openbmc/build/tmp/deploy/sdk/witherspoon-2019-08-08/sysroots/armv6-openbmc-linux-gnueabi/usr/src/debug/dbus/1.12.16-r0/dbus-1.12.16/bus/apparmor.c
dbus_bool_t bus_apparmor_allows_acquire_service(DBusConnection* connection,
                                                const char* bustype,
                                                const char* service_name,
                                                DBusError* error)
{

#ifdef HAVE_APPARMOR
    BusAppArmorConfinement* con = NULL;
    DBusString qstr, auxdata;
    dbus_bool_t free_auxdata = FALSE;
    /* the AppArmor API uses pointers to int for pointers to boolean, and
     * int is not strictly guaranteed to be the same as dbus_bool_t */
    int allow = FALSE, audit = TRUE;
    unsigned long pid;
    int res, serrno = 0;

    if (!apparmor_enabled)
        return TRUE;

    _dbus_assert(connection != NULL);

    con = bus_connection_dup_apparmor_confinement(connection);

    if (is_unconfined(con->label, con->mode))
    {
        allow = TRUE;
        audit = FALSE;
        goto out;
    }

    if (!_dbus_string_init(&qstr))
        goto oom;

    if (!build_service_query(&qstr, con->label, bustype, service_name))
    {
        _dbus_string_free(&qstr);
        goto oom;
    }

    res = aa_query_label(AA_DBUS_BIND, _dbus_string_get_data(&qstr),
                         _dbus_string_get_length(&qstr), &allow, &audit);
    _dbus_string_free(&qstr);
    if (res == -1)
    {
        serrno = errno;
        set_error_from_query_errno(error, serrno);
        goto audit;
    }

    /* Don't fail operations on profiles in complain mode */
    if (modestr_is_complain(con->mode))
        allow = TRUE;

    if (!allow)
        dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED,
                       "Connection \"%s\" is not allowed to own the service "
                       "\"%s\" due to AppArmor policy",
                       bus_connection_is_active(connection)
                           ? bus_connection_get_name(connection)
                           : "(inactive)",
                       service_name);

    if (!audit)
        goto out;

audit:
    if (!_dbus_string_init(&auxdata))
        goto oom;
    free_auxdata = TRUE;

    if (!_dbus_append_pair_str(&auxdata, "bus", bustype ? bustype : "unknown"))
        goto oom;

    if (!_dbus_append_pair_str(&auxdata, "name", service_name))
        goto oom;

    if (serrno && !_dbus_append_pair_str(&auxdata, "info", strerror(serrno)))
        goto oom;

    if (!_dbus_append_mask(&auxdata, AA_DBUS_BIND))
        goto oom;

    if (connection && dbus_connection_get_unix_process_id(connection, &pid) &&
        !_dbus_append_pair_uint(&auxdata, "pid", pid))
        goto oom;

    if (con->label && !_dbus_append_pair_str(&auxdata, "label", con->label))
        goto oom;

    log_message(allow, "bind", &auxdata);

out:
    if (con != NULL)
        bus_apparmor_confinement_unref(con);
    if (free_auxdata)
        _dbus_string_free(&auxdata);
    return allow;

oom:
    if (error != NULL && !dbus_error_is_set(error))
        BUS_SET_OOM(error);
    allow = FALSE;
    goto out;

#else
    return TRUE;
#endif /* HAVE_APPARMOR */
}
/**
 * Returns true if the given connection can acquire a service,
 * using the tasks security context
 *
 * @param connection connection that wants to own the service
 * @param bustype name of the bus
 * @param service_name the name of the service to acquire
 * @param error the reason for failure when FALSE is returned
 * @returns TRUE if acquire is permitted
 */
Returns true if the given connection can acquire a service,
using the tasks security context


Returns true if the given connection can acquire a service using the tasks security context
dbus_bool_t bus_apparmor_allows_acquire_service(DBusConnection* connection,
                                                const char* bustype,
                                                const char* service_name,
                                                DBusError* error)
{
#ifdef HAVE_APPARMOR
    BusAppArmorConfinement* con = NULL;
    DBusString qstr, auxdata;
    dbus_bool_t free_auxdata = FALSE;
    int allow = FALSE, audit = TRUE;
    unsigned long pid;
    int res, serrno = 0;
    if (!apparmor_enabled)
        return TRUE;
    _dbus_assert(connection != NULL);
    con = bus_connection_dup_apparmor_confinement(connection);
    if (is_unconfined(con->label, con->mode))
    {
        allow = TRUE;
        audit = FALSE;
        goto out;
    }
    if (!_dbus_string_init(&qstr))
        goto oom;
    if (!build_service_query(&qstr, con->label, bustype, service_name))
    {
        _dbus_string_free(&qstr);
        goto oom;
    }
    res = aa_query_label(AA_DBUS_BIND, _dbus_string_get_data(&qstr),
                         _dbus_string_get_length(&qstr), &allow, &audit);
    _dbus_string_free(&qstr);
    if (res == -1)
    {
        serrno = errno;
        set_error_from_query_errno(error, serrno);
        goto audit;
    }
    if (modestr_is_complain(con->mode))
        allow = TRUE;
    if (!allow)
        dbus_set_error(error, DBUS_ERROR_ACCESS_DENIED,
                       "Connection \"%s\" is not allowed to own the service "
                       "\"%s\" due to AppArmor policy",
                       bus_connection_is_active(connection)
                           ? bus_connection_get_name(connection)
                           : "(inactive)",
                       service_name);
    if (!audit)
        goto out;
audit:
    if (!_dbus_string_init(&auxdata))
        goto oom;
    free_auxdata = TRUE;
    if (!_dbus_append_pair_str(&auxdata, "bus", bustype ? bustype : "unknown"))
        goto oom;
    if (!_dbus_append_pair_str(&auxdata, "name", service_name))
        goto oom;
    if (serrno && !_dbus_append_pair_str(&auxdata, "info", strerror(serrno)))
        goto oom;
    if (!_dbus_append_mask(&auxdata, AA_DBUS_BIND))
        goto oom;
    if (connection && dbus_connection_get_unix_process_id(connection, &pid) &&
        !_dbus_append_pair_uint(&auxdata, "pid", pid))
        goto oom;
    if (con->label && !_dbus_append_pair_str(&auxdata, "label", con->label))
        goto oom;
    log_message(allow, "bind", &auxdata);
out:
    if (con != NULL)
        bus_apparmor_confinement_unref(con);
    if (free_auxdata)
        _dbus_string_free(&auxdata);
    return allow;
oom:
    if (error != NULL && !dbus_error_is_set(error))
        BUS_SET_OOM(error);
    allow = FALSE;
    goto out;
#else
    return TRUE;
#endif 
}
dbus_bool_t bus_apparmor_allows_acquire_service ( DBusConnection * connection , const char * bustype , const char * service_name , DBusError * error ) { #ifdef HAVE_APPARMOR BusAppArmorConfinement * con = NULL ; DBusString qstr , auxdata ; dbus_bool_t free_auxdata = FALSE ; int allow = FALSE , audit = TRUE ; unsigned long pid ; int res , serrno = 0 ; if ( ! apparmor_enabled ) return TRUE ; _dbus_assert ( connection != NULL ) ; con = bus_connection_dup_apparmor_confinement ( connection ) ; if ( is_unconfined ( con -> label , con -> mode ) ) { allow = TRUE ; audit = FALSE ; goto out ; } if ( ! _dbus_string_init ( & qstr ) ) goto oom ; if ( ! build_service_query ( & qstr , con -> label , bustype , service_name ) ) { _dbus_string_free ( & qstr ) ; goto oom ; } res = aa_query_label ( AA_DBUS_BIND , _dbus_string_get_data ( & qstr ) , _dbus_string_get_length ( & qstr ) , & allow , & audit ) ; _dbus_string_free ( & qstr ) ; if ( res == -1 ) { serrno = errno ; set_error_from_query_errno ( error , serrno ) ; goto audit ; } if ( modestr_is_complain ( con -> mode ) ) allow = TRUE ; if ( ! allow ) dbus_set_error ( error , DBUS_ERROR_ACCESS_DENIED , " \" \" " " \" \" " , bus_connection_is_active ( connection ) ? bus_connection_get_name ( connection ) : " " , service_name ) ; if ( ! audit ) goto out ; audit : if ( ! _dbus_string_init ( & auxdata ) ) goto oom ; free_auxdata = TRUE ; if ( ! _dbus_append_pair_str ( & auxdata , " " , bustype ? bustype : " " ) ) goto oom ; if ( ! _dbus_append_pair_str ( & auxdata , " " , service_name ) ) goto oom ; if ( serrno && ! _dbus_append_pair_str ( & auxdata , " " , strerror ( serrno ) ) ) goto oom ; if ( ! _dbus_append_mask ( & auxdata , AA_DBUS_BIND ) ) goto oom ; if ( connection && dbus_connection_get_unix_process_id ( connection , & pid ) && ! _dbus_append_pair_uint ( & auxdata , " " , pid ) ) goto oom ; if ( con -> label && ! _dbus_append_pair_str ( & auxdata , " " , con -> label ) ) goto oom ; log_message ( allow , " " , & auxdata ) ; out : if ( con != NULL ) bus_apparmor_confinement_unref ( con ) ; if ( free_auxdata ) _dbus_string_free ( & auxdata ) ; return allow ; oom : if ( error != NULL && ! dbus_error_is_set ( error ) ) BUS_SET_OOM ( error ) ; allow = FALSE ; goto out ; #else return TRUE ; #endif }
Returns true if the given connection can acquire a service,
 using the tasks security context
Returns true if the given connection can acquire a service using the tasks security context
/* the AppArmor API uses pointers to int for pointers to boolean, and
     * int is not strictly guaranteed to be the same as dbus_bool_t */ /* Don't fail operations on profiles in complain mode */ /* HAVE_APPARMOR */