byteswap: make use of glibc specific bytswap primitives
glibc knows three bswap_{16|32|64}() calls that internally make use of a
gcc extension to implement faster byteswapping. We should make use of it
if we can.
atomic: implement atomic operations based on gcc's __sync extension
Newer gccs and intel ccs support a __sync extension for making use of
atomic operations. This patch replaces the handcrafted x86 atomic
operation support with usage of __sync.
__sync is supported by more processors and by more compilers than the
old assembler code. Also, this extension has been available on gcc for
quite a while now for x86, so replacing the old assembler code should
only be a loss when very old compiilers are used.
git: enable whitespace checking commit hook during in autogen.sh
Trailing whitespace sucks. This change modifies autogen.sh to activate
the example pre-commit that ships with git. It will make sure that from
then on no further commits with trailing whitespace can be made
cloexec: set all sockets that are created with SOCK_CLOEXEC
Since all socket users enable FD_CLOEXEC anyway we can just do that in
_dbus_open_socket() and be done with it for all cases. By side effect
this allows us to use SOCK_CLOEXEC and hence close the CLOEXEC race.
All users of full duplex pipes enable FD_CLOEXEC later anyway so let's
just do it as part of _dbus_full_duplex_pipe. By side effect this allows
to make use of SOCK_CLOEXEC which fixes a race when forking/execing from
a different thread at the same time as we ar in this function.
unix-fd: when sending a message with unix fds verify that the connection can do it
Not all of the send function flavours allow returning proper error
codes. For the cases where this is not easily possible the client should
call dbus_connection_can_send_type() first.
unix-fd: add message encoding/decoding for unix fds
When appending unix fds to the message a new entry in the fd array will
be allocated and the index to it will be written to the message payload.
When parsing unix fds from the message the index will be read from the
payload and then looked up in the fd array.
When we read fds we put them in a queue first. Since each message knows
how many fds are attached to it we will then pop enough fds from this
queue each time we decode a message from the stream.
This should make sending and receiving more portable since we don't make
any strong requirements on the exact semantics of the SCM_RIGHTS
implementation: as long as fds are recieved in order, none or lost and
the arrive at the same time as at least one byte from the actual message
dat we should be able to handle them correctly.
We introduce a new type code for the unix fds. The data stored in unix
fd fields will be an integer index into the array of fds that are
attached to a specific message. We also introduce a new header field
that stores how many fds belong to the message. And finally we introduce
a new error for messages where the payload and the meta data (i.e. unix
fds read for it) don't match up.
This function can be used to check if a socket can be used to pass file
descriptors. On platforms that don't support this at all this is
hardcoded to return FALSE.
On Linux send()/sendmsg() know the special flag MSG_NOSIGNAL which if
set makes sure that no SIGPIPE signal is raised when we write to a
socket that has been disconnected.
By using this flag we don't have to play games with SIGPIPE which is
pretty ugly stuff since it touches the global process context.
build-system: get rid of config.h inclusion checks
These header files include config.h explicitly anyway. These checks are
hence pointless.
Of course one could argue that including config.h from header files
sucks, but D-Bus generally seems not to have a problem with that, so
let's unify this.
Marc Mutz [Wed, 7 Jan 2009 11:46:53 +0000 (12:46 +0100)]
configure.in: fail abstract socket test gracefully when cross-compiling
* configure.in: only run AC_CACHE_CHECK if enable_abstract_sockets=auto
* configure.in: warn that, when cross-compiling, we're unable to detect
abstract sockets availability automatically
libselinux behavior in permissive mode wrt invalid domains
Stephen Smalley wrote:
> On Tue, 2009-04-21 at 16:32 -0400, Joshua Brindle wrote:
>
>> Stephen Smalley wrote:
>>
>>> On Thu, 2009-04-16 at 20:47 -0400, Eamon Walsh wrote:
>>>
>>>> Stephen Smalley wrote:
>>>>
>> <snip>
>>
>>
>>> No, I don't want to change the behavior upon context_to_sid calls in
>>> general, as we otherwise lose all context validity checking in
>>> permissive mode.
>>>
>>> I think I'd rather change compute_sid behavior to preclude the situation
>>> from arising in the first place, possibly altering the behavior in
>>> permissive mode upon an invalid context to fall back on the ssid
>>> (process) or the tsid (object). But I'm not entirely convinced any
>>> change is required here.
>>>
>>>
>> I just want to follow up to make sure we are all on the same page here. Was the
>> suggestion to change avc_has_perm in libselinux or context_to_sid in the kernel
>> or leave the code as is and fix the callers of avc_has_perm to correctly handle
>> error codes?
>>
>> I prefer the last approach because of Eamon's explanation, EINVAL is already
>> passed in errno to specify the context was invalid (and if object managers
>> aren't handling that correctly now there is a good chance they aren't handling
>> the ENOMEM case either).
>>
>
> I'd be inclined to change compute_sid (not context_to_sid) in the kernel
> to prevent invalid contexts from being formed even in permissive mode
> (scenario is a type transition where role is not authorized for the new
> type). That was originally to allow the system to boot in permissive
> mode. But an alternative would be to just stay in the caller's context
> (ssid) in that situation.
>
> Changing the callers of avc_has_perm() to handle EINVAL and/or ENOMEM
> may make sense, but that logic should not depend on enforcing vs.
> permissive mode.
>
>
FWIW, the following patch to D-Bus should help:
bfo21072 - Log SELinux denials better by checking errno for the cause
Note that this does not fully address the bug report since
EINVAL can still be returned in permissive mode. However the log
messages will now reflect the proper cause of the denial.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov> Signed-off-by: Colin Walters <walters@verbum.org>
William Lachance [Tue, 21 Apr 2009 17:51:46 +0000 (13:51 -0400)]
Bug 19567 - Make marshaling code usable without DBusConnection
Some projects want to reuse the DBus message format, without
actually going through a DBusConnection. This set of changes
makes a few functions from DBusMessage public, and adds a new
function to determine the number of bytes needed to demarshal
a message.
Colin Walters [Wed, 25 Feb 2009 16:10:15 +0000 (11:10 -0500)]
Bug 20137 - Fix alignment usage when demarshaling basics
We can't safely type-pun from e.g. char * to DBusBasicValue *, because
the latter has higher alignment requirements. Instead, create an
explicit pointer for each case.
Also, we mark each one volatile to sidestep strict aliasing issues, for
the future when we turn on strict aliasing support.
Original patch and review from Jay Estabrook <jay.estabrook@hp.com>.
Colin Walters [Wed, 1 Apr 2009 16:02:00 +0000 (12:02 -0400)]
Bug 17803 - Fix both test case and validation logic
The previous commit had errors in both the test case and
the validation logic. The test case was missing a trailing
comma before the previous one, so we weren't testing the
signature we thought we were.
The validation logic was wrong because if the type was not valid,
we'd drop through the entire if clause, and thus skip returning
an error code, and accept the signature.
libselinux behavior in permissive mode wrt invalid domains
Stephen Smalley wrote:
> On Tue, 2009-04-21 at 16:32 -0400, Joshua Brindle wrote:
>
>> Stephen Smalley wrote:
>>
>>> On Thu, 2009-04-16 at 20:47 -0400, Eamon Walsh wrote:
>>>
>>>> Stephen Smalley wrote:
>>>>
>> <snip>
>>
>>
>>> No, I don't want to change the behavior upon context_to_sid calls in
>>> general, as we otherwise lose all context validity checking in
>>> permissive mode.
>>>
>>> I think I'd rather change compute_sid behavior to preclude the situation
>>> from arising in the first place, possibly altering the behavior in
>>> permissive mode upon an invalid context to fall back on the ssid
>>> (process) or the tsid (object). But I'm not entirely convinced any
>>> change is required here.
>>>
>>>
>> I just want to follow up to make sure we are all on the same page here. Was the
>> suggestion to change avc_has_perm in libselinux or context_to_sid in the kernel
>> or leave the code as is and fix the callers of avc_has_perm to correctly handle
>> error codes?
>>
>> I prefer the last approach because of Eamon's explanation, EINVAL is already
>> passed in errno to specify the context was invalid (and if object managers
>> aren't handling that correctly now there is a good chance they aren't handling
>> the ENOMEM case either).
>>
>
> I'd be inclined to change compute_sid (not context_to_sid) in the kernel
> to prevent invalid contexts from being formed even in permissive mode
> (scenario is a type transition where role is not authorized for the new
> type). That was originally to allow the system to boot in permissive
> mode. But an alternative would be to just stay in the caller's context
> (ssid) in that situation.
>
> Changing the callers of avc_has_perm() to handle EINVAL and/or ENOMEM
> may make sense, but that logic should not depend on enforcing vs.
> permissive mode.
>
>
FWIW, the following patch to D-Bus should help:
bfo21072 - Log SELinux denials better by checking errno for the cause
Note that this does not fully address the bug report since
EINVAL can still be returned in permissive mode. However the log
messages will now reflect the proper cause of the denial.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov> Signed-off-by: Colin Walters <walters@verbum.org>
William Lachance [Tue, 21 Apr 2009 17:51:46 +0000 (13:51 -0400)]
Bug 19567 - Make marshaling code usable without DBusConnection
Some projects want to reuse the DBus message format, without
actually going through a DBusConnection. This set of changes
makes a few functions from DBusMessage public, and adds a new
function to determine the number of bytes needed to demarshal
a message.
Colin Walters [Wed, 1 Apr 2009 16:02:00 +0000 (12:02 -0400)]
Bug 17803 - Fix both test case and validation logic
The previous commit had errors in both the test case and
the validation logic. The test case was missing a trailing
comma before the previous one, so we weren't testing the
signature we thought we were.
The validation logic was wrong because if the type was not valid,
we'd drop through the entire if clause, and thus skip returning
an error code, and accept the signature.
Colin Walters [Wed, 25 Feb 2009 16:10:15 +0000 (11:10 -0500)]
Bug 20137 - Fix alignment usage when demarshaling basics
We can't safely type-pun from e.g. char * to DBusBasicValue *, because
the latter has higher alignment requirements. Instead, create an
explicit pointer for each case.
Also, we mark each one volatile to sidestep strict aliasing issues, for
the future when we turn on strict aliasing support.
Original patch and review from Jay Estabrook <jay.estabrook@hp.com>.
The AC_CANONICAL_TARGET macro and the $target_os variables are used for the
target of compilers and other code-generation tools, and should not be used
during cross-compile of generic software. Replace them with
AC_CANONICAL_HOST and $host_os instead, as they should have been from the
start.
For a breakdown of what host, build and target machines are, please see
http://blog.flameeyes.eu/s/canonical-target .
Colin Walters [Sat, 20 Dec 2008 01:02:14 +0000 (20:02 -0500)]
Enable -Werror by default with --enable-maintainer-mode, and change warnings
Important compiler warnings were being lost in the noise from warnings
we know about but aren't problems, and moreover made using -Werror
difficult. Now we expect *all* developers and testers to be using
-Werror.
The AC_CANONICAL_TARGET macro and the $target_os variables are used for the
target of compilers and other code-generation tools, and should not be used
during cross-compile of generic software. Replace them with
AC_CANONICAL_HOST and $host_os instead, as they should have been from the
start.
For a breakdown of what host, build and target machines are, please see
http://blog.flameeyes.eu/s/canonical-target .
Colin Walters [Sat, 20 Dec 2008 01:02:14 +0000 (20:02 -0500)]
Enable -Werror by default with --enable-maintainer-mode, and change warnings
Important compiler warnings were being lost in the noise from warnings
we know about but aren't problems, and moreover made using -Werror
difficult. Now we expect *all* developers and testers to be using
-Werror.
Colin Walters [Thu, 18 Dec 2008 00:29:39 +0000 (19:29 -0500)]
Add requested_reply to send denials, and connection loginfo to "would deny"
The requested_reply field is necessary in send denials too because
it's used in the policy language. The connection loginfo lack in
"would deny" was just an oversight.
Colin Walters [Wed, 17 Dec 2008 21:01:28 +0000 (16:01 -0500)]
Add uid, pid, and command to security logs
Extend the current security logs with even more relevant
information than just the message content. This requires
some utility code to look up and cache (as a string)
the data such as the uid/pid/command when a connection is
authenticated.
Colin Walters [Thu, 18 Dec 2008 00:29:39 +0000 (19:29 -0500)]
Add requested_reply to send denials, and connection loginfo to "would deny"
The requested_reply field is necessary in send denials too because
it's used in the policy language. The connection loginfo lack in
"would deny" was just an oversight.
Colin Walters [Wed, 17 Dec 2008 21:01:28 +0000 (16:01 -0500)]
Add uid, pid, and command to security logs
Extend the current security logs with even more relevant
information than just the message content. This requires
some utility code to look up and cache (as a string)
the data such as the uid/pid/command when a connection is
authenticated.
Colin Walters [Tue, 9 Dec 2008 14:15:06 +0000 (09:15 -0500)]
Bug 18229: Allow signals
Our previous fix went too far towards lockdown; many things rely
on signals to work, and there's no really good reason to restrict
which signals can be emitted on the bus because we can't tie
them to a particular sender.
projects / thirdparty / dbus.git / log
