connection: kdbus_ep_policy_check_src_names() -> kdbus_conn_policy_see()

Same as the previous policy helpers, move SRC-NAME verification to
connection.c. Furthermore, rename the function to a subject-based name:
  kdbus_conn_policy_see(conn, whom)
It now verifies whether @conn can see @whom, which is what we really want
to know. The fact that this relies on the destination names is irrelevant
for the call-side. Policy is based on SEE policies, so let it look like it
really is.

This again allows us to drop the 'ep' argument as it is implicitly given
by the subject 'conn'.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>

diff --git a/connection.c b/connection.c
index 1c4f8c0f2b37014b9085c6692152d4f0f6ec320e..8d680762a201df8f43e736fde21dc3fdcde9ca31 100644 (file)
--- a/connection.c
+++ b/connection.c
@@ -1331,9 +1331,7 @@ int kdbus_cmd_conn_info(struct kdbus_conn *conn,
                        goto exit;
                }
 
-               /* check if 'conn' is allowed to see any of owner_conn's names*/
-               ret = kdbus_ep_policy_check_src_names(conn->ep, owner_conn,
-                                                     conn);
+               ret = kdbus_conn_policy_see(conn, owner_conn);
                if (ret < 0)
                        goto exit;
        }
@@ -2005,3 +2003,48 @@ int kdbus_conn_policy_see_name(struct kdbus_conn *conn, const char *name)
 
        return ret;
 }
+
+/**
+ * kdbus_conn_policy_see() - verify a connection can see a given peer
+ * @conn:              Connection to verify whether it sees a peer
+ * @whom:              Peer destination that is to be 'seen'
+ *
+ * This checks whether @conn is able to see @whom.
+ *
+ * Return: 0 if allowed, negative error code if not.
+ */
+int kdbus_conn_policy_see(struct kdbus_conn *conn, struct kdbus_conn *whom)
+{
+       struct kdbus_name_entry *e;
+       int ret = -ENOENT;
+
+       /*
+        * By default, all names are visible on a bus, so a connection can
+        * always see other connections. SEE policies can only be installed on
+        * custom endpoints, where by default no name is visible and we hide
+        * peers from each other, unless you see at least _one_ name of the
+        * peer.
+        */
+       if (!conn->ep->has_policy)
+               return 0;
+
+       down_read(&conn->ep->policy_db.entries_rwlock);
+
+       /*
+        * If conn_dst is allowed to see one name of conn_src then
+        * return success, otherwise fail even if conn_src does not
+        * own any name, this will block any leak from conn_src to
+        * conn_dst
+        */
+       mutex_lock(&whom->lock);
+       list_for_each_entry(e, &whom->names_list, conn_entry) {
+               ret = kdbus_conn_policy_see_name_unlocked(conn, e->name);
+               if (ret == 0)
+                       break;
+       }
+       mutex_unlock(&whom->lock);
+
+       up_read(&conn->ep->policy_db.entries_rwlock);
+
+       return ret;
+}

diff --git a/connection.h b/connection.h
index ce2278437849daf6a50a32483f7de4afebcf6d90..454b20f44b1f0326158a2216ac142b2a3083a4bc 100644 (file)
--- a/connection.h
+++ b/connection.h
@@ -141,6 +141,7 @@ int kdbus_conn_policy_talk(struct kdbus_conn *conn, struct kdbus_conn *to);
 int kdbus_conn_policy_see_name_unlocked(struct kdbus_conn *conn,
                                        const char *name);
 int kdbus_conn_policy_see_name(struct kdbus_conn *conn, const char *name);
+int kdbus_conn_policy_see(struct kdbus_conn *conn, struct kdbus_conn *whom);
 
 /* command dispatcher */
 int kdbus_cmd_msg_send(struct kdbus_conn *conn_src,

diff --git a/endpoint.c b/endpoint.c
index dd215a0620172a710d1ac436109b4a1f7814b1cd..b881e87a6f9eb6f04947e6afaa69bc65587b06bc 100644 (file)
--- a/endpoint.c
+++ b/endpoint.c
@@ -282,52 +282,3 @@ int kdbus_ep_policy_check_notification(struct kdbus_ep *ep,
 
        return ret;
 }
-
-/**
- * kdbus_ep_policy_check_src_names() - check whether a connection's endpoint
- *                                    is allowed to see any of another
- *                                    connection's currently owned names
- * @ep:                        Endpoint to operate on
- * @conn_src:          Connection that owns the names
- * @conn_dst:          Destination connection to check credentials against
- *
- * This function checks whether @ep is allowed to see any of the names
- * currently owned by @conn_src. This is used for custom endpoints
- * which have a stricter policy. If the @ep is not a custom endpoint
- * then this function does nothing but return 0.
- *
- * Return: 0 if allowed, negative error code if not or if @conn_src
- * does not own any name. This is intended behaviour to prevent all
- * messages originated from @conn_src.
- */
-int kdbus_ep_policy_check_src_names(struct kdbus_ep *ep,
-                                   struct kdbus_conn *conn_src,
-                                   struct kdbus_conn *conn_dst)
-{
-       struct kdbus_name_entry *e;
-       int ret = -ENOENT;
-
-       /* This is not a custom endpoint, nothing to do */
-       if (!ep->has_policy)
-               return 0;
-
-       down_read(&ep->policy_db.entries_rwlock);
-       mutex_lock(&conn_src->lock);
-
-       /*
-        * If conn_dst is allowed to see one name of conn_src then
-        * return success, otherwise fail even if conn_src does not
-        * own any name, this will block any leak from conn_src to
-        * conn_dst
-        */
-       list_for_each_entry(e, &conn_src->names_list, conn_entry) {
-               ret = kdbus_conn_policy_see_name_unlocked(conn_dst, e->name);
-               if (ret == 0)
-                       break;
-       }
-
-       mutex_unlock(&conn_src->lock);
-       up_read(&ep->policy_db.entries_rwlock);
-
-       return ret;
-}

diff --git a/endpoint.h b/endpoint.h
index 3661ebb0db78e1954de8ef88ec3a18a467cdd0be..e915bfed9e9c05a44d652ec8cb1a97a219adfaec 100644 (file)
--- a/endpoint.h
+++ b/endpoint.h
@@ -67,8 +67,5 @@ int kdbus_ep_policy_set(struct kdbus_ep *ep,
 int kdbus_ep_policy_check_notification(struct kdbus_ep *ep,
                                       struct kdbus_conn *conn,
                                       const struct kdbus_kmsg *kmsg);
-int kdbus_ep_policy_check_src_names(struct kdbus_ep *ep,
-                                   struct kdbus_conn *conn_src,
-                                   struct kdbus_conn *conn_dst);
 
 #endif