Removed temporary systemd socket

[Issue#]        N/A
[Bug/Feature]   After enabled smack protection for security-server
                API temporary unprotected socket is no longer needed
[Cause]         Deprecated temporary socket used
[Solution]      Socket removed
[Verification]  Compiule, run tests

Change-Id: Ifef2aefc0b017b208f2d64a93f68d7ee95be6050

diff --git a/packaging/security-server.spec b/packaging/security-server.spec
index fb01fa1..7e776a4 100644 (file)
--- a/packaging/security-server.spec
+++ b/packaging/security-server.spec
@@ -92,7 +92,6 @@ ln -s ../security-server-privilege-by-pid.socket %{buildroot}/usr/lib/systemd/sy
 ln -s ../security-server-app-permissions.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-app-permissions.socket
 ln -s ../security-server-cookie-get.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-cookie-get.socket
 ln -s ../security-server-cookie-check.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-cookie-check.socket
-ln -s ../security-server-cookie-check-tmp.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-cookie-check-tmp.socket
 ln -s ../security-server-app-privilege-by-name.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-app-privilege-by-name.socket
 ln -s ../security-server-open-for.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-open-for.socket
 ln -s ../security-server-password-check.socket %{buildroot}/usr/lib/systemd/system/sockets.target.wants/security-server-password-check.socket
@@ -149,8 +148,6 @@ fi
 %attr(-,root,root) /usr/lib/systemd/system/security-server-cookie-get.socket
 %attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-cookie-check.socket
 %attr(-,root,root) /usr/lib/systemd/system/security-server-cookie-check.socket
-%attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-cookie-check-tmp.socket
-%attr(-,root,root) /usr/lib/systemd/system/security-server-cookie-check-tmp.socket
 %attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-app-privilege-by-name.socket
 %attr(-,root,root) /usr/lib/systemd/system/security-server-app-privilege-by-name.socket
 %attr(-,root,root) /usr/lib/systemd/system/sockets.target.wants/security-server-open-for.socket

diff --git a/src/server/client/client-cookie.cpp b/src/server/client/client-cookie.cpp
index 12fa21f..c1efaf3 100644 (file)
--- a/src/server/client/client-cookie.cpp
+++ b/src/server/client/client-cookie.cpp
@@ -265,7 +265,7 @@ int security_server_get_uid_by_cookie(const char *cookie, uid_t *uid)
         Serialization::Serialize(send, key);
 
         //send buffer to server
-        retval = sendToServer(SERVICE_SOCKET_COOKIE_CHECK_TMP, send.Pop(), recv);
+        retval = sendToServer(SERVICE_SOCKET_COOKIE_CHECK, send.Pop(), recv);
         if (retval != SECURITY_SERVER_API_SUCCESS) {
             LogDebug("Error in sendToServer. Error code: " << retval);
             return retval;
@@ -304,7 +304,7 @@ int security_server_get_gid_by_cookie(const char *cookie, gid_t *gid)
         Serialization::Serialize(send, key);
 
         //send buffer to server
-        retval = sendToServer(SERVICE_SOCKET_COOKIE_CHECK_TMP, send.Pop(), recv);
+        retval = sendToServer(SERVICE_SOCKET_COOKIE_CHECK, send.Pop(), recv);
         if (retval != SECURITY_SERVER_API_SUCCESS) {
             LogDebug("Error in sendToServer. Error code: " << retval);
             return retval;

diff --git a/src/server/common/protocols.cpp b/src/server/common/protocols.cpp
index 1d4a615..9da1aa5 100644 (file)
--- a/src/server/common/protocols.cpp
+++ b/src/server/common/protocols.cpp
@@ -41,10 +41,6 @@ char const * const SERVICE_SOCKET_COOKIE_GET =
     "/tmp/.security-server-api-cookie-get.sock";
 char const * const SERVICE_SOCKET_COOKIE_CHECK =
     "/tmp/.security-server-api-cookie-check.sock";
-//TODO: Merge bellow socket with the one above. This should be done
-//after security-server-api-cookie-check.sock will be protected by smack and has proper label
-char const * const SERVICE_SOCKET_COOKIE_CHECK_TMP =
-    "/tmp/.security-server-api-cookie-check-tmp.sock";
 char const * const SERVICE_SOCKET_OPEN_FOR =
     "/tmp/.security-server-api-open-for.sock";
 char const * const SERVICE_SOCKET_PASSWD_CHECK =

diff --git a/src/server/common/protocols.h b/src/server/common/protocols.h
index eeb8721..6e9c4eb 100644 (file)
--- a/src/server/common/protocols.h
+++ b/src/server/common/protocols.h
@@ -37,7 +37,6 @@ extern char const * const SERVICE_SOCKET_APP_PERMISSIONS;
 extern char const * const SERVICE_SOCKET_APP_PRIVILEGE_BY_NAME;
 extern char const * const SERVICE_SOCKET_COOKIE_GET;
 extern char const * const SERVICE_SOCKET_COOKIE_CHECK;
-extern char const * const SERVICE_SOCKET_COOKIE_CHECK_TMP;
 extern char const * const SERVICE_SOCKET_OPEN_FOR;
 extern char const * const SERVICE_SOCKET_PASSWD_CHECK;
 extern char const * const SERVICE_SOCKET_PASSWD_SET;

diff --git a/src/server/service/cookie.cpp b/src/server/service/cookie.cpp
index 74d714e..29d2652 100644 (file)
--- a/src/server/service/cookie.cpp
+++ b/src/server/service/cookie.cpp
@@ -36,15 +36,13 @@
 //interfaces ID
 const int INTERFACE_GET = 0;
 const int INTERFACE_CHECK = 1;
-const int INTERFACE_CHECK_TMP = 3;
 
 namespace SecurityServer {
 
 GenericSocketService::ServiceDescriptionVector CookieService::GetServiceDescription() {
     return ServiceDescriptionVector {
         {SERVICE_SOCKET_COOKIE_GET,       "*",   INTERFACE_GET },
-        {SERVICE_SOCKET_COOKIE_CHECK,     "security-server::api-cookie-check", INTERFACE_CHECK},
-        {SERVICE_SOCKET_COOKIE_CHECK_TMP, "security-server::api-cookie-check", INTERFACE_CHECK_TMP}
+        {SERVICE_SOCKET_COOKIE_CHECK,     "security-server::api-cookie-check", INTERFACE_CHECK}
     };
  }
 
@@ -139,14 +137,6 @@ bool CookieService::processOne(const ConnectionID &conn, MessageBuffer &buffer,
             retval = privilegeByCookieRequest(buffer, send);
             break;
 
-        default:
-            LogDebug("Error, unknown function called by client");
-            retval = false;
-            break;
-        };
-    } else if (interfaceID == INTERFACE_CHECK_TMP) {
-        //TODO: Merge this interface with INTERFACE_CHECK after INTERFACE_CHECK will be secured by smack 
-        switch(msgType) {
         case CookieCall::CHECK_UID:
             LogDebug("Entering get-uid-by-cookie side handler");
             retval = uidByCookieRequest(buffer, send);

diff --git a/systemd/CMakeLists.txt b/systemd/CMakeLists.txt
index 493ffe4..0b17809 100644 (file)
--- a/systemd/CMakeLists.txt
+++ b/systemd/CMakeLists.txt
@@ -8,7 +8,6 @@ INSTALL(FILES
     ${CMAKE_SOURCE_DIR}/systemd/security-server-cookie-get.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-cookie-check.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-app-privilege-by-name.socket
-    ${CMAKE_SOURCE_DIR}/systemd/security-server-cookie-check-tmp.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-open-for.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-password-reset.socket
     ${CMAKE_SOURCE_DIR}/systemd/security-server-password-check.socket

diff --git a/systemd/security-server-cookie-check-tmp.socket b/systemd/security-server-cookie-check-tmp.socket
deleted file mode 100644 (file)
index ddc7317..0000000
--- a/systemd/security-server-cookie-check-tmp.socket
+++ /dev/null
@@ -1,16 +0,0 @@
-#This socket should be removed when security-server-api-cookie-check.sock
-#will be protected by smack and has proper label (at the moment it is '*')
-[Socket]
-ListenStream=/tmp/.security-server-api-cookie-check-tmp.sock
-SocketMode=0777
-SmackLabelIPIn=security-server::api-cookie-check
-SmackLabelIPOut=@
-
-Service=security-server.service
-
-[Unit]
-Wants=security-server.target
-Before=security-server.target
-
-[Install]
-WantedBy=sockets.target

diff --git a/systemd/security-server.service b/systemd/security-server.service
index 1f02359..9fa6cb1 100644 (file)
--- a/systemd/security-server.service
+++ b/systemd/security-server.service
@@ -11,7 +11,6 @@ Sockets=security-server-app-permissions.socket
 Sockets=security-server-app-privilege-by-name.socket
 Sockets=security-server-cookie-get.socket
 Sockets=security-server-cookie-check.socket
-Sockets=security-server-cookie-check-tmp.socket
 Sockets=security-server-open-for.socket
 Sockets=security-server-password-check.socket
 Sockets=security-server-password-set.socket