]>
Commit | Line | Data |
---|---|---|
70a5db58 LP |
1 | /* SPDX-License-Identifier: LGPL-2.1+ */ |
2 | ||
3 | #include "errno-util.h" | |
4 | #include "home-util.h" | |
5 | #include "id128-util.h" | |
6 | #include "libcrypt-util.h" | |
7 | #include "mountpoint-util.h" | |
8 | #include "path-util.h" | |
9 | #include "stat-util.h" | |
10 | #include "user-record-util.h" | |
11 | #include "user-util.h" | |
12 | ||
13 | int user_record_synthesize( | |
14 | UserRecord *h, | |
15 | const char *user_name, | |
16 | const char *realm, | |
17 | const char *image_path, | |
18 | UserStorage storage, | |
19 | uid_t uid, | |
20 | gid_t gid) { | |
21 | ||
22 | _cleanup_free_ char *hd = NULL, *un = NULL, *ip = NULL, *rr = NULL, *user_name_and_realm = NULL; | |
23 | char smid[SD_ID128_STRING_MAX]; | |
24 | sd_id128_t mid; | |
25 | int r; | |
26 | ||
27 | assert(h); | |
28 | assert(user_name); | |
29 | assert(image_path); | |
30 | assert(IN_SET(storage, USER_LUKS, USER_SUBVOLUME, USER_FSCRYPT, USER_DIRECTORY)); | |
31 | assert(uid_is_valid(uid)); | |
32 | assert(gid_is_valid(gid)); | |
33 | ||
34 | /* Fill in a home record from just a username and an image path. */ | |
35 | ||
36 | if (h->json) | |
37 | return -EBUSY; | |
38 | ||
39 | if (!suitable_user_name(user_name)) | |
40 | return -EINVAL; | |
41 | ||
42 | if (realm) { | |
43 | r = suitable_realm(realm); | |
44 | if (r < 0) | |
45 | return r; | |
46 | if (r == 0) | |
47 | return -EINVAL; | |
48 | } | |
49 | ||
50 | if (!suitable_image_path(image_path)) | |
51 | return -EINVAL; | |
52 | ||
53 | r = sd_id128_get_machine(&mid); | |
54 | if (r < 0) | |
55 | return r; | |
56 | ||
57 | un = strdup(user_name); | |
58 | if (!un) | |
59 | return -ENOMEM; | |
60 | ||
61 | if (realm) { | |
62 | rr = strdup(realm); | |
63 | if (!rr) | |
64 | return -ENOMEM; | |
65 | ||
66 | user_name_and_realm = strjoin(user_name, "@", realm); | |
67 | if (!user_name_and_realm) | |
68 | return -ENOMEM; | |
69 | } | |
70 | ||
71 | ip = strdup(image_path); | |
72 | if (!ip) | |
73 | return -ENOMEM; | |
74 | ||
75 | hd = path_join("/home/", user_name); | |
76 | if (!hd) | |
77 | return -ENOMEM; | |
78 | ||
79 | r = json_build(&h->json, | |
80 | JSON_BUILD_OBJECT( | |
81 | JSON_BUILD_PAIR("userName", JSON_BUILD_STRING(user_name)), | |
82 | JSON_BUILD_PAIR_CONDITION(!!rr, "realm", JSON_BUILD_STRING(realm)), | |
83 | JSON_BUILD_PAIR("disposition", JSON_BUILD_STRING("regular")), | |
84 | JSON_BUILD_PAIR("binding", JSON_BUILD_OBJECT( | |
85 | JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( | |
86 | JSON_BUILD_PAIR("imagePath", JSON_BUILD_STRING(image_path)), | |
87 | JSON_BUILD_PAIR("homeDirectory", JSON_BUILD_STRING(hd)), | |
88 | JSON_BUILD_PAIR("storage", JSON_BUILD_STRING(user_storage_to_string(storage))), | |
89 | JSON_BUILD_PAIR("uid", JSON_BUILD_UNSIGNED(uid)), | |
90 | JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(gid)))))))); | |
91 | if (r < 0) | |
92 | return r; | |
93 | ||
94 | free_and_replace(h->user_name, un); | |
95 | free_and_replace(h->realm, rr); | |
96 | free_and_replace(h->user_name_and_realm_auto, user_name_and_realm); | |
97 | free_and_replace(h->image_path, ip); | |
98 | free_and_replace(h->home_directory, hd); | |
99 | h->storage = storage; | |
100 | h->uid = uid; | |
101 | ||
102 | h->mask = USER_RECORD_REGULAR|USER_RECORD_BINDING; | |
103 | return 0; | |
104 | } | |
105 | ||
106 | int group_record_synthesize(GroupRecord *g, UserRecord *h) { | |
107 | _cleanup_free_ char *un = NULL, *rr = NULL, *group_name_and_realm = NULL; | |
108 | char smid[SD_ID128_STRING_MAX]; | |
109 | sd_id128_t mid; | |
110 | int r; | |
111 | ||
112 | assert(g); | |
113 | assert(h); | |
114 | ||
115 | if (g->json) | |
116 | return -EBUSY; | |
117 | ||
118 | r = sd_id128_get_machine(&mid); | |
119 | if (r < 0) | |
120 | return r; | |
121 | ||
122 | un = strdup(h->user_name); | |
123 | if (!un) | |
124 | return -ENOMEM; | |
125 | ||
126 | if (h->realm) { | |
127 | rr = strdup(h->realm); | |
128 | if (!rr) | |
129 | return -ENOMEM; | |
130 | ||
131 | group_name_and_realm = strjoin(un, "@", rr); | |
132 | if (!group_name_and_realm) | |
133 | return -ENOMEM; | |
134 | } | |
135 | ||
136 | r = json_build(&g->json, | |
137 | JSON_BUILD_OBJECT( | |
138 | JSON_BUILD_PAIR("groupName", JSON_BUILD_STRING(un)), | |
139 | JSON_BUILD_PAIR_CONDITION(!!rr, "realm", JSON_BUILD_STRING(rr)), | |
140 | JSON_BUILD_PAIR("binding", JSON_BUILD_OBJECT( | |
141 | JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( | |
142 | JSON_BUILD_PAIR("gid", JSON_BUILD_UNSIGNED(user_record_gid(h))))))), | |
143 | JSON_BUILD_PAIR_CONDITION(h->disposition >= 0, "disposition", JSON_BUILD_STRING(user_disposition_to_string(user_record_disposition(h)))), | |
144 | JSON_BUILD_PAIR("status", JSON_BUILD_OBJECT( | |
145 | JSON_BUILD_PAIR(sd_id128_to_string(mid, smid), JSON_BUILD_OBJECT( | |
146 | JSON_BUILD_PAIR("service", JSON_BUILD_STRING("io.systemd.Home")))))))); | |
147 | if (r < 0) | |
148 | return r; | |
149 | ||
150 | free_and_replace(g->group_name, un); | |
151 | free_and_replace(g->realm, rr); | |
152 | free_and_replace(g->group_name_and_realm_auto, group_name_and_realm); | |
153 | g->gid = user_record_gid(h); | |
154 | g->disposition = h->disposition; | |
155 | ||
156 | g->mask = USER_RECORD_REGULAR|USER_RECORD_BINDING; | |
157 | return 0; | |
158 | } | |
159 | ||
160 | int user_record_reconcile( | |
161 | UserRecord *host, | |
162 | UserRecord *embedded, | |
163 | UserReconcileMode mode, | |
164 | UserRecord **ret) { | |
165 | ||
166 | int r, result; | |
167 | ||
168 | /* Reconciles the identity record stored on the host with the one embedded in a $HOME | |
169 | * directory. Returns the following error codes: | |
170 | * | |
171 | * -EINVAL: one of the records not valid | |
172 | * -REMCHG: identity records are not about the same user | |
173 | * -ESTALE: embedded identity record is equally new or newer than supplied record | |
174 | * | |
175 | * Return the new record to use, which is either the the embedded record updated with the host | |
176 | * binding or the host record. In both cases the secret data is stripped. */ | |
177 | ||
178 | assert(host); | |
179 | assert(embedded); | |
180 | ||
181 | /* Make sure both records are initialized */ | |
182 | if (!host->json || !embedded->json) | |
183 | return -EINVAL; | |
184 | ||
185 | /* Ensure these records actually contain user data */ | |
186 | if (!(embedded->mask & host->mask & USER_RECORD_REGULAR)) | |
187 | return -EINVAL; | |
188 | ||
189 | /* Make sure the user name and realm matches */ | |
190 | if (!user_record_compatible(host, embedded)) | |
191 | return -EREMCHG; | |
192 | ||
193 | /* Embedded identities may not contain secrets or binding info*/ | |
194 | if ((embedded->mask & (USER_RECORD_SECRET|USER_RECORD_BINDING)) != 0) | |
195 | return -EINVAL; | |
196 | ||
197 | /* The embedded record checked out, let's now figure out which of the two identities we'll consider | |
198 | * in effect from now on. We do this by checking the last change timestamp, and in doubt always let | |
199 | * the embedded data win. */ | |
200 | if (host->last_change_usec != UINT64_MAX && | |
201 | (embedded->last_change_usec == UINT64_MAX || host->last_change_usec > embedded->last_change_usec)) | |
202 | ||
203 | /* The host version is definitely newer, either because it has a version at all and the | |
204 | * embedded version doesn't or because it is numerically newer. */ | |
205 | result = USER_RECONCILE_HOST_WON; | |
206 | ||
207 | else if (host->last_change_usec == embedded->last_change_usec) { | |
208 | ||
209 | /* The nominal version number of the host and the embedded identity is the same. If so, let's | |
210 | * verify that, and tell the caller if we are ignoring embedded data. */ | |
211 | ||
212 | r = user_record_masked_equal(host, embedded, USER_RECORD_REGULAR|USER_RECORD_PRIVILEGED|USER_RECORD_PER_MACHINE); | |
213 | if (r < 0) | |
214 | return r; | |
215 | if (r > 0) { | |
216 | if (mode == USER_RECONCILE_REQUIRE_NEWER) | |
217 | return -ESTALE; | |
218 | ||
219 | result = USER_RECONCILE_IDENTICAL; | |
220 | } else | |
221 | result = USER_RECONCILE_HOST_WON; | |
222 | } else { | |
223 | _cleanup_(json_variant_unrefp) JsonVariant *extended = NULL; | |
224 | _cleanup_(user_record_unrefp) UserRecord *merged = NULL; | |
225 | JsonVariant *e; | |
226 | ||
227 | /* The embedded version is newer */ | |
228 | ||
229 | if (mode == USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL) | |
230 | return -ESTALE; | |
231 | ||
232 | /* Copy in the binding data */ | |
233 | extended = json_variant_ref(embedded->json); | |
234 | ||
235 | e = json_variant_by_key(host->json, "binding"); | |
236 | if (e) { | |
237 | r = json_variant_set_field(&extended, "binding", e); | |
238 | if (r < 0) | |
239 | return r; | |
240 | } | |
241 | ||
242 | merged = user_record_new(); | |
243 | if (!merged) | |
244 | return -ENOMEM; | |
245 | ||
246 | r = user_record_load(merged, extended, USER_RECORD_LOAD_MASK_SECRET); | |
247 | if (r < 0) | |
248 | return r; | |
249 | ||
250 | *ret = TAKE_PTR(merged); | |
251 | return USER_RECONCILE_EMBEDDED_WON; /* update */ | |
252 | } | |
253 | ||
254 | /* Strip out secrets */ | |
255 | r = user_record_clone(host, USER_RECORD_LOAD_MASK_SECRET, ret); | |
256 | if (r < 0) | |
257 | return r; | |
258 | ||
259 | return result; | |
260 | } | |
261 | ||
262 | int user_record_add_binding( | |
263 | UserRecord *h, | |
264 | UserStorage storage, | |
265 | const char *image_path, | |
266 | sd_id128_t partition_uuid, | |
267 | sd_id128_t luks_uuid, | |
268 | sd_id128_t fs_uuid, | |
269 | const char *luks_cipher, | |
270 | const char *luks_cipher_mode, | |
271 | uint64_t luks_volume_key_size, | |
272 | const char *file_system_type, | |
273 | const char *home_directory, | |
274 | uid_t uid, | |
275 | gid_t gid) { | |
276 | ||
277 | _cleanup_(json_variant_unrefp) JsonVariant *new_binding_entry = NULL, *binding = NULL; | |
278 | char smid[SD_ID128_STRING_MAX], partition_uuids[37], luks_uuids[37], fs_uuids[37]; | |
279 | _cleanup_free_ char *ip = NULL, *hd = NULL; | |
280 | sd_id128_t mid; | |
281 | int r; | |
282 | ||
283 | assert(h); | |
284 | ||
285 | if (!h->json) | |
286 | return -EUNATCH; | |
287 | ||
288 | r = sd_id128_get_machine(&mid); | |
289 | if (r < 0) | |
290 | return r; | |
291 | sd_id128_to_string(mid, smid); | |
292 | ||
293 | if (image_path) { | |
294 | ip = strdup(image_path); | |
295 | if (!ip) | |
296 | return -ENOMEM; | |
297 | } | |
298 | ||
299 | if (home_directory) { | |
300 | hd = strdup(home_directory); | |
301 | if (!hd) | |
302 | return -ENOMEM; | |
303 | } | |
304 | ||
305 | r = json_build(&new_binding_entry, | |
306 | JSON_BUILD_OBJECT( | |
307 | JSON_BUILD_PAIR_CONDITION(!!image_path, "imagePath", JSON_BUILD_STRING(image_path)), | |
308 | JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(partition_uuid), "partitionUuid", JSON_BUILD_STRING(id128_to_uuid_string(partition_uuid, partition_uuids))), | |
309 | JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(luks_uuid), "luksUuid", JSON_BUILD_STRING(id128_to_uuid_string(luks_uuid, luks_uuids))), | |
310 | JSON_BUILD_PAIR_CONDITION(!sd_id128_is_null(fs_uuid), "fileSystemUuid", JSON_BUILD_STRING(id128_to_uuid_string(fs_uuid, fs_uuids))), | |
311 | JSON_BUILD_PAIR_CONDITION(!!luks_cipher, "luksCipher", JSON_BUILD_STRING(luks_cipher)), | |
312 | JSON_BUILD_PAIR_CONDITION(!!luks_cipher_mode, "luksCipherMode", JSON_BUILD_STRING(luks_cipher_mode)), | |
313 | JSON_BUILD_PAIR_CONDITION(luks_volume_key_size != UINT64_MAX, "luksVolumeKeySize", JSON_BUILD_UNSIGNED(luks_volume_key_size)), | |
314 | JSON_BUILD_PAIR_CONDITION(!!file_system_type, "fileSystemType", JSON_BUILD_STRING(file_system_type)), | |
315 | JSON_BUILD_PAIR_CONDITION(!!home_directory, "homeDirectory", JSON_BUILD_STRING(home_directory)), | |
316 | JSON_BUILD_PAIR_CONDITION(uid_is_valid(uid), "uid", JSON_BUILD_UNSIGNED(uid)), | |
317 | JSON_BUILD_PAIR_CONDITION(gid_is_valid(gid), "gid", JSON_BUILD_UNSIGNED(gid)), | |
318 | JSON_BUILD_PAIR_CONDITION(storage >= 0, "storage", JSON_BUILD_STRING(user_storage_to_string(storage))))); | |
319 | if (r < 0) | |
320 | return r; | |
321 | ||
322 | binding = json_variant_ref(json_variant_by_key(h->json, "binding")); | |
323 | if (binding) { | |
324 | _cleanup_(json_variant_unrefp) JsonVariant *be = NULL; | |
325 | ||
326 | /* Merge the new entry with an old one, if that exists */ | |
327 | be = json_variant_ref(json_variant_by_key(binding, smid)); | |
328 | if (be) { | |
329 | r = json_variant_merge(&be, new_binding_entry); | |
330 | if (r < 0) | |
331 | return r; | |
332 | ||
333 | json_variant_unref(new_binding_entry); | |
334 | new_binding_entry = TAKE_PTR(be); | |
335 | } | |
336 | } | |
337 | ||
338 | r = json_variant_set_field(&binding, smid, new_binding_entry); | |
339 | if (r < 0) | |
340 | return r; | |
341 | ||
342 | r = json_variant_set_field(&h->json, "binding", binding); | |
343 | if (r < 0) | |
344 | return r; | |
345 | ||
346 | if (storage >= 0) | |
347 | h->storage = storage; | |
348 | ||
349 | if (ip) | |
350 | free_and_replace(h->image_path, ip); | |
351 | ||
352 | if (!sd_id128_is_null(partition_uuid)) | |
353 | h->partition_uuid = partition_uuid; | |
354 | ||
355 | if (!sd_id128_is_null(luks_uuid)) | |
356 | h->luks_uuid = luks_uuid; | |
357 | ||
358 | if (!sd_id128_is_null(fs_uuid)) | |
359 | h->file_system_uuid = fs_uuid; | |
360 | ||
361 | if (hd) | |
362 | free_and_replace(h->home_directory, hd); | |
363 | ||
364 | if (uid_is_valid(uid)) | |
365 | h->uid = uid; | |
366 | ||
367 | h->mask |= USER_RECORD_BINDING; | |
368 | return 1; | |
369 | } | |
370 | ||
371 | int user_record_test_home_directory(UserRecord *h) { | |
372 | const char *hd; | |
373 | int r; | |
374 | ||
375 | assert(h); | |
376 | ||
377 | /* Returns one of USER_TEST_ABSENT, USER_TEST_MOUNTED, USER_TEST_EXISTS on success */ | |
378 | ||
379 | hd = user_record_home_directory(h); | |
380 | if (!hd) | |
381 | return -ENXIO; | |
382 | ||
383 | r = is_dir(hd, false); | |
384 | if (r == -ENOENT) | |
385 | return USER_TEST_ABSENT; | |
386 | if (r < 0) | |
387 | return r; | |
388 | if (r == 0) | |
389 | return -ENOTDIR; | |
390 | ||
391 | r = path_is_mount_point(hd, NULL, 0); | |
392 | if (r < 0) | |
393 | return r; | |
394 | if (r > 0) | |
395 | return USER_TEST_MOUNTED; | |
396 | ||
397 | /* If the image path and the home directory are identical, then it's OK if the directory is | |
398 | * populated. */ | |
399 | if (IN_SET(user_record_storage(h), USER_CLASSIC, USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT)) { | |
400 | const char *ip; | |
401 | ||
402 | ip = user_record_image_path(h); | |
403 | if (ip && path_equal(ip, hd)) | |
404 | return USER_TEST_EXISTS; | |
405 | } | |
406 | ||
407 | /* Otherwise it's not OK */ | |
408 | r = dir_is_empty(hd); | |
409 | if (r < 0) | |
410 | return r; | |
411 | if (r == 0) | |
412 | return -EBUSY; | |
413 | ||
414 | return USER_TEST_EXISTS; | |
415 | } | |
416 | ||
417 | int user_record_test_home_directory_and_warn(UserRecord *h) { | |
418 | int r; | |
419 | ||
420 | assert(h); | |
421 | ||
422 | r = user_record_test_home_directory(h); | |
423 | if (r == -ENXIO) | |
424 | return log_error_errno(r, "User record lacks home directory, refusing."); | |
425 | if (r == -ENOTDIR) | |
426 | return log_error_errno(r, "Home directory %s is not a directory, refusing.", user_record_home_directory(h)); | |
427 | if (r == -EBUSY) | |
428 | return log_error_errno(r, "Home directory %s exists, is not mounted but populated, refusing.", user_record_home_directory(h)); | |
429 | if (r < 0) | |
430 | return log_error_errno(r, "Failed to test whether the home directory %s exists: %m", user_record_home_directory(h)); | |
431 | ||
432 | return r; | |
433 | } | |
434 | ||
435 | int user_record_test_image_path(UserRecord *h) { | |
436 | const char *ip; | |
437 | struct stat st; | |
438 | ||
439 | assert(h); | |
440 | ||
441 | if (user_record_storage(h) == USER_CIFS) | |
442 | return USER_TEST_UNDEFINED; | |
443 | ||
444 | ip = user_record_image_path(h); | |
445 | if (!ip) | |
446 | return -ENXIO; | |
447 | ||
448 | if (stat(ip, &st) < 0) { | |
449 | if (errno == ENOENT) | |
450 | return USER_TEST_ABSENT; | |
451 | ||
452 | return -errno; | |
453 | } | |
454 | ||
455 | switch (user_record_storage(h)) { | |
456 | ||
457 | case USER_LUKS: | |
458 | if (S_ISREG(st.st_mode)) | |
459 | return USER_TEST_EXISTS; | |
460 | if (S_ISBLK(st.st_mode)) { | |
461 | /* For block devices we can't really be sure if the device referenced actually is the | |
462 | * fs we look for or some other file system (think: what does /dev/sdb1 refer | |
463 | * to?). Hence, let's return USER_TEST_MAYBE as an ambigious return value for these | |
464 | * case, except if the device path used is one of the paths that is based on a | |
465 | * filesystem or partition UUID or label, because in those cases we can be sure we | |
466 | * are referring to the right device. */ | |
467 | ||
468 | if (PATH_STARTSWITH_SET(ip, | |
469 | "/dev/disk/by-uuid/", | |
470 | "/dev/disk/by-partuuid/", | |
471 | "/dev/disk/by-partlabel/", | |
472 | "/dev/disk/by-label/")) | |
473 | return USER_TEST_EXISTS; | |
474 | ||
475 | return USER_TEST_MAYBE; | |
476 | } | |
477 | ||
478 | return -EBADFD; | |
479 | ||
480 | case USER_CLASSIC: | |
481 | case USER_DIRECTORY: | |
482 | case USER_SUBVOLUME: | |
483 | case USER_FSCRYPT: | |
484 | if (S_ISDIR(st.st_mode)) | |
485 | return USER_TEST_EXISTS; | |
486 | ||
487 | return -ENOTDIR; | |
488 | ||
489 | default: | |
490 | assert_not_reached("Unexpected record type"); | |
491 | } | |
492 | } | |
493 | ||
494 | int user_record_test_image_path_and_warn(UserRecord *h) { | |
495 | int r; | |
496 | ||
497 | assert(h); | |
498 | ||
499 | r = user_record_test_image_path(h); | |
500 | if (r == -ENXIO) | |
501 | return log_error_errno(r, "User record lacks image path, refusing."); | |
502 | if (r == -EBADFD) | |
503 | return log_error_errno(r, "Image path %s is not a regular file or block device, refusing.", user_record_image_path(h)); | |
504 | if (r == -ENOTDIR) | |
505 | return log_error_errno(r, "Image path %s is not a directory, refusing.", user_record_image_path(h)); | |
506 | if (r < 0) | |
507 | return log_error_errno(r, "Failed to test whether image path %s exists: %m", user_record_image_path(h)); | |
508 | ||
509 | return r; | |
510 | } | |
511 | ||
512 | int user_record_test_secret(UserRecord *h, UserRecord *secret) { | |
513 | char **i; | |
514 | int r; | |
515 | ||
516 | assert(h); | |
517 | ||
518 | /* Checks whether any of the specified passwords matches any of the hashed passwords of the entry */ | |
519 | ||
520 | if (strv_isempty(h->hashed_password)) | |
521 | return -ENXIO; | |
522 | ||
523 | STRV_FOREACH(i, secret->password) { | |
524 | r = test_password_many(h->hashed_password, *i); | |
525 | if (r < 0) | |
526 | return r; | |
527 | if (r > 0) | |
528 | return 0; | |
529 | } | |
530 | ||
531 | return -ENOKEY; | |
532 | } | |
533 | ||
534 | int user_record_set_disk_size(UserRecord *h, uint64_t disk_size) { | |
535 | _cleanup_(json_variant_unrefp) JsonVariant *new_per_machine = NULL, *midv = NULL, *midav = NULL, *ne = NULL; | |
536 | _cleanup_free_ JsonVariant **array = NULL; | |
537 | char smid[SD_ID128_STRING_MAX]; | |
538 | size_t idx = SIZE_MAX, n; | |
539 | JsonVariant *per_machine; | |
540 | sd_id128_t mid; | |
541 | int r; | |
542 | ||
543 | assert(h); | |
544 | ||
545 | if (!h->json) | |
546 | return -EUNATCH; | |
547 | ||
548 | if (disk_size < USER_DISK_SIZE_MIN || disk_size > USER_DISK_SIZE_MAX) | |
549 | return -ERANGE; | |
550 | ||
551 | r = sd_id128_get_machine(&mid); | |
552 | if (r < 0) | |
553 | return r; | |
554 | ||
555 | sd_id128_to_string(mid, smid); | |
556 | ||
557 | r = json_variant_new_string(&midv, smid); | |
558 | if (r < 0) | |
559 | return r; | |
560 | ||
561 | r = json_variant_new_array(&midav, (JsonVariant*[]) { midv }, 1); | |
562 | if (r < 0) | |
563 | return r; | |
564 | ||
565 | per_machine = json_variant_by_key(h->json, "perMachine"); | |
566 | if (per_machine) { | |
567 | size_t i; | |
568 | ||
569 | if (!json_variant_is_array(per_machine)) | |
570 | return -EINVAL; | |
571 | ||
572 | n = json_variant_elements(per_machine); | |
573 | ||
574 | array = new(JsonVariant*, n + 1); | |
575 | if (!array) | |
576 | return -ENOMEM; | |
577 | ||
578 | for (i = 0; i < n; i++) { | |
579 | JsonVariant *m; | |
580 | ||
581 | array[i] = json_variant_by_index(per_machine, i); | |
582 | ||
583 | if (!json_variant_is_object(array[i])) | |
584 | return -EINVAL; | |
585 | ||
586 | m = json_variant_by_key(array[i], "matchMachineId"); | |
587 | if (!m) { | |
588 | /* No machineId field? Let's ignore this, but invalidate what we found so far */ | |
589 | idx = SIZE_MAX; | |
590 | continue; | |
591 | } | |
592 | ||
593 | if (json_variant_equal(m, midv) || | |
594 | json_variant_equal(m, midav)) { | |
595 | /* Matches exactly what we are looking for. Let's use this */ | |
596 | idx = i; | |
597 | continue; | |
598 | } | |
599 | ||
600 | r = per_machine_id_match(m, JSON_PERMISSIVE); | |
601 | if (r < 0) | |
602 | return r; | |
603 | if (r > 0) | |
604 | /* Also matches what we are looking for, but with a broader match. In this | |
605 | * case let's ignore this entry, and add a new specific one to the end. */ | |
606 | idx = SIZE_MAX; | |
607 | } | |
608 | ||
609 | if (idx == SIZE_MAX) | |
610 | idx = n++; /* Nothing suitable found, place new entry at end */ | |
611 | else | |
612 | ne = json_variant_ref(array[idx]); | |
613 | ||
614 | } else { | |
615 | array = new(JsonVariant*, 1); | |
616 | if (!array) | |
617 | return -ENOMEM; | |
618 | ||
619 | idx = 0; | |
620 | n = 1; | |
621 | } | |
622 | ||
623 | if (!ne) { | |
624 | r = json_variant_set_field(&ne, "matchMachineId", midav); | |
625 | if (r < 0) | |
626 | return r; | |
627 | } | |
628 | ||
629 | r = json_variant_set_field_unsigned(&ne, "diskSize", disk_size); | |
630 | if (r < 0) | |
631 | return r; | |
632 | ||
633 | assert(idx < n); | |
634 | array[idx] = ne; | |
635 | ||
636 | r = json_variant_new_array(&new_per_machine, array, n); | |
637 | if (r < 0) | |
638 | return r; | |
639 | ||
640 | r = json_variant_set_field(&h->json, "perMachine", new_per_machine); | |
641 | if (r < 0) | |
642 | return r; | |
643 | ||
644 | h->disk_size = disk_size; | |
645 | h->mask |= USER_RECORD_PER_MACHINE; | |
646 | return 0; | |
647 | } | |
648 | ||
649 | int user_record_update_last_changed(UserRecord *h, bool with_password) { | |
650 | _cleanup_(json_variant_unrefp) JsonVariant *v = NULL; | |
651 | usec_t n; | |
652 | int r; | |
653 | ||
654 | assert(h); | |
655 | ||
656 | if (!h->json) | |
657 | return -EUNATCH; | |
658 | ||
659 | n = now(CLOCK_REALTIME); | |
660 | ||
661 | /* refuse downgrading */ | |
662 | if (h->last_change_usec != UINT64_MAX && h->last_change_usec >= n) | |
663 | return -ECHRNG; | |
664 | if (h->last_password_change_usec != UINT64_MAX && h->last_password_change_usec >= n) | |
665 | return -ECHRNG; | |
666 | ||
667 | v = json_variant_ref(h->json); | |
668 | ||
669 | r = json_variant_set_field_unsigned(&v, "lastChangeUSec", n); | |
670 | if (r < 0) | |
671 | return r; | |
672 | ||
673 | if (with_password) { | |
674 | r = json_variant_set_field_unsigned(&v, "lastPasswordChangeUSec", n); | |
675 | if (r < 0) | |
676 | return r; | |
677 | ||
678 | h->last_password_change_usec = n; | |
679 | } | |
680 | ||
681 | h->last_change_usec = n; | |
682 | ||
683 | json_variant_unref(h->json); | |
684 | h->json = TAKE_PTR(v); | |
685 | ||
686 | h->mask |= USER_RECORD_REGULAR; | |
687 | return 0; | |
688 | } | |
689 | ||
690 | int user_record_make_hashed_password(UserRecord *h, char **secret, bool extend) { | |
691 | _cleanup_(json_variant_unrefp) JsonVariant *priv = NULL; | |
692 | _cleanup_strv_free_ char **np = NULL; | |
693 | char **i; | |
694 | int r; | |
695 | ||
696 | assert(h); | |
697 | assert(secret); | |
698 | ||
699 | /* Initializes the hashed password list from the specified plaintext passwords */ | |
700 | ||
701 | if (extend) { | |
702 | np = strv_copy(h->hashed_password); | |
703 | if (!np) | |
704 | return -ENOMEM; | |
705 | ||
706 | strv_uniq(np); | |
707 | } | |
708 | ||
709 | STRV_FOREACH(i, secret) { | |
710 | _cleanup_free_ char *salt = NULL; | |
711 | struct crypt_data cd = {}; | |
712 | char *k; | |
713 | ||
714 | r = make_salt(&salt); | |
715 | if (r < 0) | |
716 | return r; | |
717 | ||
718 | errno = 0; | |
719 | k = crypt_r(*i, salt, &cd); | |
720 | if (!k) | |
721 | return errno_or_else(EINVAL); | |
722 | ||
723 | r = strv_extend(&np, k); | |
724 | if (r < 0) | |
725 | return r; | |
726 | } | |
727 | ||
728 | priv = json_variant_ref(json_variant_by_key(h->json, "privileged")); | |
729 | ||
730 | if (strv_isempty(np)) | |
731 | r = json_variant_filter(&priv, STRV_MAKE("hashedPassword")); | |
732 | else { | |
733 | _cleanup_(json_variant_unrefp) JsonVariant *new_array = NULL; | |
734 | ||
735 | r = json_variant_new_array_strv(&new_array, np); | |
736 | if (r < 0) | |
737 | return r; | |
738 | ||
739 | r = json_variant_set_field(&priv, "hashedPassword", new_array); | |
02cec156 YW |
740 | if (r < 0) |
741 | return r; | |
70a5db58 LP |
742 | } |
743 | ||
744 | r = json_variant_set_field(&h->json, "privileged", priv); | |
745 | if (r < 0) | |
746 | return r; | |
747 | ||
748 | strv_free_and_replace(h->hashed_password, np); | |
749 | ||
750 | SET_FLAG(h->mask, USER_RECORD_PRIVILEGED, !json_variant_is_blank_object(priv)); | |
751 | return 0; | |
752 | } | |
753 | ||
754 | int user_record_set_hashed_password(UserRecord *h, char **hashed_password) { | |
755 | _cleanup_(json_variant_unrefp) JsonVariant *priv = NULL; | |
756 | _cleanup_strv_free_ char **copy = NULL; | |
757 | int r; | |
758 | ||
759 | assert(h); | |
760 | ||
761 | priv = json_variant_ref(json_variant_by_key(h->json, "privileged")); | |
762 | ||
763 | if (strv_isempty(hashed_password)) | |
764 | r = json_variant_filter(&priv, STRV_MAKE("hashedPassword")); | |
765 | else { | |
766 | _cleanup_(json_variant_unrefp) JsonVariant *array = NULL; | |
767 | ||
768 | copy = strv_copy(hashed_password); | |
769 | if (!copy) | |
770 | return -ENOMEM; | |
771 | ||
772 | strv_uniq(copy); | |
773 | ||
774 | r = json_variant_new_array_strv(&array, copy); | |
775 | if (r < 0) | |
776 | return r; | |
777 | ||
778 | r = json_variant_set_field(&priv, "hashedPassword", array); | |
779 | } | |
780 | if (r < 0) | |
781 | return r; | |
782 | ||
783 | r = json_variant_set_field(&h->json, "privileged", priv); | |
784 | if (r < 0) | |
785 | return r; | |
786 | ||
787 | strv_free_and_replace(h->hashed_password, copy); | |
788 | ||
789 | SET_FLAG(h->mask, USER_RECORD_PRIVILEGED, !json_variant_is_blank_object(priv)); | |
790 | return 0; | |
791 | } | |
792 | ||
793 | int user_record_set_password(UserRecord *h, char **password, bool prepend) { | |
794 | _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; | |
795 | _cleanup_(strv_free_erasep) char **e = NULL; | |
796 | int r; | |
797 | ||
798 | assert(h); | |
799 | ||
800 | if (prepend) { | |
801 | e = strv_copy(password); | |
802 | if (!e) | |
803 | return -ENOMEM; | |
804 | ||
805 | r = strv_extend_strv(&e, h->password, true); | |
806 | if (r < 0) | |
807 | return r; | |
808 | ||
809 | strv_uniq(e); | |
810 | ||
811 | if (strv_equal(h->password, e)) | |
812 | return 0; | |
813 | ||
814 | } else { | |
815 | if (strv_equal(h->password, password)) | |
816 | return 0; | |
817 | ||
818 | e = strv_copy(password); | |
819 | if (!e) | |
820 | return -ENOMEM; | |
821 | ||
822 | strv_uniq(e); | |
823 | } | |
824 | ||
825 | w = json_variant_ref(json_variant_by_key(h->json, "secret")); | |
826 | ||
827 | if (strv_isempty(e)) | |
828 | r = json_variant_filter(&w, STRV_MAKE("password")); | |
829 | else { | |
830 | _cleanup_(json_variant_unrefp) JsonVariant *l = NULL; | |
831 | ||
832 | r = json_variant_new_array_strv(&l, e); | |
833 | if (r < 0) | |
834 | return r; | |
835 | ||
836 | json_variant_sensitive(l); | |
837 | ||
838 | r = json_variant_set_field(&w, "password", l); | |
839 | } | |
840 | if (r < 0) | |
841 | return r; | |
842 | ||
843 | r = json_variant_set_field(&h->json, "secret", w); | |
844 | if (r < 0) | |
845 | return r; | |
846 | ||
847 | strv_free_and_replace(h->password, e); | |
848 | ||
849 | SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); | |
850 | return 0; | |
851 | } | |
852 | ||
853 | int user_record_set_pkcs11_pin(UserRecord *h, char **pin, bool prepend) { | |
854 | _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; | |
855 | _cleanup_(strv_free_erasep) char **e = NULL; | |
856 | int r; | |
857 | ||
858 | assert(h); | |
859 | ||
860 | if (prepend) { | |
861 | e = strv_copy(pin); | |
862 | if (!e) | |
863 | return -ENOMEM; | |
864 | ||
865 | r = strv_extend_strv(&e, h->pkcs11_pin, true); | |
866 | if (r < 0) | |
867 | return r; | |
868 | ||
869 | strv_uniq(e); | |
870 | ||
871 | if (strv_equal(h->pkcs11_pin, e)) | |
872 | return 0; | |
873 | ||
874 | } else { | |
875 | if (strv_equal(h->pkcs11_pin, pin)) | |
876 | return 0; | |
877 | ||
878 | e = strv_copy(pin); | |
879 | if (!e) | |
880 | return -ENOMEM; | |
881 | ||
882 | strv_uniq(e); | |
883 | } | |
884 | ||
885 | w = json_variant_ref(json_variant_by_key(h->json, "secret")); | |
886 | ||
887 | if (strv_isempty(e)) | |
888 | r = json_variant_filter(&w, STRV_MAKE("pkcs11Pin")); | |
889 | else { | |
890 | _cleanup_(json_variant_unrefp) JsonVariant *l = NULL; | |
891 | ||
892 | r = json_variant_new_array_strv(&l, e); | |
893 | if (r < 0) | |
894 | return r; | |
895 | ||
896 | json_variant_sensitive(l); | |
897 | ||
898 | r = json_variant_set_field(&w, "pkcs11Pin", l); | |
899 | } | |
900 | if (r < 0) | |
901 | return r; | |
902 | ||
903 | r = json_variant_set_field(&h->json, "secret", w); | |
904 | if (r < 0) | |
905 | return r; | |
906 | ||
907 | strv_free_and_replace(h->pkcs11_pin, e); | |
908 | ||
909 | SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); | |
910 | return 0; | |
911 | } | |
912 | ||
913 | int user_record_set_pkcs11_protected_authentication_path_permitted(UserRecord *h, int b) { | |
914 | _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; | |
915 | int r; | |
916 | ||
917 | assert(h); | |
918 | ||
919 | w = json_variant_ref(json_variant_by_key(h->json, "secret")); | |
920 | ||
921 | if (b < 0) | |
922 | r = json_variant_filter(&w, STRV_MAKE("pkcs11ProtectedAuthenticationPathPermitted")); | |
923 | else | |
924 | r = json_variant_set_field_boolean(&w, "pkcs11ProtectedAuthenticationPathPermitted", b); | |
925 | if (r < 0) | |
926 | return r; | |
927 | ||
928 | if (json_variant_is_blank_object(w)) | |
929 | r = json_variant_filter(&h->json, STRV_MAKE("secret")); | |
930 | else | |
931 | r = json_variant_set_field(&h->json, "secret", w); | |
932 | if (r < 0) | |
933 | return r; | |
934 | ||
935 | h->pkcs11_protected_authentication_path_permitted = b; | |
936 | ||
937 | SET_FLAG(h->mask, USER_RECORD_SECRET, !json_variant_is_blank_object(w)); | |
938 | return 0; | |
939 | } | |
940 | ||
941 | static bool per_machine_entry_empty(JsonVariant *v) { | |
942 | const char *k; | |
943 | _unused_ JsonVariant *e; | |
944 | ||
945 | JSON_VARIANT_OBJECT_FOREACH(k, e, v) | |
946 | if (!STR_IN_SET(k, "matchMachineId", "matchHostname")) | |
947 | return false; | |
948 | ||
949 | return true; | |
950 | } | |
951 | ||
952 | int user_record_set_password_change_now(UserRecord *h, int b) { | |
953 | _cleanup_(json_variant_unrefp) JsonVariant *w = NULL; | |
954 | JsonVariant *per_machine; | |
955 | int r; | |
956 | ||
957 | assert(h); | |
958 | ||
959 | w = json_variant_ref(h->json); | |
960 | ||
961 | if (b < 0) | |
962 | r = json_variant_filter(&w, STRV_MAKE("passwordChangeNow")); | |
963 | else | |
964 | r = json_variant_set_field_boolean(&w, "passwordChangeNow", b); | |
965 | if (r < 0) | |
966 | return r; | |
967 | ||
968 | /* Also drop the field from all perMachine entries */ | |
969 | per_machine = json_variant_by_key(w, "perMachine"); | |
970 | if (per_machine) { | |
971 | _cleanup_(json_variant_unrefp) JsonVariant *array = NULL; | |
972 | JsonVariant *e; | |
973 | ||
974 | JSON_VARIANT_ARRAY_FOREACH(e, per_machine) { | |
975 | _cleanup_(json_variant_unrefp) JsonVariant *z = NULL; | |
976 | ||
977 | if (!json_variant_is_object(e)) | |
978 | return -EINVAL; | |
979 | ||
980 | z = json_variant_ref(e); | |
981 | ||
982 | r = json_variant_filter(&z, STRV_MAKE("passwordChangeNow")); | |
983 | if (r < 0) | |
984 | return r; | |
985 | ||
986 | if (per_machine_entry_empty(z)) | |
987 | continue; | |
988 | ||
989 | r = json_variant_append_array(&array, z); | |
990 | if (r < 0) | |
991 | return r; | |
992 | } | |
993 | ||
994 | if (json_variant_is_blank_array(array)) | |
995 | r = json_variant_filter(&w, STRV_MAKE("perMachine")); | |
996 | else | |
997 | r = json_variant_set_field(&w, "perMachine", array); | |
998 | if (r < 0) | |
999 | return r; | |
1000 | ||
1001 | SET_FLAG(h->mask, USER_RECORD_PER_MACHINE, !json_variant_is_blank_array(array)); | |
1002 | } | |
1003 | ||
1004 | json_variant_unref(h->json); | |
1005 | h->json = TAKE_PTR(w); | |
1006 | ||
1007 | h->password_change_now = b; | |
1008 | ||
1009 | return 0; | |
1010 | } | |
1011 | ||
1012 | int user_record_merge_secret(UserRecord *h, UserRecord *secret) { | |
1013 | int r; | |
1014 | ||
1015 | assert(h); | |
1016 | ||
1017 | /* Merges the secrets from 'secret' into 'h'. */ | |
1018 | ||
1019 | r = user_record_set_password(h, secret->password, true); | |
1020 | if (r < 0) | |
1021 | return r; | |
1022 | ||
1023 | r = user_record_set_pkcs11_pin(h, secret->pkcs11_pin, true); | |
1024 | if (r < 0) | |
1025 | return r; | |
1026 | ||
1027 | if (secret->pkcs11_protected_authentication_path_permitted >= 0) { | |
1028 | r = user_record_set_pkcs11_protected_authentication_path_permitted(h, secret->pkcs11_protected_authentication_path_permitted); | |
1029 | if (r < 0) | |
1030 | return r; | |
1031 | } | |
1032 | ||
1033 | return 0; | |
1034 | } | |
1035 | ||
1036 | int user_record_good_authentication(UserRecord *h) { | |
1037 | _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; | |
1038 | char buf[SD_ID128_STRING_MAX]; | |
1039 | uint64_t counter, usec; | |
1040 | sd_id128_t mid; | |
1041 | int r; | |
1042 | ||
1043 | assert(h); | |
1044 | ||
1045 | switch (h->good_authentication_counter) { | |
1046 | case UINT64_MAX: | |
1047 | counter = 1; | |
1048 | break; | |
1049 | case UINT64_MAX-1: | |
1050 | counter = h->good_authentication_counter; /* saturate */ | |
1051 | break; | |
1052 | default: | |
1053 | counter = h->good_authentication_counter + 1; | |
1054 | break; | |
1055 | } | |
1056 | ||
1057 | usec = now(CLOCK_REALTIME); | |
1058 | ||
1059 | r = sd_id128_get_machine(&mid); | |
1060 | if (r < 0) | |
1061 | return r; | |
1062 | ||
1063 | v = json_variant_ref(h->json); | |
1064 | w = json_variant_ref(json_variant_by_key(v, "status")); | |
1065 | z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); | |
1066 | ||
1067 | r = json_variant_set_field_unsigned(&z, "goodAuthenticationCounter", counter); | |
1068 | if (r < 0) | |
1069 | return r; | |
1070 | ||
1071 | r = json_variant_set_field_unsigned(&z, "lastGoodAuthenticationUSec", usec); | |
1072 | if (r < 0) | |
1073 | return r; | |
1074 | ||
1075 | r = json_variant_set_field(&w, buf, z); | |
1076 | if (r < 0) | |
1077 | return r; | |
1078 | ||
1079 | r = json_variant_set_field(&v, "status", w); | |
1080 | if (r < 0) | |
1081 | return r; | |
1082 | ||
1083 | json_variant_unref(h->json); | |
1084 | h->json = TAKE_PTR(v); | |
1085 | ||
1086 | h->good_authentication_counter = counter; | |
1087 | h->last_good_authentication_usec = usec; | |
1088 | ||
1089 | h->mask |= USER_RECORD_STATUS; | |
1090 | return 0; | |
1091 | } | |
1092 | ||
1093 | int user_record_bad_authentication(UserRecord *h) { | |
1094 | _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; | |
1095 | char buf[SD_ID128_STRING_MAX]; | |
1096 | uint64_t counter, usec; | |
1097 | sd_id128_t mid; | |
1098 | int r; | |
1099 | ||
1100 | assert(h); | |
1101 | ||
1102 | switch (h->bad_authentication_counter) { | |
1103 | case UINT64_MAX: | |
1104 | counter = 1; | |
1105 | break; | |
1106 | case UINT64_MAX-1: | |
1107 | counter = h->bad_authentication_counter; /* saturate */ | |
1108 | break; | |
1109 | default: | |
1110 | counter = h->bad_authentication_counter + 1; | |
1111 | break; | |
1112 | } | |
1113 | ||
1114 | usec = now(CLOCK_REALTIME); | |
1115 | ||
1116 | r = sd_id128_get_machine(&mid); | |
1117 | if (r < 0) | |
1118 | return r; | |
1119 | ||
1120 | v = json_variant_ref(h->json); | |
1121 | w = json_variant_ref(json_variant_by_key(v, "status")); | |
1122 | z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); | |
1123 | ||
1124 | r = json_variant_set_field_unsigned(&z, "badAuthenticationCounter", counter); | |
1125 | if (r < 0) | |
1126 | return r; | |
1127 | ||
1128 | r = json_variant_set_field_unsigned(&z, "lastBadAuthenticationUSec", usec); | |
1129 | if (r < 0) | |
1130 | return r; | |
1131 | ||
1132 | r = json_variant_set_field(&w, buf, z); | |
1133 | if (r < 0) | |
1134 | return r; | |
1135 | ||
1136 | r = json_variant_set_field(&v, "status", w); | |
1137 | if (r < 0) | |
1138 | return r; | |
1139 | ||
1140 | json_variant_unref(h->json); | |
1141 | h->json = TAKE_PTR(v); | |
1142 | ||
1143 | h->bad_authentication_counter = counter; | |
1144 | h->last_bad_authentication_usec = usec; | |
1145 | ||
1146 | h->mask |= USER_RECORD_STATUS; | |
1147 | return 0; | |
1148 | } | |
1149 | ||
1150 | int user_record_ratelimit(UserRecord *h) { | |
1151 | _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *w = NULL, *z = NULL; | |
1152 | usec_t usec, new_ratelimit_begin_usec, new_ratelimit_count; | |
1153 | char buf[SD_ID128_STRING_MAX]; | |
1154 | sd_id128_t mid; | |
1155 | int r; | |
1156 | ||
1157 | assert(h); | |
1158 | ||
1159 | usec = now(CLOCK_REALTIME); | |
1160 | ||
1161 | if (h->ratelimit_begin_usec != UINT64_MAX && h->ratelimit_begin_usec > usec) | |
1162 | /* Hmm, time is running backwards? Say no! */ | |
1163 | return 0; | |
1164 | else if (h->ratelimit_begin_usec == UINT64_MAX || | |
1165 | usec_add(h->ratelimit_begin_usec, user_record_ratelimit_interval_usec(h)) <= usec) { | |
1166 | /* Fresh start */ | |
1167 | new_ratelimit_begin_usec = usec; | |
1168 | new_ratelimit_count = 1; | |
1169 | } else if (h->ratelimit_count < user_record_ratelimit_burst(h)) { | |
1170 | /* Count up */ | |
1171 | new_ratelimit_begin_usec = h->ratelimit_begin_usec; | |
1172 | new_ratelimit_count = h->ratelimit_count + 1; | |
1173 | } else | |
1174 | /* Limit hit */ | |
1175 | return 0; | |
1176 | ||
1177 | r = sd_id128_get_machine(&mid); | |
1178 | if (r < 0) | |
1179 | return r; | |
1180 | ||
1181 | v = json_variant_ref(h->json); | |
1182 | w = json_variant_ref(json_variant_by_key(v, "status")); | |
1183 | z = json_variant_ref(json_variant_by_key(w, sd_id128_to_string(mid, buf))); | |
1184 | ||
1185 | r = json_variant_set_field_unsigned(&z, "rateLimitBeginUSec", new_ratelimit_begin_usec); | |
1186 | if (r < 0) | |
1187 | return r; | |
1188 | ||
1189 | r = json_variant_set_field_unsigned(&z, "rateLimitCount", new_ratelimit_count); | |
1190 | if (r < 0) | |
1191 | return r; | |
1192 | ||
1193 | r = json_variant_set_field(&w, buf, z); | |
1194 | if (r < 0) | |
1195 | return r; | |
1196 | ||
1197 | r = json_variant_set_field(&v, "status", w); | |
1198 | if (r < 0) | |
1199 | return r; | |
1200 | ||
1201 | json_variant_unref(h->json); | |
1202 | h->json = TAKE_PTR(v); | |
1203 | ||
1204 | h->ratelimit_begin_usec = new_ratelimit_begin_usec; | |
1205 | h->ratelimit_count = new_ratelimit_count; | |
1206 | ||
1207 | h->mask |= USER_RECORD_STATUS; | |
1208 | return 1; | |
1209 | } | |
1210 | ||
1211 | int user_record_is_supported(UserRecord *hr, sd_bus_error *error) { | |
1212 | assert(hr); | |
1213 | ||
1214 | if (hr->disposition >= 0 && hr->disposition != USER_REGULAR) | |
1215 | return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Cannot manage anything but regular users."); | |
1216 | ||
1217 | if (hr->storage >= 0 && !IN_SET(hr->storage, USER_LUKS, USER_DIRECTORY, USER_SUBVOLUME, USER_FSCRYPT, USER_CIFS)) | |
1218 | return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "User record has storage type this service cannot manage."); | |
1219 | ||
1220 | if (gid_is_valid(hr->gid) && hr->uid != (uid_t) hr->gid) | |
1221 | return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "User record has to have matching UID/GID fields."); | |
1222 | ||
1223 | if (hr->service && !streq(hr->service, "io.systemd.Home")) | |
1224 | return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Not accepted with service not matching io.systemd.Home."); | |
1225 | ||
1226 | return 0; | |
1227 | } |