
>+    return FALSE;
> 
>   return TRUE;
> }
>diff --git a/dbus/dbus-transport.c b/dbus/dbus-transport.c
>index 31586b1..f6c3df7 100644
>--- a/dbus/dbus-transport.c
>+++ b/dbus/dbus-transport.c
>@@ -1333,6 +1333,39 @@ _dbus_transport_get_unix_user (DBusTransport *transport,
> }
> 
> /**
>+ * See _dbus_connection_get_unix_group().
>+ *
>+ * @param transport the transport
>+ * @param gid return location for the group ID
>+ * @returns #TRUE if uid is filled in with a valid group ID
>+ */
>+dbus_bool_t
>+_dbus_transport_get_unix_group (DBusTransport *transport,
>+                               unsigned long *gid)
>+{
>+  DBusCredentials *auth_identity;
>+
>+  *gid = _DBUS_INT32_MAX; /* better than some root or system user in
>+                           * case of bugs in the caller. Caller should
>+                           * never use this value on purpose, however.
>+                           */
>+
>+  if (!transport->authenticated)
>+    return FALSE;
>+
>+  auth_identity = _dbus_auth_get_identity (transport->auth);
>+
>+  if (_dbus_credentials_include (auth_identity,
>+                                 DBUS_CREDENTIAL_UNIX_GROUP_ID))
>+    {
>+      *gid = _dbus_credentials_get_unix_gid (auth_identity);
>+      return TRUE;
>+    }
>+  else
>+    return FALSE;
>+}
>+
>+/**
>  * See dbus_connection_get_unix_process_id().
>  *
>  * @param transport the transport
>diff --git a/dbus/dbus-transport.h b/dbus/dbus-transport.h
>index 9e3787d..8cb3ae7 100644
>--- a/dbus/dbus-transport.h
>+++ b/dbus/dbus-transport.h
>@@ -74,6 +74,8 @@ dbus_bool_t        _dbus_transport_get_socket_fd          (DBusTransport
>                                                            DBusSocket                 *fd_p);
> dbus_bool_t        _dbus_transport_get_unix_user          (DBusTransport              *transport,
>                                                            unsigned long              *uid);
>+dbus_bool_t        _dbus_transport_get_unix_group         (DBusTransport              *transport,
>+                                                           unsigned long              *gid);
> dbus_bool_t        _dbus_transport_get_unix_process_id     (DBusTransport              *transport,
>                                                            unsigned long              *pid);
> dbus_bool_t        _dbus_transport_get_adt_audit_session_data (DBusTransport              *transport,

Actions: View | Splinter Review

Attachments on bug 97821: 126648

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.