src/home/homed-manager-bus.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <linux/capability.h>
   4
   5 #include "alloc-util.h"
   6 #include "bus-common-errors.h"
   7 #include "bus-polkit.h"
   8 #include "format-util.h"
   9 #include "homed-bus.h"
  10 #include "homed-home-bus.h"
  11 #include "homed-manager-bus.h"
  12 #include "homed-manager.h"
  13 #include "strv.h"
  14 #include "user-record-sign.h"
  15 #include "user-record-util.h"
  16 #include "user-util.h"
  17
  18 static int property_get_auto_login(
  19                 sd_bus *bus,
  20                 const char *path,
  21                 const char *interface,
  22                 const char *property,
  23                 sd_bus_message *reply,
  24                 void *userdata,
  25                 sd_bus_error *error) {
  26
  27         Manager *m = ASSERT_PTR(userdata);
  28         Home *h;
  29         int r;
  30
  31         assert(bus);
  32         assert(reply);
  33
  34         r = sd_bus_message_open_container(reply, 'a', "(sso)");
  35         if (r < 0)
  36                 return r;
  37
  38         HASHMAP_FOREACH(h, m->homes_by_name) {
  39                 _cleanup_strv_free_ char **seats = NULL;
  40                 _cleanup_free_ char *home_path = NULL;
  41
  42                 r = home_auto_login(h, &seats);
  43                 if (r < 0) {
  44                         log_debug_errno(r, "Failed to determine whether home '%s' is candidate for auto-login, ignoring: %m", h->user_name);
  45                         continue;
  46                 }
  47                 if (!r)
  48                         continue;
  49
  50                 r = bus_home_path(h, &home_path);
  51                 if (r < 0)
  52                         return log_error_errno(r, "Failed to generate home bus path: %m");
  53
  54                 STRV_FOREACH(s, seats) {
  55                         r = sd_bus_message_append(reply, "(sso)", h->user_name, *s, home_path);
  56                         if (r < 0)
  57                                 return r;
  58                 }
  59         }
  60
  61         return sd_bus_message_close_container(reply);
  62 }
  63
  64 static int lookup_user_name(
  65                 Manager *m,
  66                 sd_bus_message *message,
  67                 const char *user_name,
  68                 sd_bus_error *error,
  69                 Home **ret) {
  70
  71         Home *h;
  72         int r;
  73
  74         assert(m);
  75         assert(message);
  76         assert(user_name);
  77         assert(ret);
  78
  79         if (isempty(user_name)) {
  80                 _cleanup_(sd_bus_creds_unrefp) sd_bus_creds *creds = NULL;
  81                 uid_t uid;
  82
  83                 /* If an empty user name is specified, then identify caller's EUID and find home by that. */
  84
  85                 r = sd_bus_query_sender_creds(message, SD_BUS_CREDS_EUID, &creds);
  86                 if (r < 0)
  87                         return r;
  88
  89                 r = sd_bus_creds_get_euid(creds, &uid);
  90                 if (r < 0)
  91                         return r;
  92
  93                 h = hashmap_get(m->homes_by_uid, UID_TO_PTR(uid));
  94                 if (!h)
  95                         return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_HOME, "Client's UID " UID_FMT " not managed.", uid);
  96
  97         } else {
  98
  99                 if (!valid_user_group_name(user_name, 0))
 100                         return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "User name %s is not valid", user_name);
 101
 102                 h = hashmap_get(m->homes_by_name, user_name);
 103                 if (!h)
 104                         return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_HOME, "No home for user %s known", user_name);
 105         }
 106
 107         *ret = h;
 108         return 0;
 109 }
 110
 111 static int method_get_home_by_name(
 112                 sd_bus_message *message,
 113                 void *userdata,
 114                 sd_bus_error *error) {
 115
 116         _cleanup_free_ char *path = NULL;
 117         const char *user_name;
 118         Manager *m = ASSERT_PTR(userdata);
 119         Home *h;
 120         int r;
 121
 122         assert(message);
 123
 124         r = sd_bus_message_read(message, "s", &user_name);
 125         if (r < 0)
 126                 return r;
 127
 128         r = lookup_user_name(m, message, user_name, error, &h);
 129         if (r < 0)
 130                 return r;
 131
 132         r = bus_home_path(h, &path);
 133         if (r < 0)
 134                 return r;
 135
 136         return sd_bus_reply_method_return(
 137                         message, "usussso",
 138                         (uint32_t) h->uid,
 139                         home_state_to_string(home_get_state(h)),
 140                         h->record ? (uint32_t) user_record_gid(h->record) : GID_INVALID,
 141                         h->record ? user_record_real_name(h->record) : NULL,
 142                         h->record ? user_record_home_directory(h->record) : NULL,
 143                         h->record ? user_record_shell(h->record) : NULL,
 144                         path);
 145 }
 146
 147 static int method_get_home_by_uid(
 148                 sd_bus_message *message,
 149                 void *userdata,
 150                 sd_bus_error *error) {
 151
 152         _cleanup_free_ char *path = NULL;
 153         Manager *m = ASSERT_PTR(userdata);
 154         uint32_t uid;
 155         int r;
 156         Home *h;
 157
 158         assert(message);
 159
 160         r = sd_bus_message_read(message, "u", &uid);
 161         if (r < 0)
 162                 return r;
 163         if (!uid_is_valid(uid))
 164                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "UID " UID_FMT " is not valid", uid);
 165
 166         h = hashmap_get(m->homes_by_uid, UID_TO_PTR(uid));
 167         if (!h)
 168                 return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_HOME, "No home for UID " UID_FMT " known", uid);
 169
 170         /* Note that we don't use bus_home_path() here, but build the path manually, since if we are queried
 171          * for a UID we should also generate the bus path with a UID, and bus_home_path() uses our more
 172          * typical bus path by name. */
 173         if (asprintf(&path, "/org/freedesktop/home1/home/" UID_FMT, h->uid) < 0)
 174                 return -ENOMEM;
 175
 176         return sd_bus_reply_method_return(
 177                         message, "ssussso",
 178                         h->user_name,
 179                         home_state_to_string(home_get_state(h)),
 180                         h->record ? (uint32_t) user_record_gid(h->record) : GID_INVALID,
 181                         h->record ? user_record_real_name(h->record) : NULL,
 182                         h->record ? user_record_home_directory(h->record) : NULL,
 183                         h->record ? user_record_shell(h->record) : NULL,
 184                         path);
 185 }
 186
 187 static int method_list_homes(
 188                 sd_bus_message *message,
 189                 void *userdata,
 190                 sd_bus_error *error) {
 191
 192         _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL;
 193         Manager *m = ASSERT_PTR(userdata);
 194         Home *h;
 195         int r;
 196
 197         assert(message);
 198
 199         r = sd_bus_message_new_method_return(message, &reply);
 200         if (r < 0)
 201                 return r;
 202
 203         r = sd_bus_message_open_container(reply, 'a', "(susussso)");
 204         if (r < 0)
 205                 return r;
 206
 207         HASHMAP_FOREACH(h, m->homes_by_uid) {
 208                 _cleanup_free_ char *path = NULL;
 209
 210                 r = bus_home_path(h, &path);
 211                 if (r < 0)
 212                         return r;
 213
 214                 r = sd_bus_message_append(
 215                                 reply, "(susussso)",
 216                                 h->user_name,
 217                                 (uint32_t) h->uid,
 218                                 home_state_to_string(home_get_state(h)),
 219                                 h->record ? (uint32_t) user_record_gid(h->record) : GID_INVALID,
 220                                 h->record ? user_record_real_name(h->record) : NULL,
 221                                 h->record ? user_record_home_directory(h->record) : NULL,
 222                                 h->record ? user_record_shell(h->record) : NULL,
 223                                 path);
 224                 if (r < 0)
 225                         return r;
 226         }
 227
 228         r = sd_bus_message_close_container(reply);
 229         if (r < 0)
 230                 return r;
 231
 232         return sd_bus_send(NULL, reply, NULL);
 233 }
 234
 235 static int method_get_user_record_by_name(
 236                 sd_bus_message *message,
 237                 void *userdata,
 238                 sd_bus_error *error) {
 239
 240         _cleanup_free_ char *json = NULL, *path = NULL;
 241         Manager *m = ASSERT_PTR(userdata);
 242         const char *user_name;
 243         bool incomplete;
 244         Home *h;
 245         int r;
 246
 247         assert(message);
 248
 249         r = sd_bus_message_read(message, "s", &user_name);
 250         if (r < 0)
 251                 return r;
 252
 253         r = lookup_user_name(m, message, user_name, error, &h);
 254         if (r < 0)
 255                 return r;
 256
 257         r = bus_home_get_record_json(h, message, &json, &incomplete);
 258         if (r < 0)
 259                 return r;
 260
 261         r = bus_home_path(h, &path);
 262         if (r < 0)
 263                 return r;
 264
 265         return sd_bus_reply_method_return(
 266                         message, "sbo",
 267                         json,
 268                         incomplete,
 269                         path);
 270 }
 271
 272 static int method_get_user_record_by_uid(
 273                 sd_bus_message *message,
 274                 void *userdata,
 275                 sd_bus_error *error) {
 276
 277         _cleanup_free_ char *json = NULL, *path = NULL;
 278         Manager *m = ASSERT_PTR(userdata);
 279         bool incomplete;
 280         uint32_t uid;
 281         Home *h;
 282         int r;
 283
 284         assert(message);
 285
 286         r = sd_bus_message_read(message, "u", &uid);
 287         if (r < 0)
 288                 return r;
 289         if (!uid_is_valid(uid))
 290                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "UID " UID_FMT " is not valid", uid);
 291
 292         h = hashmap_get(m->homes_by_uid, UID_TO_PTR(uid));
 293         if (!h)
 294                 return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_HOME, "No home for UID " UID_FMT " known", uid);
 295
 296         r = bus_home_get_record_json(h, message, &json, &incomplete);
 297         if (r < 0)
 298                 return r;
 299
 300         if (asprintf(&path, "/org/freedesktop/home1/home/" UID_FMT, h->uid) < 0)
 301                 return -ENOMEM;
 302
 303         return sd_bus_reply_method_return(
 304                         message, "sbo",
 305                         json,
 306                         incomplete,
 307                         path);
 308 }
 309
 310 static int generic_home_method(
 311                 Manager *m,
 312                 sd_bus_message *message,
 313                 sd_bus_message_handler_t handler,
 314                 sd_bus_error *error) {
 315
 316         const char *user_name;
 317         Home *h;
 318         int r;
 319
 320         assert(m);
 321         assert(message);
 322         assert(handler);
 323
 324         r = sd_bus_message_read(message, "s", &user_name);
 325         if (r < 0)
 326                 return r;
 327
 328         r = lookup_user_name(m, message, user_name, error, &h);
 329         if (r < 0)
 330                 return r;
 331
 332         return handler(message, h, error);
 333 }
 334
 335 static int method_activate_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 336         return generic_home_method(userdata, message, bus_home_method_activate, error);
 337 }
 338
 339 static int method_deactivate_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 340         return generic_home_method(userdata, message, bus_home_method_deactivate, error);
 341 }
 342
 343 static int validate_and_allocate_home(Manager *m, UserRecord *hr, Hashmap *blobs, Home **ret, sd_bus_error *error) {
 344         _cleanup_(user_record_unrefp) UserRecord *signed_hr = NULL;
 345         bool signed_locally;
 346         Home *other;
 347         int r;
 348
 349         assert(m);
 350         assert(hr);
 351         assert(ret);
 352
 353         r = user_record_is_supported(hr, error);
 354         if (r < 0)
 355                 return r;
 356
 357         other = hashmap_get(m->homes_by_name, hr->user_name);
 358         if (other)
 359                 return sd_bus_error_setf(error, BUS_ERROR_USER_NAME_EXISTS, "Specified user name %s exists already, refusing.", hr->user_name);
 360
 361         r = getpwnam_malloc(hr->user_name, /* ret= */ NULL);
 362         if (r >= 0)
 363                 return sd_bus_error_setf(error, BUS_ERROR_USER_NAME_EXISTS, "Specified user name %s exists in the NSS user database, refusing.", hr->user_name);
 364         if (r != -ESRCH)
 365                 return r;
 366
 367         r = getgrnam_malloc(hr->user_name, /* ret= */ NULL);
 368         if (r >= 0)
 369                 return sd_bus_error_setf(error, BUS_ERROR_USER_NAME_EXISTS, "Specified user name %s conflicts with an NSS group by the same name, refusing.", hr->user_name);
 370         if (r != -ESRCH)
 371                 return r;
 372
 373         if (blobs) {
 374                 const char *failed = NULL;
 375                 r = user_record_ensure_blob_manifest(hr, blobs, &failed);
 376                 if (r == -EINVAL)
 377                         return sd_bus_error_set(error, SD_BUS_ERROR_INVALID_ARGS, "Provided blob files do not correspond to blob manifest.");
 378                 if (r < 0)
 379                         return sd_bus_error_set_errnof(error, r, "Failed to generate hash for blob %s: %m", strnull(failed));
 380         }
 381
 382         r = manager_verify_user_record(m, hr);
 383         switch (r) {
 384
 385         case USER_RECORD_UNSIGNED:
 386                 /* If the record is unsigned, then let's sign it with our own key */
 387                 r = manager_sign_user_record(m, hr, &signed_hr, error);
 388                 if (r < 0)
 389                         return r;
 390
 391                 hr = signed_hr;
 392                 _fallthrough_;
 393
 394         case USER_RECORD_SIGNED_EXCLUSIVE:
 395                 signed_locally = true;
 396                 break;
 397
 398         case USER_RECORD_SIGNED:
 399         case USER_RECORD_FOREIGN:
 400                 signed_locally = false;
 401                 break;
 402
 403         case -ENOKEY:
 404                 return sd_bus_error_setf(error, BUS_ERROR_BAD_SIGNATURE, "Specified user record for %s is signed by a key we don't recognize, refusing.", hr->user_name);
 405
 406         default:
 407                 return sd_bus_error_set_errnof(error, r, "Failed to validate signature for '%s': %m", hr->user_name);
 408         }
 409
 410         if (uid_is_valid(hr->uid)) {
 411                 _cleanup_free_ struct passwd *pw = NULL;
 412                 _cleanup_free_ struct group *gr = NULL;
 413
 414                 other = hashmap_get(m->homes_by_uid, UID_TO_PTR(hr->uid));
 415                 if (other)
 416                         return sd_bus_error_setf(error, BUS_ERROR_UID_IN_USE, "Specified UID " UID_FMT " already in use by home %s, refusing.", hr->uid, other->user_name);
 417
 418                 r = getpwuid_malloc(hr->uid, &pw);
 419                 if (r >= 0)
 420                         return sd_bus_error_setf(error, BUS_ERROR_UID_IN_USE, "Specified UID " UID_FMT " already in use by NSS user %s, refusing.", hr->uid, pw->pw_name);
 421                 if (r != -ESRCH)
 422                         return r;
 423
 424                 r = getgrgid_malloc(hr->uid, &gr);
 425                 if (r >= 0)
 426                         return sd_bus_error_setf(error, BUS_ERROR_UID_IN_USE, "Specified UID " UID_FMT " already in use as GID by NSS group %s, refusing.", hr->uid, gr->gr_name);
 427                 if (r != -ESRCH)
 428                         return r;
 429         } else {
 430                 r = manager_augment_record_with_uid(m, hr);
 431                 if (r < 0)
 432                         return sd_bus_error_set_errnof(error, r, "Failed to acquire UID for '%s': %m", hr->user_name);
 433         }
 434
 435         r = home_new(m, hr, NULL, ret);
 436         if (r < 0)
 437                 return r;
 438
 439         (*ret)->signed_locally = signed_locally;
 440         return r;
 441 }
 442
 443 static int method_register_home(
 444                 sd_bus_message *message,
 445                 void *userdata,
 446                 sd_bus_error *error) {
 447
 448         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 449         Manager *m = ASSERT_PTR(userdata);
 450         _cleanup_(home_freep) Home *h = NULL;
 451         int r;
 452
 453         assert(message);
 454
 455         r = bus_message_read_home_record(message, USER_RECORD_LOAD_EMBEDDED|USER_RECORD_PERMISSIVE, &hr, error);
 456         if (r < 0)
 457                 return r;
 458
 459         r = bus_verify_polkit_async(
 460                         message,
 461                         "org.freedesktop.home1.create-home",
 462                         /* details= */ NULL,
 463                         &m->polkit_registry,
 464                         error);
 465         if (r < 0)
 466                 return r;
 467         if (r == 0)
 468                 return 1; /* Will call us back */
 469
 470         r = validate_and_allocate_home(m, hr, NULL, &h, error);
 471         if (r < 0)
 472                 return r;
 473
 474         r = home_save_record(h);
 475         if (r < 0)
 476                 return r;
 477
 478         TAKE_PTR(h);
 479
 480         return sd_bus_reply_method_return(message, NULL);
 481 }
 482
 483 static int method_unregister_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 484         return generic_home_method(userdata, message, bus_home_method_unregister, error);
 485 }
 486
 487
 488 static int method_create_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 489         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 490         _cleanup_hashmap_free_ Hashmap *blobs = NULL;
 491         uint64_t flags = 0;
 492         Manager *m = ASSERT_PTR(userdata);
 493         Home *h;
 494         int r;
 495
 496         assert(message);
 497
 498         r = bus_message_read_home_record(message, USER_RECORD_REQUIRE_REGULAR|USER_RECORD_ALLOW_SECRET|USER_RECORD_ALLOW_PRIVILEGED|USER_RECORD_ALLOW_PER_MACHINE|USER_RECORD_ALLOW_SIGNATURE, &hr, error);
 499         if (r < 0)
 500                 return r;
 501
 502         if (endswith(sd_bus_message_get_member(message), "Ex")) {
 503                 r = bus_message_read_blobs(message, &blobs, error);
 504                 if (r < 0)
 505                         return r;
 506
 507                 r = sd_bus_message_read(message, "t", &flags);
 508                 if (r < 0)
 509                         return r;
 510                 if (flags != 0)
 511                         return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED, "Provided flags are unsupported.");
 512         }
 513
 514         r = bus_verify_polkit_async(
 515                         message,
 516                         "org.freedesktop.home1.create-home",
 517                         /* details= */ NULL,
 518                         &m->polkit_registry,
 519                         error);
 520         if (r < 0)
 521                 return r;
 522         if (r == 0)
 523                 return 1; /* Will call us back */
 524
 525         r = validate_and_allocate_home(m, hr, blobs, &h, error);
 526         if (r < 0)
 527                 return r;
 528
 529         r = home_create(h, hr, blobs, flags, error);
 530         if (r < 0)
 531                 goto fail;
 532
 533         assert(r == 0);
 534         h->unregister_on_failure = true;
 535         assert(!h->current_operation);
 536
 537         r = home_set_current_message(h, message);
 538         if (r < 0)
 539                 return r;
 540
 541         return 1;
 542
 543 fail:
 544         (void) home_unlink_record(h);
 545         h = home_free(h);
 546         return r;
 547 }
 548
 549 static int method_realize_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 550         return generic_home_method(userdata, message, bus_home_method_realize, error);
 551 }
 552
 553 static int method_remove_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 554         return generic_home_method(userdata, message, bus_home_method_remove, error);
 555 }
 556
 557 static int method_fixate_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 558         return generic_home_method(userdata, message, bus_home_method_fixate, error);
 559 }
 560
 561 static int method_authenticate_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 562         return generic_home_method(userdata, message, bus_home_method_authenticate, error);
 563 }
 564
 565 static int method_update_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 566         _cleanup_(user_record_unrefp) UserRecord *hr = NULL;
 567         _cleanup_hashmap_free_ Hashmap *blobs = NULL;
 568         uint64_t flags = 0;
 569         Manager *m = ASSERT_PTR(userdata);
 570         Home *h;
 571         int r;
 572
 573         assert(message);
 574
 575         r = bus_message_read_home_record(message, USER_RECORD_REQUIRE_REGULAR|USER_RECORD_ALLOW_SECRET|USER_RECORD_ALLOW_PRIVILEGED|USER_RECORD_ALLOW_PER_MACHINE|USER_RECORD_ALLOW_SIGNATURE|USER_RECORD_PERMISSIVE, &hr, error);
 576         if (r < 0)
 577                 return r;
 578
 579         if (endswith(sd_bus_message_get_member(message), "Ex")) {
 580                 r = bus_message_read_blobs(message, &blobs, error);
 581                 if (r < 0)
 582                         return r;
 583
 584                 r = sd_bus_message_read(message, "t", &flags);
 585                 if (r < 0)
 586                         return r;
 587         }
 588
 589         assert(hr->user_name);
 590
 591         h = hashmap_get(m->homes_by_name, hr->user_name);
 592         if (!h)
 593                 return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_HOME, "No home for user %s known", hr->user_name);
 594
 595         return bus_home_update_record(h, message, hr, blobs, flags, error);
 596 }
 597
 598 static int method_resize_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 599         return generic_home_method(userdata, message, bus_home_method_resize, error);
 600 }
 601
 602 static int method_change_password_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 603         return generic_home_method(userdata, message, bus_home_method_change_password, error);
 604 }
 605
 606 static int method_lock_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 607         return generic_home_method(userdata, message, bus_home_method_lock, error);
 608 }
 609
 610 static int method_unlock_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 611         return generic_home_method(userdata, message, bus_home_method_unlock, error);
 612 }
 613
 614 static int method_acquire_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 615         return generic_home_method(userdata, message, bus_home_method_acquire, error);
 616 }
 617
 618 static int method_ref_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 619         return generic_home_method(userdata, message, bus_home_method_ref, error);
 620 }
 621
 622 static int method_release_home(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 623         return generic_home_method(userdata, message, bus_home_method_release, error);
 624 }
 625
 626 static int method_lock_all_homes(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 627         _cleanup_(operation_unrefp) Operation *o = NULL;
 628         bool waiting = false;
 629         Manager *m = ASSERT_PTR(userdata);
 630         Home *h;
 631         int r;
 632
 633         /* This is called from logind when we are preparing for system suspend. We enqueue a lock operation
 634          * for every suitable home we have and only when all of them completed we send a reply indicating
 635          * completion. */
 636
 637         HASHMAP_FOREACH(h, m->homes_by_name) {
 638
 639                 if (!home_shall_suspend(h))
 640                         continue;
 641
 642                 if (!o) {
 643                         o = operation_new(OPERATION_LOCK_ALL, message);
 644                         if (!o)
 645                                 return -ENOMEM;
 646                 }
 647
 648                 log_info("Automatically locking home of user %s.", h->user_name);
 649
 650                 r = home_schedule_operation(h, o, error);
 651                 if (r < 0)
 652                         return r;
 653
 654                 waiting = true;
 655         }
 656
 657         if (waiting) /* At least one lock operation was enqeued, let's leave here without a reply: it will
 658                       * be sent as soon as the last of the lock operations completed. */
 659                 return 1;
 660
 661         return sd_bus_reply_method_return(message, NULL);
 662 }
 663
 664 static int method_deactivate_all_homes(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 665         _cleanup_(operation_unrefp) Operation *o = NULL;
 666         bool waiting = false;
 667         Manager *m = ASSERT_PTR(userdata);
 668         Home *h;
 669         int r;
 670
 671         /* This is called from systemd-homed-activate.service's ExecStop= command to ensure that all home
 672          * directories are shutdown before the system goes down. Note that we don't do this from
 673          * systemd-homed.service itself since we want to allow restarting of it without tearing down all home
 674          * directories. */
 675
 676         HASHMAP_FOREACH(h, m->homes_by_name) {
 677
 678                 if (!o) {
 679                         o = operation_new(OPERATION_DEACTIVATE_ALL, message);
 680                         if (!o)
 681                                 return -ENOMEM;
 682                 }
 683
 684                 log_info("Automatically deactivating home of user %s.", h->user_name);
 685
 686                 r = home_schedule_operation(h, o, error);
 687                 if (r < 0)
 688                         return r;
 689
 690                 waiting = true;
 691         }
 692
 693         if (waiting) /* At least one lock operation was enqeued, let's leave here without a reply: it will be
 694                       * sent as soon as the last of the deactivation operations completed. */
 695                 return 1;
 696
 697         return sd_bus_reply_method_return(message, NULL);
 698 }
 699
 700 static int method_rebalance(sd_bus_message *message, void *userdata, sd_bus_error *error) {
 701         Manager *m = ASSERT_PTR(userdata);
 702         int r;
 703
 704         r = manager_schedule_rebalance(m, /* immediately= */ true);
 705         if (r == 0)
 706                 return sd_bus_reply_method_errorf(message, BUS_ERROR_REBALANCE_NOT_NEEDED, "No home directories need rebalancing.");
 707         if (r < 0)
 708                 return r;
 709
 710         /* Keep a reference to this message, so that we can reply to it once we are done */
 711         r = set_ensure_put(&m->rebalance_queued_method_calls, &bus_message_hash_ops, message);
 712         if (r < 0)
 713                 return log_error_errno(r, "Failed to track rebalance bus message: %m");
 714
 715         sd_bus_message_ref(message);
 716         return 1;
 717 }
 718
 719 static const sd_bus_vtable manager_vtable[] = {
 720         SD_BUS_VTABLE_START(0),
 721
 722         SD_BUS_PROPERTY("AutoLogin", "a(sso)", property_get_auto_login, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
 723
 724         SD_BUS_METHOD_WITH_ARGS("GetHomeByName",
 725                                 SD_BUS_ARGS("s", user_name),
 726                                 SD_BUS_RESULT("u", uid,
 727                                               "s", home_state,
 728                                               "u", gid,
 729                                               "s", real_name,
 730                                               "s", home_directory,
 731                                               "s", shell,
 732                                               "o", bus_path),
 733                                 method_get_home_by_name,
 734                                 SD_BUS_VTABLE_UNPRIVILEGED),
 735         SD_BUS_METHOD_WITH_ARGS("GetHomeByUID",
 736                                 SD_BUS_ARGS("u", uid),
 737                                 SD_BUS_RESULT("s", user_name,
 738                                               "s", home_state,
 739                                               "u", gid,
 740                                               "s", real_name,
 741                                               "s", home_directory,
 742                                               "s", shell,
 743                                               "o", bus_path),
 744                                 method_get_home_by_uid,
 745                                 SD_BUS_VTABLE_UNPRIVILEGED),
 746         SD_BUS_METHOD_WITH_ARGS("GetUserRecordByName",
 747                                 SD_BUS_ARGS("s", user_name),
 748                                 SD_BUS_RESULT("s", user_record, "b", incomplete, "o", bus_path),
 749                                 method_get_user_record_by_name,
 750                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 751         SD_BUS_METHOD_WITH_ARGS("GetUserRecordByUID",
 752                                 SD_BUS_ARGS("u", uid),
 753                                 SD_BUS_RESULT("s", user_record, "b", incomplete, "o", bus_path),
 754                                 method_get_user_record_by_uid,
 755                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 756         SD_BUS_METHOD_WITH_ARGS("ListHomes",
 757                                 SD_BUS_NO_ARGS,
 758                                 SD_BUS_RESULT("a(susussso)", home_areas),
 759                                 method_list_homes,
 760                                 SD_BUS_VTABLE_UNPRIVILEGED),
 761
 762         /* The following methods directly execute an operation on a home area, without ref-counting, queueing
 763          * or anything, and are accessible through homectl. */
 764         SD_BUS_METHOD_WITH_ARGS("ActivateHome",
 765                                 SD_BUS_ARGS("s", user_name, "s", secret),
 766                                 SD_BUS_NO_RESULT,
 767                                 method_activate_home,
 768                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 769         SD_BUS_METHOD_WITH_ARGS("ActivateHomeIfReferenced",
 770                                 SD_BUS_ARGS("s", user_name, "s", secret),
 771                                 SD_BUS_NO_RESULT,
 772                                 method_activate_home,
 773                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 774         SD_BUS_METHOD_WITH_ARGS("DeactivateHome",
 775                                 SD_BUS_ARGS("s", user_name),
 776                                 SD_BUS_NO_RESULT,
 777                                 method_deactivate_home,
 778                                 0),
 779
 780         /* Add the JSON record to homed, but don't create actual $HOME */
 781         SD_BUS_METHOD_WITH_ARGS("RegisterHome",
 782                                 SD_BUS_ARGS("s", user_record),
 783                                 SD_BUS_NO_RESULT,
 784                                 method_register_home,
 785                                 SD_BUS_VTABLE_UNPRIVILEGED),
 786
 787         /* Remove the JSON record from homed, but don't remove actual $HOME  */
 788         SD_BUS_METHOD_WITH_ARGS("UnregisterHome",
 789                                 SD_BUS_ARGS("s", user_name),
 790                                 SD_BUS_NO_RESULT,
 791                                 method_unregister_home,
 792                                 SD_BUS_VTABLE_UNPRIVILEGED),
 793
 794         /* Add JSON record, and create $HOME for it */
 795         SD_BUS_METHOD_WITH_ARGS("CreateHome",
 796                                 SD_BUS_ARGS("s", user_record),
 797                                 SD_BUS_NO_RESULT,
 798                                 method_create_home,
 799                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 800         SD_BUS_METHOD_WITH_ARGS("CreateHomeEx",
 801                                 SD_BUS_ARGS("s", user_record, "a{sh}", blobs, "t", flags),
 802                                 SD_BUS_NO_RESULT,
 803                                 method_create_home,
 804                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 805
 806         /* Create $HOME for already registered JSON entry */
 807         SD_BUS_METHOD_WITH_ARGS("RealizeHome",
 808                                 SD_BUS_ARGS("s", user_name, "s", secret),
 809                                 SD_BUS_NO_RESULT,
 810                                 method_realize_home,
 811                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 812
 813         /* Remove the JSON record and remove $HOME */
 814         SD_BUS_METHOD_WITH_ARGS("RemoveHome",
 815                                 SD_BUS_ARGS("s", user_name),
 816                                 SD_BUS_NO_RESULT,
 817                                 method_remove_home,
 818                                 SD_BUS_VTABLE_UNPRIVILEGED),
 819
 820         /* Investigate $HOME and propagate contained JSON record into our database */
 821         SD_BUS_METHOD_WITH_ARGS("FixateHome",
 822                                 SD_BUS_ARGS("s", user_name, "s", secret),
 823                                 SD_BUS_NO_RESULT,
 824                                 method_fixate_home,
 825                                 SD_BUS_VTABLE_SENSITIVE),
 826
 827         /* Just check credentials */
 828         SD_BUS_METHOD_WITH_ARGS("AuthenticateHome",
 829                                 SD_BUS_ARGS("s", user_name, "s", secret),
 830                                 SD_BUS_NO_RESULT,
 831                                 method_authenticate_home,
 832                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 833
 834         /* Update the JSON record of existing user */
 835         SD_BUS_METHOD_WITH_ARGS("UpdateHome",
 836                                 SD_BUS_ARGS("s", user_record),
 837                                 SD_BUS_NO_RESULT,
 838                                 method_update_home,
 839                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 840         SD_BUS_METHOD_WITH_ARGS("UpdateHomeEx",
 841                                 SD_BUS_ARGS("s", user_record, "a{sh}", blobs, "t", flags),
 842                                 SD_BUS_NO_RESULT,
 843                                 method_update_home,
 844                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 845
 846         SD_BUS_METHOD_WITH_ARGS("ResizeHome",
 847                                 SD_BUS_ARGS("s", user_name, "t", size, "s", secret),
 848                                 SD_BUS_NO_RESULT,
 849                                 method_resize_home,
 850                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 851
 852         SD_BUS_METHOD_WITH_ARGS("ChangePasswordHome",
 853                                 SD_BUS_ARGS("s", user_name, "s", new_secret, "s", old_secret),
 854                                 SD_BUS_NO_RESULT,
 855                                 method_change_password_home,
 856                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 857
 858         /* Prepare active home for system suspend: flush out passwords, suspend access */
 859         SD_BUS_METHOD_WITH_ARGS("LockHome",
 860                                 SD_BUS_ARGS("s", user_name),
 861                                 SD_BUS_NO_RESULT,
 862                                 method_lock_home,
 863                                 0),
 864
 865         /* Make $HOME usable after system resume again */
 866         SD_BUS_METHOD_WITH_ARGS("UnlockHome",
 867                                 SD_BUS_ARGS("s", user_name, "s", secret),
 868                                 SD_BUS_NO_RESULT,
 869                                 method_unlock_home,
 870                                 SD_BUS_VTABLE_SENSITIVE),
 871
 872         /* The following methods implement ref-counted activation, and are what the PAM module and "homectl
 873          * with" use. In contrast to the methods above which fail if an operation is already being executed
 874          * on a home directory, these ones will queue the request, and are thus more reliable. Moreover,
 875          * they are a bit smarter: AcquireHome() will fixate, activate, unlock, or authenticate depending on
 876          * the state of the home area, so that the end result is always the same (i.e. the home directory is
 877          * accessible), and we always validate the specified passwords. RefHome() will not authenticate, and
 878          * thus only works if the home area is already active. */
 879         SD_BUS_METHOD_WITH_ARGS("AcquireHome",
 880                                 SD_BUS_ARGS("s", user_name, "s", secret, "b", please_suspend),
 881                                 SD_BUS_RESULT("h", send_fd),
 882                                 method_acquire_home,
 883                                 SD_BUS_VTABLE_UNPRIVILEGED|SD_BUS_VTABLE_SENSITIVE),
 884         SD_BUS_METHOD_WITH_ARGS("RefHome",
 885                                 SD_BUS_ARGS("s", user_name, "b", please_suspend),
 886                                 SD_BUS_RESULT("h", send_fd),
 887                                 method_ref_home,
 888                                 0),
 889         SD_BUS_METHOD_WITH_ARGS("RefHomeUnrestricted",
 890                                 SD_BUS_ARGS("s", user_name, "b", please_suspend),
 891                                 SD_BUS_RESULT("h", send_fd),
 892                                 method_ref_home,
 893                                 0),
 894         SD_BUS_METHOD_WITH_ARGS("ReleaseHome",
 895                                 SD_BUS_ARGS("s", user_name),
 896                                 SD_BUS_NO_RESULT,
 897                                 method_release_home,
 898                                 0),
 899
 900         /* An operation that acts on all homes that allow it */
 901         SD_BUS_METHOD("LockAllHomes", NULL, NULL, method_lock_all_homes, 0),
 902         SD_BUS_METHOD("DeactivateAllHomes", NULL, NULL, method_deactivate_all_homes, 0),
 903         SD_BUS_METHOD("Rebalance", NULL, NULL, method_rebalance, 0),
 904
 905         SD_BUS_VTABLE_END
 906 };
 907
 908 const BusObjectImplementation manager_object = {
 909         "/org/freedesktop/home1",
 910         "org.freedesktop.home1.Manager",
 911         .vtables = BUS_VTABLES(manager_vtable),
 912         .children = BUS_IMPLEMENTATIONS(&home_object),
 913 };
 914
 915 static int on_deferred_auto_login(sd_event_source *s, void *userdata) {
 916         Manager *m = ASSERT_PTR(userdata);
 917         int r;
 918
 919         m->deferred_auto_login_event_source = sd_event_source_disable_unref(m->deferred_auto_login_event_source);
 920
 921         r = sd_bus_emit_properties_changed(
 922                         m->bus,
 923                         "/org/freedesktop/home1",
 924                         "org.freedesktop.home1.Manager",
 925                         "AutoLogin", NULL);
 926         if (r < 0)
 927                 log_warning_errno(r, "Failed to send AutoLogin property change event, ignoring: %m");
 928
 929         return 0;
 930 }
 931
 932 int bus_manager_emit_auto_login_changed(Manager *m) {
 933         int r;
 934         assert(m);
 935
 936         if (m->deferred_auto_login_event_source)
 937                 return 0;
 938
 939         if (!m->event)
 940                 return 0;
 941
 942         if (IN_SET(sd_event_get_state(m->event), SD_EVENT_FINISHED, SD_EVENT_EXITING))
 943                 return 0;
 944
 945         r = sd_event_add_defer(m->event, &m->deferred_auto_login_event_source, on_deferred_auto_login, m);
 946         if (r < 0)
 947                 return log_error_errno(r, "Failed to allocate auto login event source: %m");
 948
 949         r = sd_event_source_set_priority(m->deferred_auto_login_event_source, SD_EVENT_PRIORITY_IDLE+10);
 950         if (r < 0)
 951                 log_warning_errno(r, "Failed to tweak priority of event source, ignoring: %m");
 952
 953         (void) sd_event_source_set_description(m->deferred_auto_login_event_source, "deferred-auto-login");
 954         return 1;
 955 }