#include "af-list.h"
#include "alloc-util.h"
-#include "bus-util.h"
+#include "bus-get-properties.h"
#include "cap-list.h"
#include "capability-util.h"
#include "cpu-set-util.h"
if (r < 0)
return r;
- r = sd_bus_message_append(reply, "b", c->syscall_whitelist);
+ r = sd_bus_message_append(reply, "b", c->syscall_allow_list);
if (r < 0)
return r;
if (r < 0)
return r;
- r = sd_bus_message_append(reply, "b", c->address_families_whitelist);
+ r = sd_bus_message_append(reply, "b", c->address_families_allow_list);
if (r < 0)
return r;
return sd_bus_message_append_array(reply, 'y', c->root_hash, c->root_hash_size);
}
+static int property_get_root_hash_sig(
+ sd_bus *bus,
+ const char *path,
+ const char *interface,
+ const char *property,
+ sd_bus_message *reply,
+ void *userdata,
+ sd_bus_error *error) {
+
+ ExecContext *c = userdata;
+
+ assert(bus);
+ assert(c);
+ assert(property);
+ assert(reply);
+
+ return sd_bus_message_append_array(reply, 'y', c->root_hash_sig, c->root_hash_sig_size);
+}
+
const sd_bus_vtable bus_exec_vtable[] = {
SD_BUS_VTABLE_START(0),
SD_BUS_PROPERTY("Environment", "as", NULL, offsetof(ExecContext, environment), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("RootImage", "s", NULL, offsetof(ExecContext, root_image), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("RootHash", "ay", property_get_root_hash, 0, SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("RootHashPath", "s", NULL, offsetof(ExecContext, root_hash_path), SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_PROPERTY("RootHashSignature", "ay", property_get_root_hash_sig, 0, SD_BUS_VTABLE_PROPERTY_CONST),
+ SD_BUS_PROPERTY("RootHashSignaturePath", "s", NULL, offsetof(ExecContext, root_hash_sig_path), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("RootVerity", "s", NULL, offsetof(ExecContext, root_verity), SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("OOMScoreAdjust", "i", property_get_oom_score_adjust, 0, SD_BUS_VTABLE_PROPERTY_CONST),
SD_BUS_PROPERTY("CoredumpFilter", "t", property_get_coredump_filter, 0, SD_BUS_VTABLE_PROPERTY_CONST),
return bus_set_transient_path(u, "RootHash", &c->root_hash_path, message, flags, error);
}
+ if (streq(name, "RootHashSignature")) {
+ const void *roothash_sig_decoded;
+ size_t roothash_sig_decoded_size;
+
+ r = sd_bus_message_read_array(message, 'y', &roothash_sig_decoded, &roothash_sig_decoded_size);
+ if (r < 0)
+ return r;
+
+ if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
+ _cleanup_free_ char *encoded = NULL;
+
+ if (roothash_sig_decoded_size == 0) {
+ c->root_hash_sig_path = mfree(c->root_hash_sig_path);
+ c->root_hash_sig = mfree(c->root_hash_sig);
+ c->root_hash_sig_size = 0;
+
+ unit_write_settingf(u, flags, name, "RootHashSignature=");
+ } else {
+ _cleanup_free_ void *p;
+ ssize_t len;
+
+ len = base64mem(roothash_sig_decoded, roothash_sig_decoded_size, &encoded);
+ if (len < 0)
+ return -ENOMEM;
+
+ p = memdup(roothash_sig_decoded, roothash_sig_decoded_size);
+ if (!p)
+ return -ENOMEM;
+
+ free_and_replace(c->root_hash_sig, p);
+ c->root_hash_sig_size = roothash_sig_decoded_size;
+ c->root_hash_sig_path = mfree(c->root_hash_sig_path);
+
+ unit_write_settingf(u, flags, name, "RootHashSignature=base64:%s", encoded);
+ }
+ }
+
+ return 1;
+ }
+
+ if (streq(name, "RootHashSignaturePath")) {
+ c->root_hash_sig_size = 0;
+ c->root_hash_sig = mfree(c->root_hash_sig);
+
+ return bus_set_transient_path(u, "RootHashSignature", &c->root_hash_sig_path, message, flags, error);
+ }
+
if (streq(name, "RootVerity"))
return bus_set_transient_path(u, name, &c->root_verity, message, flags, error);
return bus_set_transient_errno(u, name, &c->syscall_errno, message, flags, error);
if (streq(name, "SystemCallFilter")) {
- int whitelist;
+ int allow_list;
_cleanup_strv_free_ char **l = NULL;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
return r;
- r = sd_bus_message_read(message, "b", &whitelist);
+ r = sd_bus_message_read(message, "b", &allow_list);
if (r < 0)
return r;
if (!UNIT_WRITE_FLAGS_NOOP(flags)) {
_cleanup_free_ char *joined = NULL;
- SeccompParseFlags invert_flag = whitelist ? 0 : SECCOMP_PARSE_INVERT;
+ SeccompParseFlags invert_flag = allow_list ? 0 : SECCOMP_PARSE_INVERT;
char **s;
if (strv_isempty(l)) {
- c->syscall_whitelist = false;
+ c->syscall_allow_list = false;
c->syscall_filter = hashmap_free(c->syscall_filter);
unit_write_settingf(u, flags, name, "SystemCallFilter=");
if (!c->syscall_filter)
return log_oom();
- c->syscall_whitelist = whitelist;
+ c->syscall_allow_list = allow_list;
- if (c->syscall_whitelist) {
+ if (c->syscall_allow_list) {
r = seccomp_parse_syscall_filter("@default",
-1,
c->syscall_filter,
SECCOMP_PARSE_PERMISSIVE |
- SECCOMP_PARSE_WHITELIST | invert_flag,
+ SECCOMP_PARSE_ALLOW_LIST | invert_flag,
u->id,
NULL, 0);
if (r < 0)
c->syscall_filter,
SECCOMP_PARSE_LOG | SECCOMP_PARSE_PERMISSIVE |
invert_flag |
- (c->syscall_whitelist ? SECCOMP_PARSE_WHITELIST : 0),
+ (c->syscall_allow_list ? SECCOMP_PARSE_ALLOW_LIST : 0),
u->id,
NULL, 0);
if (r < 0)
if (!joined)
return -ENOMEM;
- unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", whitelist ? "" : "~", joined);
+ unit_write_settingf(u, flags, name, "SystemCallFilter=%s%s", allow_list ? "" : "~", joined);
}
return 1;
return 1;
} else if (streq(name, "RestrictAddressFamilies")) {
- int whitelist;
+ int allow_list;
_cleanup_strv_free_ char **l = NULL;
r = sd_bus_message_enter_container(message, 'r', "bas");
if (r < 0)
return r;
- r = sd_bus_message_read(message, "b", &whitelist);
+ r = sd_bus_message_read(message, "b", &allow_list);
if (r < 0)
return r;
char **s;
if (strv_isempty(l)) {
- c->address_families_whitelist = false;
+ c->address_families_allow_list = false;
c->address_families = set_free(c->address_families);
unit_write_settingf(u, flags, name, "RestrictAddressFamilies=");
if (!c->address_families)
return log_oom();
- c->address_families_whitelist = whitelist;
+ c->address_families_allow_list = allow_list;
}
STRV_FOREACH(s, l) {
if (af < 0)
return af;
- if (whitelist == c->address_families_whitelist) {
+ if (allow_list == c->address_families_allow_list) {
r = set_put(c->address_families, INT_TO_PTR(af));
if (r < 0)
return r;
if (!joined)
return -ENOMEM;
- unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", whitelist ? "" : "~", joined);
+ unit_write_settingf(u, flags, name, "RestrictAddressFamilies=%s%s", allow_list ? "" : "~", joined);
}
return 1;
projects / thirdparty / systemd.git / blobdiff