diff options
| author | Tyler Hicks <tyhicks@canonical.com> | 2014-02-13 13:17:23 -0600 |
|---|---|---|
| committer | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2015-02-18 18:59:46 +0000 |
| commit | 66979aae614eef97a30a9cad1ab4c77f277b63f4 (patch) | |
| tree | c250163990c366458787a3b10407693afd85c069 /bus/apparmor.h | |
| parent | d9a2fdb96adf18d6876406a6cd4335b802d66af7 (diff) | |
| download | dbus-66979aae614eef97a30a9cad1ab4c77f277b63f4.tar.gz | |
Mediation of processes eavesdropping
When an AppArmor confined process wants to eavesdrop on a bus, a check
is performed to see if the action should be allowed.
The check is based on the connection's label and the bus type.
This patch adds a new hook, which was not previously included in the
SELinux mediation, to mediate eavesdropping from
bus_driver_handle_add_match().
A new function is added to bus/signals.c to see if a match rule is an
eavesdropping rule since the rule flags field is private to signals.c.
An example AppArmor rule that would allow a process to eavesdrop on the
session bus would be:
dbus eavesdrop bus=session,
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Diffstat (limited to 'bus/apparmor.h')
| -rw-r--r-- | bus/apparmor.h | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/bus/apparmor.h b/bus/apparmor.h index 3f3d6469..4a47aecc 100644 --- a/bus/apparmor.h +++ b/bus/apparmor.h @@ -59,4 +59,8 @@ dbus_bool_t bus_apparmor_allows_send (DBusConnection *sender, const char *source, DBusError *error); +dbus_bool_t bus_apparmor_allows_eavesdropping (DBusConnection *connection, + const char *bustype, + DBusError *error); + #endif /* BUS_APPARMOR_H */ |