internal bugfix: handle no-interface messages

No-interface messages should be handled in a special way.
Dbus says in bus/policy.c:

 The interface is optional in messages. For allow rules, if the message
 has no interface we want to skip the rule (and thus not allow);
 for deny rules, if the message has no interface we want to use the
 rule (and thus deny).

For example, a rule of type:
 <deny send_type="method_call" send_interface="foo.bar"/>
should:
- deny method_calls with foo.bar interface;
- deny method_calls with no interface.
A rule of type:
 <allow send_type="method_call" send_interface="foo.bar"/>
should:
- allow method_calls with foo.bar interface;
- not allow method_calls with not interface (the rule should be ignored).

The point is to make libdbuspolicy work as close as possible to how
dbus-daemon works with policies.

Change-Id: I99563d3728047a67fa4719948719a2df9c5d9f97

diff --git a/src/internal/policy.cpp b/src/internal/policy.cpp
index 56b0ddd..ef6f129 100644 (file)
--- a/src/internal/policy.cpp
+++ b/src/internal/policy.cpp
@@ -119,7 +119,8 @@ bool MatchItemSR::match(MessageType _type,
                                                const boost::string_ref &_path,
                                                const boost::string_ref &_member,
                                                const boost::string_ref &_name,
-                                               bool _is_name_prefix) const {
+                                               bool _is_name_prefix,
+                                               Decision decision) const {
        if (_type != MessageType::ANY && _type != type)
                return false;
 
@@ -127,6 +128,13 @@ bool MatchItemSR::match(MessageType _type,
                return lhs.empty() || rhs.empty() || lhs == rhs;
        };
 
+       /* A special clause for no-interface messages. If an allow rule is for some interface
+        * and message has no interface we have to ignore the rule.
+        * See dbus/bus/policy.c:bus_client_policy_check_can_send() for reference.
+        */
+       if (interface.empty() && !_interface.empty() && Decision::DENY != decision)
+               return false;
+
        if (!equal_or_empty(_interface, interface))
                return false;
 

diff --git a/src/internal/policy.hpp b/src/internal/policy.hpp
index 51a4322..9f1575e 100644 (file)
--- a/src/internal/policy.hpp
+++ b/src/internal/policy.hpp
@@ -165,7 +165,8 @@ namespace ldp_xml_parser
                                   const boost::string_ref &_path,
                                   const boost::string_ref &_member,
                                   const boost::string_ref &_name,
-                                  bool _is_name_prefix) const;
+                                  bool _is_name_prefix,
+                                  Decision decision) const;
        };
 
        class MatchItemSend : public MatchItemSR {

diff --git a/src/internal/storage_backend_serialized.cpp b/src/internal/storage_backend_serialized.cpp
index 7c880d9..d9439ce 100644 (file)
--- a/src/internal/storage_backend_serialized.cpp
+++ b/src/internal/storage_backend_serialized.cpp
@@ -217,7 +217,8 @@ bool match(const T &match, const I *i) {
                                           s(i->path()),
                                           s(i->member()),
                                           s(i->name()),
-                                          i->is_name_prefix());
+                                          i->is_name_prefix(),
+                                          makeDecision(i->decision()->decision()));
 }
 
 template <> bool match(const ldp_xml_parser::MatchItemAccess &match, const FB::ItemAccess *item) {