[thirdparty/systemd.git] / src / login / logind-acl.c

/* SPDX-License-Identifier: LGPL-2.1+ */
/***
  This file is part of systemd.

  Copyright 2011 Lennart Poettering
***/

#include <errno.h>
#include <string.h>

#include "acl-util.h"
#include "alloc-util.h"
#include "dirent-util.h"
#include "escape.h"
#include "fd-util.h"
#include "format-util.h"
#include "logind-acl.h"
#include "set.h"
#include "string-util.h"
#include "udev-util.h"
#include "util.h"

static int flush_acl(acl_t acl) {
        acl_entry_t i;
        int found;
        bool changed = false;

        assert(acl);

        for (found = acl_get_entry(acl, ACL_FIRST_ENTRY, &i);
             found > 0;
             found = acl_get_entry(acl, ACL_NEXT_ENTRY, &i)) {

                acl_tag_t tag;

                if (acl_get_tag_type(i, &tag) < 0)
                        return -errno;

                if (tag != ACL_USER)
                        continue;

                if (acl_delete_entry(acl, i) < 0)
                        return -errno;

                changed = true;
        }

        if (found < 0)
                return -errno;

        return changed;
}

int devnode_acl(const char *path,
                bool flush,
                bool del, uid_t old_uid,
                bool add, uid_t new_uid) {

        acl_t acl;
        int r = 0;
        bool changed = false;

        assert(path);

        acl = acl_get_file(path, ACL_TYPE_ACCESS);
        if (!acl)
                return -errno;

        if (flush) {

                r = flush_acl(acl);
                if (r < 0)
                        goto finish;
                if (r > 0)
                        changed = true;

        } else if (del && old_uid > 0) {
                acl_entry_t entry;

                r = acl_find_uid(acl, old_uid, &entry);
                if (r < 0)
                        goto finish;

                if (r > 0) {
                        if (acl_delete_entry(acl, entry) < 0) {
                                r = -errno;
                                goto finish;
                        }

                        changed = true;
                }
        }

        if (add && new_uid > 0) {
                acl_entry_t entry;
                acl_permset_t permset;
                int rd, wt;

                r = acl_find_uid(acl, new_uid, &entry);
                if (r < 0)
                        goto finish;

                if (r == 0) {
                        if (acl_create_entry(&acl, &entry) < 0) {
                                r = -errno;
                                goto finish;
                        }

                        if (acl_set_tag_type(entry, ACL_USER) < 0 ||
                            acl_set_qualifier(entry, &new_uid) < 0) {
                                r = -errno;
                                goto finish;
                        }
                }

                if (acl_get_permset(entry, &permset) < 0) {
                        r = -errno;
                        goto finish;
                }

                rd = acl_get_perm(permset, ACL_READ);
                if (rd < 0) {
                        r = -errno;
                        goto finish;
                }

                wt = acl_get_perm(permset, ACL_WRITE);
                if (wt < 0) {
                        r = -errno;
                        goto finish;
                }

                if (!rd || !wt) {

                        if (acl_add_perm(permset, ACL_READ|ACL_WRITE) < 0) {
                                r = -errno;
                                goto finish;
                        }

                        changed = true;
                }
        }

        if (!changed)
                goto finish;

        if (acl_calc_mask(&acl) < 0) {
                r = -errno;
                goto finish;
        }

        if (acl_set_file(path, ACL_TYPE_ACCESS, acl) < 0) {
                r = -errno;
                goto finish;
        }

        r = 0;

finish:
        acl_free(acl);

        return r;
}

int devnode_acl_all(struct udev *udev,
                    const char *seat,
                    bool flush,
                    bool del, uid_t old_uid,
                    bool add, uid_t new_uid) {

        _cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
        struct udev_list_entry *item = NULL, *first = NULL;
        _cleanup_set_free_free_ Set *nodes = NULL;
        _cleanup_closedir_ DIR *dir = NULL;
        struct dirent *dent;
        Iterator i;
        char *n;
        int r;

        assert(udev);

        nodes = set_new(&path_hash_ops);
        if (!nodes)
                return -ENOMEM;

        e = udev_enumerate_new(udev);
        if (!e)
                return -ENOMEM;

        if (isempty(seat))
                seat = "seat0";

        /* We can only match by one tag in libudev. We choose
         * "uaccess" for that. If we could match for two tags here we
         * could add the seat name as second match tag, but this would
         * be hardly optimizable in libudev, and hence checking the
         * second tag manually in our loop is a good solution. */
        r = udev_enumerate_add_match_tag(e, "uaccess");
        if (r < 0)
                return r;

        r = udev_enumerate_add_match_is_initialized(e);
        if (r < 0)
                return r;

        r = udev_enumerate_scan_devices(e);
        if (r < 0)
                return r;

        first = udev_enumerate_get_list_entry(e);
        udev_list_entry_foreach(item, first) {
                _cleanup_udev_device_unref_ struct udev_device *d = NULL;
                const char *node, *sn;

                d = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
                if (!d)
                        return -ENOMEM;

                sn = udev_device_get_property_value(d, "ID_SEAT");
                if (isempty(sn))
                        sn = "seat0";

                if (!streq(seat, sn))
                        continue;

                node = udev_device_get_devnode(d);
                /* In case people mistag devices with nodes, we need to ignore this */
                if (!node)
                        continue;

                n = strdup(node);
                if (!n)
                        return -ENOMEM;

                log_debug("Found udev node %s for seat %s", n, seat);
                r = set_consume(nodes, n);
                if (r < 0)
                        return r;
        }

        /* udev exports "dead" device nodes to allow module on-demand loading,
         * these devices are not known to the kernel at this moment */
        dir = opendir("/run/udev/static_node-tags/uaccess");
        if (dir) {
                FOREACH_DIRENT(dent, dir, return -errno) {
                        _cleanup_free_ char *unescaped_devname = NULL;

                        if (cunescape(dent->d_name, UNESCAPE_RELAX, &unescaped_devname) < 0)
                                return -ENOMEM;

                        n = strappend("/dev/", unescaped_devname);
                        if (!n)
                                return -ENOMEM;

                        log_debug("Found static node %s for seat %s", n, seat);
                        r = set_consume(nodes, n);
                        if (r == -EEXIST)
                                continue;
                        if (r < 0)
                                return r;
                }
        }

        r = 0;
        SET_FOREACH(n, nodes, i) {
                int k;

                log_debug("Changing ACLs at %s for seat %s (uid "UID_FMT"→"UID_FMT"%s%s)",
                          n, seat, old_uid, new_uid,
                          del ? " del" : "", add ? " add" : "");

                k = devnode_acl(n, flush, del, old_uid, add, new_uid);
                if (k == -ENOENT)
                        log_debug("Device %s disappeared while setting ACLs", n);
                else if (k < 0 && r == 0)
                        r = k;
        }

        return r;
}
Commit	Line	Data
53e1b683	1	/* SPDX-License-Identifier: LGPL-2.1+ */
5eda94dd LP	2	/***
	3	This file is part of systemd.
	4
	5	Copyright 2011 Lennart Poettering
5eda94dd LP	6	***/
5eda94dd LP	7
5eda94dd LP	8	#include <errno.h>
	9	#include <string.h>
	10
79c07722	11	#include "acl-util.h"
b5efdb8a	12	#include "alloc-util.h"
a0956174	13	#include "dirent-util.h"
4f5dd394	14	#include "escape.h"
3ffd4af2	15	#include "fd-util.h"
f97b34a6	16	#include "format-util.h"
3ffd4af2	17	#include "logind-acl.h"
6b78df0a	18	#include "set.h"
07630cea	19	#include "string-util.h"
bf5332d2	20	#include "udev-util.h"
4f5dd394	21	#include "util.h"
5eda94dd LP	22
	23	static int flush_acl(acl_t acl) {
	24	acl_entry_t i;
	25	int found;
	26	bool changed = false;
	27
	28	assert(acl);
	29
	30	for (found = acl_get_entry(acl, ACL_FIRST_ENTRY, &i);
	31	found > 0;
	32	found = acl_get_entry(acl, ACL_NEXT_ENTRY, &i)) {
	33
	34	acl_tag_t tag;
	35
	36	if (acl_get_tag_type(i, &tag) < 0)
	37	return -errno;
	38
	39	if (tag != ACL_USER)
	40	continue;
	41
	42	if (acl_delete_entry(acl, i) < 0)
	43	return -errno;
	44
	45	changed = true;
	46	}
	47
	48	if (found < 0)
	49	return -errno;
	50
	51	return changed;
	52	}
	53
	54	int devnode_acl(const char *path,
	55	bool flush,
	56	bool del, uid_t old_uid,
	57	bool add, uid_t new_uid) {
	58
	59	acl_t acl;
501c92c4	60	int r = 0;
5eda94dd LP	61	bool changed = false;
	62
	63	assert(path);
	64
	65	acl = acl_get_file(path, ACL_TYPE_ACCESS);
	66	if (!acl)
	67	return -errno;
	68
	69	if (flush) {
	70
	71	r = flush_acl(acl);
	72	if (r < 0)
	73	goto finish;
	74	if (r > 0)
	75	changed = true;
	76
	77	} else if (del && old_uid > 0) {
	78	acl_entry_t entry;
	79
f4b47811	80	r = acl_find_uid(acl, old_uid, &entry);
5eda94dd LP	81	if (r < 0)
	82	goto finish;
	83
	84	if (r > 0) {
	85	if (acl_delete_entry(acl, entry) < 0) {
	86	r = -errno;
	87	goto finish;
	88	}
	89
	90	changed = true;
	91	}
	92	}
	93
	94	if (add && new_uid > 0) {
	95	acl_entry_t entry;
	96	acl_permset_t permset;
	97	int rd, wt;
	98
f4b47811	99	r = acl_find_uid(acl, new_uid, &entry);
5eda94dd LP	100	if (r < 0)
	101	goto finish;
	102
	103	if (r == 0) {
	104	if (acl_create_entry(&acl, &entry) < 0) {
	105	r = -errno;
	106	goto finish;
	107	}
	108
	109	if (acl_set_tag_type(entry, ACL_USER) < 0 \|\|
	110	acl_set_qualifier(entry, &new_uid) < 0) {
	111	r = -errno;
	112	goto finish;
	113	}
	114	}
	115
	116	if (acl_get_permset(entry, &permset) < 0) {
	117	r = -errno;
	118	goto finish;
	119	}
	120
	121	rd = acl_get_perm(permset, ACL_READ);
	122	if (rd < 0) {
	123	r = -errno;
	124	goto finish;
	125	}
	126
	127	wt = acl_get_perm(permset, ACL_WRITE);
	128	if (wt < 0) {
	129	r = -errno;
	130	goto finish;
	131	}
	132
	133	if (!rd \|\| !wt) {
	134
	135	if (acl_add_perm(permset, ACL_READ\|ACL_WRITE) < 0) {
	136	r = -errno;
	137	goto finish;
	138	}
	139
	140	changed = true;
	141	}
	142	}
	143
	144	if (!changed)
	145	goto finish;
	146
	147	if (acl_calc_mask(&acl) < 0) {
	148	r = -errno;
	149	goto finish;
	150	}
	151
	152	if (acl_set_file(path, ACL_TYPE_ACCESS, acl) < 0) {
	153	r = -errno;
	154	goto finish;
	155	}
	156
	157	r = 0;
	158
	159	finish:
	160	acl_free(acl);
	161
	162	return r;
	163	}
164
165	int devnode_acl_all(struct udev *udev,
166	const char *seat,
167	bool flush,
168	bool del, uid_t old_uid,
169	bool add, uid_t new_uid) {
170
bf5332d2	171	_cleanup_udev_enumerate_unref_ struct udev_enumerate *e = NULL;
5eda94dd	172	struct udev_list_entry item = NULL, first = NULL;
bf5332d2	173	_cleanup_set_free_free_ Set *nodes = NULL;
db0c1e3b	174	_cleanup_closedir_ DIR *dir = NULL;
6b78df0a	175	struct dirent *dent;
bf5332d2 LP	176	Iterator i;
bf5332d2 LP	177	char *n;
5eda94dd LP	178	int r;
	179
	180	assert(udev);
	181
548f6937	182	nodes = set_new(&path_hash_ops);
cc377381	183	if (!nodes)
6b78df0a	184	return -ENOMEM;
5eda94dd LP	185
5eda94dd LP	186	e = udev_enumerate_new(udev);
bf5332d2 LP	187	if (!e)
bf5332d2 LP	188	return -ENOMEM;
6b78df0a TG	189
	190	if (isempty(seat))
	191	seat = "seat0";
5eda94dd	192
7b3afbac LP	193	/* We can only match by one tag in libudev. We choose
	194	* "uaccess" for that. If we could match for two tags here we
	195	* could add the seat name as second match tag, but this would
	196	* be hardly optimizable in libudev, and hence checking the
	197	* second tag manually in our loop is a good solution. */
5eda94dd LP	198	r = udev_enumerate_add_match_tag(e, "uaccess");
5eda94dd LP	199	if (r < 0)
bf5332d2	200	return r;
5eda94dd	201
e1202047 LP	202	r = udev_enumerate_add_match_is_initialized(e);
	203	if (r < 0)
	204	return r;
	205
5eda94dd LP	206	r = udev_enumerate_scan_devices(e);
5eda94dd LP	207	if (r < 0)
bf5332d2	208	return r;
5eda94dd LP	209
	210	first = udev_enumerate_get_list_entry(e);
	211	udev_list_entry_foreach(item, first) {
bf5332d2	212	_cleanup_udev_device_unref_ struct udev_device *d = NULL;
5eda94dd LP	213	const char node, sn;
	214
	215	d = udev_device_new_from_syspath(udev, udev_list_entry_get_name(item));
bf5332d2 LP	216	if (!d)
	217	return -ENOMEM;
	218
53907215 LP	219	sn = udev_device_get_property_value(d, "ID_SEAT");
53907215 LP	220	if (isempty(sn))
5eda94dd LP	221	sn = "seat0";
5eda94dd LP	222
bf5332d2	223	if (!streq(seat, sn))
5eda94dd	224	continue;
5eda94dd LP	225
5eda94dd LP	226	node = udev_device_get_devnode(d);
bf5332d2 LP	227	/* In case people mistag devices with nodes, we need to ignore this */
bf5332d2 LP	228	if (!node)
d2d4b038	229	continue;
5eda94dd	230
6b78df0a	231	n = strdup(node);
6b78df0a	232	if (!n)
bf5332d2	233	return -ENOMEM;
ce0f7c97	234
6b78df0a	235	log_debug("Found udev node %s for seat %s", n, seat);
bf5332d2	236	r = set_consume(nodes, n);
5eda94dd	237	if (r < 0)
bf5332d2	238	return r;
5eda94dd LP	239	}
5eda94dd LP	240
6b78df0a TG	241	/* udev exports "dead" device nodes to allow module on-demand loading,
	242	* these devices are not known to the kernel at this moment */
	243	dir = opendir("/run/udev/static_node-tags/uaccess");
	244	if (dir) {
bf5332d2	245	FOREACH_DIRENT(dent, dir, return -errno) {
6b78df0a	246	_cleanup_free_ char *unescaped_devname = NULL;
5eda94dd	247
527b7a42	248	if (cunescape(dent->d_name, UNESCAPE_RELAX, &unescaped_devname) < 0)
bf5332d2	249	return -ENOMEM;
6b78df0a TG	250
6b78df0a TG	251	n = strappend("/dev/", unescaped_devname);
bf5332d2 LP	252	if (!n)
bf5332d2 LP	253	return -ENOMEM;
6b78df0a TG	254
6b78df0a TG	255	log_debug("Found static node %s for seat %s", n, seat);
bf5332d2 LP	256	r = set_consume(nodes, n);
	257	if (r == -EEXIST)
	258	continue;
	259	if (r < 0)
	260	return r;
6b78df0a	261	}
6b78df0a TG	262	}
6b78df0a TG	263
bf5332d2	264	r = 0;
6b78df0a	265	SET_FOREACH(n, nodes, i) {
bf5332d2 LP	266	int k;
bf5332d2 LP	267
6b9732b2 ZJS	268	log_debug("Changing ACLs at %s for seat %s (uid "UID_FMT"→"UID_FMT"%s%s)",
	269	n, seat, old_uid, new_uid,
	270	del ? " del" : "", add ? " add" : "");
	271
bf5332d2	272	k = devnode_acl(n, flush, del, old_uid, add, new_uid);
8016b904 DH	273	if (k == -ENOENT)
8016b904 DH	274	log_debug("Device %s disappeared while setting ACLs", n);
f7a5bb28	275	else if (k < 0 && r == 0)
bf5332d2	276	r = k;
6b78df0a TG	277	}
6b78df0a TG	278
5eda94dd LP	279	return r;
5eda94dd LP	280	}