Cross Reference: /systemd/src/bus-proxyd/proxy.c

Lines Matching defs:policy
37 #include "bus-xml-policy.h"
308         Policy *policy;
314         /* no need to load legacy policy if destination is not kdbus */
318         p->policy = sp;
320         policy = shared_policy_acquire(sp);
321         if (policy) {
322                 /* policy already pre-loaded */
323                 shared_policy_release(sp, policy);
349                         return log_error("Unknown scope %s, don't know which policy to load. Refusing.", scope);
361         Policy *policy;
366         if (!p->policy)
369         policy = shared_policy_acquire(p->policy);
373         else if (policy_check_hello(policy, p->local_creds.uid, p->local_creds.gid))
374                 log_debug("Permitting access due to XML policy.");
378         shared_policy_release(p->policy, policy);
450 static int process_policy_unlocked(sd_bus *from, sd_bus *to, sd_bus_message *m, Policy *policy, const struct ucred *our_ucred, Set *owned_names) {
457         if (!policy)
466          * ignore any policy on those and let the kernel deal with it.
468          * TODO: To be correct, we should only ignore policy-tags that are
470          * tags so we let everything pass. I haven't seen a DENY policy tag on
510                 if (policy_check_send(policy, sender_uid, sender_gid, m->header->type, owned_names, NULL, m->path, m->interface, m->member, false, NULL) &&
511                     policy_check_recv(policy, our_ucred->uid, our_ucred->gid, m->header->type, NULL, sender_names, m->path, m->interface, m->member, false))
516                         return synthetic_reply_method_errorf(m, SD_BUS_ERROR_ACCESS_DENIED, "Access prohibited by XML receiver policy.");
560                          * the message. Therefore, skip policy checks in this
563                 } else if (policy_check_send(policy, our_ucred->uid, our_ucred->gid, m->header->type, NULL, destination_names, m->path, m->interface, m->member, true, &n)) {
566                                  * name's policy we used, and to which unique ID it
581                         if (policy_check_recv(policy, destination_uid, destination_gid, m->header->type, owned_names, NULL, m->path, m->interface, m->member, true))
587                         return synthetic_reply_method_errorf(m, SD_BUS_ERROR_ACCESS_DENIED, "Access prohibited by XML sender policy.");
597         Policy *policy;
602         policy = shared_policy_acquire(sp);
603         r = process_policy_unlocked(from, to, m, policy, our_ucred, owned_names);
604         shared_policy_release(sp, policy);
779         if (p->policy) {
780                 r = process_policy(p->destination_bus, p->local_bus, m, p->policy, &p->local_creds, p->owned_names);
784                         return log_error_errno(r, "Failed to process policy: %m");
862         r = bus_proxy_process_driver(p, p->destination_bus, p->local_bus, m, p->policy, &p->local_creds, p->owned_names);
871                 if (p->policy) {
872                         r = process_policy(p->local_bus, p->destination_bus, m, p->policy, &p->local_creds, p->owned_names);
876                                 return log_error_errno(r, "Failed to process policy: %m");
886                         /* The name database changed since the policy check, hence let's check again */