core: manage SetShowStatus through polkit

When writing docs for SD_BUS_VTABLE_CAPABILITY, I noticed that we have one use
of SD_BUS_VTABLE_CAPABILITY(CAP_SYS_ADMIN) in the tree. This is the default, so
it's not very useful to specify it. But if we're touching that, I think it's
better to use mac + polkit for this like for everything else.

We don't have a very good category for this, but I don't think it makes sense
to add a new one. I just reused the same as other similar calls.

diff --git a/man/org.freedesktop.systemd1.xml b/man/org.freedesktop.systemd1.xml
index f6d6cf1384825073f9d6f435683b40f8d590b40f..5f1f586222c66e52fbf81ee00889633588b540ed 100644 (file)
--- a/man/org.freedesktop.systemd1.xml
+++ b/man/org.freedesktop.systemd1.xml
@@ -149,7 +149,6 @@ node /org/freedesktop/systemd1 {
       CancelJob(in  u id);
       ClearJobs();
       ResetFailed();
-      @org.freedesktop.systemd1.Privileged("true")
       SetShowStatus(in  s mode);
       ListUnits(out a(ssssssouso) units);
       ListUnitsFiltered(in  as states,

diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
index 91ff68fb5c8485d059d3cbca8b9fce2a778663a0..49982d003015d0a63646e5b7c5894adf0dad54f9 100644 (file)
--- a/src/core/dbus-manager.c
+++ b/src/core/dbus-manager.c
@@ -2710,6 +2710,16 @@ static int method_set_show_status(sd_bus_message *message, void *userdata, sd_bu
         assert(m);
         assert(message);
 
+        r = mac_selinux_access_check(message, "reload", error);
+        if (r < 0)
+                return r;
+
+        r = bus_verify_set_environment_async(m, message, error);
+        if (r < 0)
+                return r;
+        if (r == 0)
+                return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
+
         r = sd_bus_message_read(message, "s", &t);
         if (r < 0)
                 return r;
@@ -3100,7 +3110,7 @@ const sd_bus_vtable bus_manager_vtable[] = {
                                  SD_BUS_PARAM(mode),
                                  NULL,,
                                  method_set_show_status,
-                                 SD_BUS_VTABLE_CAPABILITY(CAP_SYS_ADMIN)),
+                                 SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD_WITH_NAMES("ListUnits",
                                  NULL,,
                                  "a(ssssssouso)",