From 08f28e92188fd0d9ce9858e9cdeb6a64458dfb35 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 31 May 2018 17:19:02 +0100 Subject: [PATCH 26/39] containers: Containers with an Allow policy cannot see well-known names There is one exception: they can see the dbus-daemon itself. Signed-off-by: Simon McVittie --- bus/containers.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/bus/containers.c b/bus/containers.c index e87c0851..b731fa37 100644 --- a/bus/containers.c +++ b/bus/containers.c @@ -1642,10 +1642,32 @@ dbus_bool_t bus_containers_check_can_see_well_known_name (DBusConnection *observer, const char *name) { +#ifdef DBUS_ENABLE_CONTAINERS + BusContainerInstance *instance; +#endif + _dbus_assert (observer != NULL); _dbus_assert (name != NULL); _dbus_assert (name[0] != ':'); +#ifdef DBUS_ENABLE_CONTAINERS + instance = connection_get_instance (observer); + + if (instance == NULL) + return TRUE; + + if (instance->has_policy) + { + /* The dbus-daemon itself is always visible */ + if (strcmp (name, DBUS_SERVICE_DBUS) == 0) + return TRUE; + + /* TODO: Have a policy by which containers can optionally see + * (and own) well-known names */ + return FALSE; + } +#endif /* DBUS_ENABLE_CONTAINERS */ + return TRUE; } -- 2.17.0