From: Laurent Bigonville <bigon@bigon.be>
Date: Tue, 6 Jun 2017 14:06:11 +0000 (+0200)
Subject: Return the dbus-daemon SELinux context when asking about org.freedesktop.DBus
X-Git-Tag: dbus-1.12.0~128
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=dcf02f80656da21db501b8c9605ad9c67d7c4dc9;p=platform%2Fupstream%2Fdbus.git

Return the dbus-daemon SELinux context when asking about org.freedesktop.DBus

Currently when asked the SELinux context of the owner of
org.freedesktop.DBus, the dbus-daemon is returning an error.

In the same situation when asked about the Unix user or the PID, the
daemon would return its own user or pid. Do the same for the SELinux
context by returning the daemon one.

In particular this avoids an issue seen with systemd --user, where
dbus-daemon responds to UpdateActivationEnvironment() by passing on the
new environment to systemd with o.fd.systemd1.Manager.SetEnvironment(),
but systemd cannot get the caller's SELinux context and so rejects the
SetEnvironment() call.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101315
[smcv: Extend commit message to describe the symptom this fixes]
Reviewed-by: Simon McVittie <smcv@collabora.com>
---

diff --git a/bus/driver.c b/bus/driver.c
index 5ecfc77..d3ad878 100644
--- a/bus/driver.c
+++ b/bus/driver.c
@@ -1854,8 +1854,9 @@ bus_driver_handle_get_connection_selinux_security_context (DBusConnection *conne
   if (reply == NULL)
     goto oom;
 
-  /* FIXME: Obtain the SELinux security context for the bus daemon itself */
-  if (found == BUS_DRIVER_FOUND_PEER)
+  if (found == BUS_DRIVER_FOUND_SELF)
+    context = bus_selinux_get_self ();
+  else if (found == BUS_DRIVER_FOUND_PEER)
     context = bus_connection_get_selinux_id (conn);
   else
     context = NULL;
diff --git a/bus/selinux.c b/bus/selinux.c
index cc11146..d09afb4 100644
--- a/bus/selinux.c
+++ b/bus/selinux.c
@@ -272,6 +272,19 @@ bus_selinux_enabled (void)
 #endif /* HAVE_SELINUX */
 }
 
+BusSELinuxID*
+bus_selinux_get_self (void)
+{
+#ifdef HAVE_SELINUX
+  if(bus_selinux_enabled ())
+    return BUS_SID_FROM_SELINUX (bus_sid);
+  else
+    return NULL;
+#else
+  return NULL;
+#endif /* HAVE_SELINUX */
+}
+
 /**
  * Do early initialization; determine whether SELinux is enabled.
  */
diff --git a/bus/selinux.h b/bus/selinux.h
index 8c7cb0a..a0383cd 100644
--- a/bus/selinux.h
+++ b/bus/selinux.h
@@ -33,6 +33,8 @@ void        bus_selinux_shutdown (void);
 
 dbus_bool_t bus_selinux_enabled  (void);
 
+BusSELinuxID *bus_selinux_get_self (void);
+
 DBusHashTable* bus_selinux_id_table_new    (void);
 BusSELinuxID*  bus_selinux_id_table_lookup (DBusHashTable    *service_table,
                                             const DBusString *service_name);