提交 64a5dc1b 编写于 作者: D Daniel P. Berrange

Convert callers to use typesafe APIs for getting identity attrs

Convert virAccessDriverPolkitFormatProcess to use typesafe API
for getting process ID attribute.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
上级 5282ed8d
...@@ -75,9 +75,9 @@ static char * ...@@ -75,9 +75,9 @@ static char *
virAccessDriverPolkitFormatProcess(const char *actionid) virAccessDriverPolkitFormatProcess(const char *actionid)
{ {
virIdentityPtr identity = virIdentityGetCurrent(); virIdentityPtr identity = virIdentityGetCurrent();
const char *callerPid = NULL; pid_t pid;
const char *callerTime = NULL; unsigned long long startTime;
const char *callerUid = NULL; uid_t uid;
char *ret = NULL; char *ret = NULL;
#ifndef PKCHECK_SUPPORTS_UID #ifndef PKCHECK_SUPPORTS_UID
static bool polkitInsecureWarned; static bool polkitInsecureWarned;
...@@ -89,39 +89,35 @@ virAccessDriverPolkitFormatProcess(const char *actionid) ...@@ -89,39 +89,35 @@ virAccessDriverPolkitFormatProcess(const char *actionid)
actionid); actionid);
return NULL; return NULL;
} }
if (virIdentityGetAttr(identity, VIR_IDENTITY_ATTR_UNIX_PROCESS_ID, &callerPid) < 0) if (virIdentityGetUNIXProcessID(identity, &pid) < 0)
goto cleanup; goto cleanup;
if (virIdentityGetAttr(identity, VIR_IDENTITY_ATTR_UNIX_PROCESS_TIME, &callerTime) < 0) if (virIdentityGetUNIXProcessTime(identity, &startTime) < 0)
goto cleanup; goto cleanup;
if (virIdentityGetAttr(identity, VIR_IDENTITY_ATTR_UNIX_USER_ID, &callerUid) < 0) if (virIdentityGetUNIXUserID(identity, &uid) < 0)
goto cleanup; goto cleanup;
if (!callerPid) { if (!pid) {
virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", virAccessError(VIR_ERR_INTERNAL_ERROR, "%s",
_("No UNIX process ID available")); _("No UNIX process ID available"));
goto cleanup; goto cleanup;
} }
if (!callerTime) { if (!startTime) {
virAccessError(VIR_ERR_INTERNAL_ERROR, "%s", virAccessError(VIR_ERR_INTERNAL_ERROR, "%s",
_("No UNIX process start time available")); _("No UNIX process start time available"));
goto cleanup; goto cleanup;
} }
if (!callerUid) {
virAccessError(VIR_ERR_INTERNAL_ERROR, "%s",
_("No UNIX caller UID available"));
goto cleanup;
}
#ifdef PKCHECK_SUPPORTS_UID #ifdef PKCHECK_SUPPORTS_UID
if (virAsprintf(&ret, "%s,%s,%s", callerPid, callerTime, callerUid) < 0) if (virAsprintf(&ret, "%llu,%llu,%llu",
(unsigned long long)pid, startTime, (unsigned long long)uid) < 0)
goto cleanup; goto cleanup;
#else #else
if (!polkitInsecureWarned) { if (!polkitInsecureWarned) {
VIR_WARN("No support for caller UID with pkcheck. " VIR_WARN("No support for caller UID with pkcheck. This deployment is known to be insecure.");
"This deployment is known to be insecure.");
polkitInsecureWarned = true; polkitInsecureWarned = true;
} }
if (virAsprintf(&ret, "%s,%s", callerPid, callerTime) < 0) if (virAsprintf(&ret, "%llu,%llu",
(unsigned long long)pid, startTime) < 0)
goto cleanup; goto cleanup;
#endif #endif
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册