From: Daniel Mack <daniel@zonque.org>
Date: Wed, 24 Sep 2014 15:24:20 +0000 (+0200)
Subject: bus-proxyd: enforce policy for name ownership
X-Git-Tag: v218~469
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f0a4c7391c7c682b658974b82390d332197740e2;p=platform%2Fupstream%2Fsystemd.git

bus-proxyd: enforce policy for name ownership
---

diff --git a/src/bus-proxyd/bus-proxyd.c b/src/bus-proxyd/bus-proxyd.c
index a6554ab..2f26f81 100644
--- a/src/bus-proxyd/bus-proxyd.c
+++ b/src/bus-proxyd/bus-proxyd.c
@@ -509,7 +509,7 @@ static int peer_is_privileged(sd_bus *bus, sd_bus_message *m) {
         return false;
 }
 
-static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
+static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m, Policy *policy, const struct ucred *ucred) {
         int r;
 
         assert(a);
@@ -859,6 +859,9 @@ static int process_driver(sd_bus *a, sd_bus *b, sd_bus_message *m) {
                 if (r < 0)
                         return synthetic_reply_method_errno(m, r, NULL);
 
+                if (!policy_check_own(policy, ucred, name))
+                        return synthetic_reply_method_errno(m, -EPERM, NULL);
+
                 if (!service_name_is_valid(name))
                         return synthetic_reply_method_errno(m, -EINVAL, NULL);
                 if ((flags & ~(BUS_NAME_ALLOW_REPLACEMENT|BUS_NAME_REPLACE_EXISTING|BUS_NAME_DO_NOT_QUEUE)) != 0)
@@ -1440,7 +1443,7 @@ int main(int argc, char *argv[]) {
                                         goto finish;
                                 }
 
-                                k = process_driver(a, b, m);
+                                k = process_driver(a, b, m, &policy, &ucred);
                                 if (k < 0) {
                                         r = k;
                                         log_error("Failed to process driver calls: %s", strerror(-r));