wt/finit
1
0
Fork 0
mirror of https://github.com/troglobit/finit.git synced 2026-10-01 05:22:48 +07:00
Code Issues Packages Projects Releases Wiki Activity
Files
2e0b1d6f8b194ebc4c4d3fdb6bfb331a394b5557
finit/test/Makefile.am
T
Joachim Wiberg 63aabaa6df libink/dbus: identify the caller behind a broker 
On the local bus SO_PEERCRED says who is calling and the kernel is the
one saying it.  Behind a broker one connection carries every caller,
so that credential describes dbus-daemon and nothing else, and every
privileged method was refused there, root included.

Ask the bus driver instead.  libink parks the call and hands us the
sender; we ask GetConnectionUnixUser and answer when the reply lands,
through the same event loop as everything else.  Nothing blocks:
blocking in PID 1 is why libuEv exists.  That needs calls libink can
make on a connection it already has, so it gained those too.

Answers are cached, since a bus never reuses a unique name while it
runs.  Not across a restart though: a new dbus-daemon numbers from
scratch and :1.7 becomes somebody else, so the cache goes when the
broker does.  A sender name too long to key on is refused rather than
truncated, two callers sharing a truncated key would share an
identity.

Privilege is no longer uid 0 alone.  The socket is already owned by
the --with-group group, so refusing its members every method that
changes anything left a wheel user able to open the bus and unable to
reboot.  Both gates now say the same thing.

Group membership needs NSS, which the C library loads with dlopen(),
so the lookup is compiled out where Finit is built to link statically.
That leaves such a build root-only, which is worth saying out loud
rather than leaving to be discovered.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2026-08-13 10:15:06 +02:00

166 lines
5.6 KiB
Makefile
Raw Blame History

SUBDIRS = lib src
EXTRA_DIST = skel/bin/busybox-x86_64.sha256 skel/sbin/service.sh skel/etc/env \
skel/bin/pre.sh skel/bin/post.sh skel/bin/ready.sh skel/bin/slay \
skel/sbin/fail.sh skel/usr/share/runparts/ref.log \
skel/usr/share/runparts/sysv.log \
skel/etc/rc.d/foo.sh skel/etc/rc.d/S01abc.sh \
skel/etc/rc.d/test.sh skel/etc/rc.d/S02def.sh \
skel/etc/rcS.d/foo.sh skel/etc/rcS.d/test.sh \
skel/etc/rcS.d/S01abc.sh skel/etc/rcS.d/S02def.sh \
skel/cdrom/.empty skel/dev/shm/.empty skel/dev/pts/.empty \
skel/etc/inittab skel/etc/hostname skel/etc/fstab \
skel/etc/passwd skel/etc/group skel/etc/ld.so.conf \
skel/etc/init.d/rcS skel/etc/init.d/rcK skel/tmp/.empty \
skel/etc/finit.d/.empty skel/etc/finit.d/available/.empty \
skel/etc/finit.d/enabled/.empty \
skel/sbin/task.sh skel/bin/crasher.sh skel/bin/fail.sh \
skel/etc/init.d/S01-service.sh skel/etc/init.d/S02-serv.sh \
skel/proc/.empty skel/root/.empty skel/run/.empty \
skel/sbin/chrootsetup.sh skel/srv/.empty skel/sys/.empty \
skel/usr/bin/.empty skel/usr/lib/.empty skel/usr/sbin/.empty \
skel/home/.empty skel/usr/games/.empty skel/usr/src/.empty \
skel/usr/share/.empty skel/usr/include/.empty \
skel/usr/local/games/.empty skel/usr/local/sbin/.empty \
skel/usr/local/share/.empty skel/usr/local/src/.empty \
skel/usr/local/lib/.empty skel/usr/local/bin/.empty \
skel/usr/local/etc/.empty skel/var/.empty
EXTRA_DIST += setup-sysroot.sh
EXTRA_DIST += add-remove-dynamic-service.sh
EXTRA_DIST += add-remove-dynamic-service-sub-config.sh
EXTRA_DIST += bootstrap-crash.sh
EXTRA_DIST += cond-start-task.sh
EXTRA_DIST += conf-format.sh
EXTRA_DIST += conf-command.sh
EXTRA_DIST += conf-provides.sh
EXTRA_DIST += conf-tty.sh
EXTRA_DIST += conf-dup-title.sh
EXTRA_DIST += conf-dirs.sh
EXTRA_DIST += conf-if.sh
EXTRA_DIST += conf-template.sh
EXTRA_DIST += script-timeout.sh
EXTRA_DIST += crashing.sh
EXTRA_DIST += dep-chain-reload.sh
EXTRA_DIST += depserv.sh
EXTRA_DIST += devmon.sh
EXTRA_DIST += failing-sysv.sh
EXTRA_DIST += svc-env.sh
EXTRA_DIST += global-envs.sh
EXTRA_DIST += initctl-status-subset.sh
EXTRA_DIST += notify.sh
EXTRA_DIST += pidfile.sh
EXTRA_DIST += stale-pidfile.sh
EXTRA_DIST += pre-post-serv.sh
EXTRA_DIST += pre-fail.sh
EXTRA_DIST += process-depends.sh
EXTRA_DIST += rclocal.sh
EXTRA_DIST += ready-serv.sh
EXTRA_DIST += restart-self.sh
EXTRA_DIST += runlevel.sh
EXTRA_DIST += run-restart-forever.sh
EXTRA_DIST += run-task-tricks.sh
EXTRA_DIST += runparts.sh
EXTRA_DIST += sysvparts.sh
EXTRA_DIST += start-stop-service.sh
EXTRA_DIST += start-stop-service-sub-config.sh
EXTRA_DIST += start-kill-service.sh
EXTRA_DIST += start-kill-stop.sh
EXTRA_DIST += start-stop-sysv.sh
EXTRA_DIST += start-stop-serv.sh
EXTRA_DIST += signal-service.sh
EXTRA_DIST += testserv.sh
EXTRA_DIST += unexpected-restart.sh
EXTRA_DIST += dbus-auth.sh
EXTRA_DIST += dbus-authz.sh
EXTRA_DIST += dbus-bus.sh
EXTRA_DIST += dbus-manager.sh
EXTRA_DIST += dbus-service.sh
EXTRA_DIST += dbus-cond.sh
EXTRA_DIST += dbus-initctl.sh
EXTRA_DIST += dbus-introspect.sh
AM_TESTS_ENVIRONMENT = SYSROOT='$(abs_builddir)/sysroot/';
AM_TESTS_ENVIRONMENT += export SYSROOT;
AM_TESTS_ENVIRONMENT += export LD_LIBRARY_PATH;
AM_TESTS_ENVIRONMENT += top_builddir=$(top_builddir);
AM_TESTS_ENVIRONMENT += export top_builddir;
TEST_EXTENSIONS = .sh
TESTS = checkself.sh
TESTS += add-remove-dynamic-service.sh
TESTS += add-remove-dynamic-service-sub-config.sh
TESTS += bootstrap-crash.sh
TESTS += cond-start-task.sh
TESTS += conf-format.sh
TESTS += conf-command.sh
TESTS += conf-provides.sh
TESTS += conf-tty.sh
TESTS += conf-dup-title.sh
TESTS += conf-dirs.sh
TESTS += conf-if.sh
TESTS += conf-template.sh
TESTS += script-timeout.sh
TESTS += crashing.sh
TESTS += dep-chain-reload.sh
TESTS += depserv.sh
TESTS += devmon.sh
TESTS += failing-sysv.sh
TESTS += svc-env.sh
TESTS += global-envs.sh
TESTS += initctl-status-subset.sh
TESTS += notify.sh
TESTS += pidfile.sh
TESTS += stale-pidfile.sh
TESTS += pre-post-serv.sh
TESTS += pre-fail.sh
TESTS += process-depends.sh
TESTS += rclocal.sh
TESTS += ready-serv.sh
TESTS += restart-self.sh
TESTS += runlevel.sh
TESTS += sysvparts.sh
TESTS += run-restart-forever.sh
TESTS += run-task-tricks.sh
TESTS += runparts.sh
TESTS += start-stop-service.sh
TESTS += start-stop-service-sub-config.sh
TESTS += start-kill-service.sh
TESTS += start-kill-stop.sh
TESTS += start-stop-sysv.sh
TESTS += start-stop-serv.sh
TESTS += signal-service.sh
if TESTSERV
TESTS += testserv.sh
endif
TESTS += unexpected-restart.sh
if DBUS
TESTS += dbus-auth.sh
TESTS += dbus-authz.sh
TESTS += dbus-bus.sh
TESTS += dbus-manager.sh
TESTS += dbus-service.sh
TESTS += dbus-cond.sh
TESTS += dbus-initctl.sh
TESTS += dbus-introspect.sh
endif
check-recursive: setup-chroot
.PHONY: checkself.sh
checkself.sh:
@echo '#!/bin/sh' > $@
@echo 'set -eu' >> $@
@echo 'cd "$$srcdir" 2>/dev/null || cd "." || exit 1' >> $@
@echo 'TESTS="$(filter %.sh,$(filter-out $@, $(TESTS)))"' >> $@
@echo 'shellcheck $$TESTS' >> $@
@chmod 0755 $@
.PHONY: setup-chroot
setup-chroot:
@SYSROOT='$(abs_builddir)/sysroot/' srcdir=$(srcdir) top_builddir=$(top_builddir) $(srcdir)/setup-sysroot.sh
clean-local:
-rm -rf $(builddir)/sysroot/
-rm -f checkself.sh
Reference in New Issue View Git Blame Copy Permalink