Repository : http://git.fedorahosted.org/cgit/firewalld-recode.git
On branch : master
commit 724a69b175b711117b855e94b0851d1dff8eb5ea Author: Daniel Kopecek dkopecek@redhat.com Date: Wed Jan 21 13:21:54 2015 +0100
Added implementation of the DBus policies interface
Makefile.am | 25 +++++- .../addLockdownWhitelistCommand.cpp} | 21 ++--- .../addLockdownWhitelistContext.cpp} | 21 ++--- .../addLockdownWhitelistUid.cpp} | 21 ++--- .../addLockdownWhitelistUser.cpp} | 21 ++--- .../disableLockdown.cpp} | 16 +-- .../enableLockdown.cpp} | 16 +-- .../getLockdownWhitelistCommands.cpp} | 15 +-- .../getLockdownWhitelistContexts.cpp} | 15 +-- .../getLockdownWhitelistUids.cpp} | 20 ++-- .../getLockdownWhitelistUsers.cpp} | 15 +-- src/Daemon/DBus/policies/methods.decl | 23 +++++ .../queryLockdown.cpp} | 11 ++- .../queryLockdownWhitelistCommand.cpp} | 15 +-- .../queryLockdownWhitelistContext.cpp} | 15 +-- .../queryLockdownWhitelistUid.cpp} | 16 +-- .../queryLockdownWhitelistUser.cpp} | 15 +-- .../removeLockdownWhitelistCommand.cpp} | 19 ++-- .../removeLockdownWhitelistContext.cpp} | 19 ++-- .../removeLockdownWhitelistUid.cpp} | 20 ++-- .../removeLockdownWhitelistUser.cpp} | 19 ++-- src/Daemon/FirewallD.cpp | 21 ++++- src/Daemon/FirewallD.hpp | 8 +- src/Daemon/LockdownWhitelist.cpp | 103 +++++++++++++++++--- src/Daemon/LockdownWhitelist.hpp | 60 ++++++++++-- 25 files changed, 337 insertions(+), 233 deletions(-)
diff --git a/Makefile.am b/Makefile.am index 631cd70..ac15f15 100644 --- a/Makefile.am +++ b/Makefile.am @@ -28,7 +28,8 @@ noinst_LTLIBRARIES =\ librichrules.la \ libdbus_main.la \ libdbus_zone.la \ - libdbus_direct.la + libdbus_direct.la \ + libdbus_policies.la
sbin_PROGRAMS=\ firewalld @@ -192,6 +193,27 @@ libdbus_zone_la_LIBADD=\ $(top_builddir)/librichrules.la \ $(top_builddir)/libfirewall.la
+libdbus_policies_la_SOURCES=\ + src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/disableLockdown.cpp \ + src/Daemon/DBus/policies/enableLockdown.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp \ + src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp \ + src/Daemon/DBus/policies/queryLockdown.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp \ + src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp + firewalld_SOURCES=\ src/Daemon/Exceptions.hpp \ src/Daemon/CLI.cpp \ @@ -217,5 +239,6 @@ firewalld_LDADD=\ $(top_builddir)/libdbus_main.la \ $(top_builddir)/libdbus_zone.la \ $(top_builddir)/libdbus_direct.la \ + $(top_builddir)/libdbus_policies.la \ @pthread_LIBS@ \ @giomm_LIBS@ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp index 3f87d05..a325396 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addCommand(command); + _dbus.broadcastSignal("LockdownWhitelistCommandAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp similarity index 70% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp index 3f87d05..0e3a17c 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addSEContext(context); + _dbus.broadcastSignal("LockdownWhitelistContextAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/disablePanicMode.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp similarity index 73% copy from src/Daemon/DBus/disablePanicMode.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp index d001ae8..8738c94 100644 --- a/src/Daemon/DBus/disablePanicMode.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,20 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,disablePanicMode) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid) { result.setTypeSignature("()"); - - if (panicMode()) { - try { - setPanicMode(false); - } catch(...) { - result = DBusError("COMMAND_FAILED", "Unable to disable panic mode"); - } - } else { - result = DBusError("NOT_ENABLED", "Panic mode not enabled"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; + try { + _lockdown_whitelist.addUID(uid); + } catch(const FirewallError& ex) { + result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp index 3f87d05..dda4c18 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/addLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); - } - catch(const FirewallError& ex) { + _lockdown_whitelist.addUsername(username); + _dbus.broadcastSignal("LockdownWhitelistUserAdded", DBUS_INTERFACE_POLICIES, parameters); + } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/disableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/disableLockdown.cpp index 89b4cef..f89e026 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/disableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,disableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/false); + _dbus.broadcastSignal("LockdownDisabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/enableLockdown.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/enableLockdown.cpp index 89b4cef..0318c97 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/enableLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,16 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,enableLockdown) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("()"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + setLockdownMode(/*enable=*/true); + _dbus.broadcastSignal("LockdownEnabled", DBUS_INTERFACE_POLICIES, parameters); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp index 89b4cef..7f21efa 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistCommands.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getCommands(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp similarity index 77% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp index 89b4cef..65cb460 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistContexts.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getSEContexts(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp similarity index 72% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp index 3f87d05..51300ce 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUids.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("(ai)"); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + std::vector<uid_t> uid_vector = _lockdown_whitelist.getUIDs(); + std::vector<gint> uid_integers; + for (auto const& uid : uid_vector) { + uid_integers.push_back((gint)uid); + } + result = uid_integers; } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfSource.cpp b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp similarity index 76% copy from src/Daemon/DBus/zone/getZoneOfSource.cpp copy to src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp index 89b4cef..608a9f4 100644 --- a/src/Daemon/DBus/zone/getZoneOfSource.cpp +++ b/src/Daemon/DBus/policies/getLockdownWhitelistUsers.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,15 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfSource) + FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers) { - result.setTypeSignature("(s)"); - - UString source_spec; - - parameters.get(0, source_spec); - + result.setTypeSignature("(as)"); try { - Pointer<Zone> zone = _fw.getSource(source_spec).getZone(); - result = zone->identifier(); + result = _lockdown_whitelist.getUsernames(); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/policies/methods.decl b/src/Daemon/DBus/policies/methods.decl index e69de29..0a6690e 100644 --- a/src/Daemon/DBus/policies/methods.decl +++ b/src/Daemon/DBus/policies/methods.decl @@ -0,0 +1,23 @@ +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistCommands); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistContexts); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUsers); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser); + +FIREWALLD_DBUS_METHOD(1,policies,addLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid); +FIREWALLD_DBUS_METHOD(1,policies,getLockdownWhitelistUids); +FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid); + +FIREWALLD_DBUS_METHOD(1,policies,enableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,disableLockdown); +FIREWALLD_DBUS_METHOD(1,policies,queryLockdown); diff --git a/src/Daemon/DBus/queryPanicMode.cpp b/src/Daemon/DBus/policies/queryLockdown.cpp similarity index 81% copy from src/Daemon/DBus/queryPanicMode.cpp copy to src/Daemon/DBus/policies/queryLockdown.cpp index a4b632a..49ac76b 100644 --- a/src/Daemon/DBus/queryPanicMode.cpp +++ b/src/Daemon/DBus/policies/queryLockdown.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,10 +22,15 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,,queryPanicMode) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdown) { result.setTypeSignature("(b)"); - result = panicMode(); + try { + result = lockdownMode(); + } + catch(const FirewallError& ex) { + result = DBusError(ex); + } return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp index 9137ba4..9b73e6b 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistCommand) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString command; + parameters.get(0, command); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.commandInList(command); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp index 9137ba4..24513e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistContext) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.SEContextInList(context); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp index 9137ba4..6a739e9 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,18 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUid) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UIDInList(uid); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp similarity index 77% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp index 9137ba4..36bd4fa 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/queryLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,17 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,queryLockdownWhitelistUser) { result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + UString username; + parameters.get(0, username); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + result = _lockdown_whitelist.UsernameInList(username); } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp index 3f87d05..8753fe5 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistCommand.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistCommand) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString command; + parameters.get(0, command); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeCommand(command)) { + _dbus.broadcastSignal("LockdownWhitelistCommandRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/isImmutable.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp similarity index 72% copy from src/Daemon/DBus/zone/isImmutable.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp index 9137ba4..9b76ae2 100644 --- a/src/Daemon/DBus/zone/isImmutable.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistContext.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,isImmutable) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistContext) { - result.setTypeSignature("(b)"); - - UString zone_name; - - parameters.get(0, zone_name); - + result.setTypeSignature("()"); + UString context; + parameters.get(0, context); try { - Pointer<const Zone> zone = _fw.getZone(zone_name.empty() ? _fw.getDefaultZoneName() : zone_name); - result = zone->isImmutable(); + if (_lockdown_whitelist.removeSEContext(context)) { + _dbus.broadcastSignal("LockdownWhitelistContextRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp similarity index 71% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp index 3f87d05..12814d2 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUid.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,20 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUid) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + gint uid_integer; + parameters.get(0, uid_integer); + uid_t uid = (uid_t)uid_integer; try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUID(uid)) { + _dbus.broadcastSignal("LockdownWhitelistUidRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/DBus/zone/getZoneOfInterface.cpp b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp similarity index 73% copy from src/Daemon/DBus/zone/getZoneOfInterface.cpp copy to src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp index 3f87d05..c09361d 100644 --- a/src/Daemon/DBus/zone/getZoneOfInterface.cpp +++ b/src/Daemon/DBus/policies/removeLockdownWhitelistUser.cpp @@ -1,5 +1,5 @@ // -// Copyright (C) 2014 Red Hat, Inc. +// Copyright (C) 2015 Red Hat, Inc. // // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by @@ -22,22 +22,19 @@
namespace firewalld { - FIREWALLD_DBUS_METHOD(1,zone,getZoneOfInterface) + FIREWALLD_DBUS_METHOD(1,policies,removeLockdownWhitelistUser) { - result.setTypeSignature("(s)"); - - UString interface_identifier; - - parameters.get(0, interface_identifier); - + result.setTypeSignature("()"); + UString username; + parameters.get(0, username); try { - Pointer<Zone> zone = _fw.getInterface(interface_identifier).getZone(); - result = zone->identifier(); + if (_lockdown_whitelist.removeUsername(username)) { + _dbus.broadcastSignal("LockdownWhitelistUserRemoved", DBUS_INTERFACE_POLICIES, parameters); + } } catch(const FirewallError& ex) { result = DBusError(ex); } - return; } } /* namespace firewalld */ diff --git a/src/Daemon/FirewallD.cpp b/src/Daemon/FirewallD.cpp index 40feef2..3deb556 100644 --- a/src/Daemon/FirewallD.cpp +++ b/src/Daemon/FirewallD.cpp @@ -148,11 +148,28 @@ namespace firewalld } }
- void FirewallD::setPanicMode(bool panic_mode) + bool FirewallD::panicMode() const + { + return _panic_mode; + } + + void FirewallD::setPanicMode(bool enable) { // Set the panic mode // Signal on dbus - _panic_mode = panic_mode; + _panic_mode = enable; + } + + bool FirewallD::lockdownMode() const + { + return _lockdown_mode; + } + + void FirewallD::setLockdownMode(bool enable) + { + // Set the lockdown mode + // Signal on dbus + _lockdown_mode = enable; }
Pointer<Service> FirewallD::lookupService(const UString& name) const diff --git a/src/Daemon/FirewallD.hpp b/src/Daemon/FirewallD.hpp index 33b2f4d..d14f5fa 100644 --- a/src/Daemon/FirewallD.hpp +++ b/src/Daemon/FirewallD.hpp @@ -69,8 +69,11 @@ namespace firewalld */ void loadDefinitions();
- bool panicMode() const { return _panic_mode; } - void setPanicMode(bool panic_mode); + bool panicMode() const; + void setPanicMode(bool enable); + + bool lockdownMode() const; + void setLockdownMode(bool enable);
/** * Return reference to the Service object definitions. @@ -215,6 +218,7 @@ namespace firewalld PointerMap<UString,ICMPType> _defined_icmptypes;
bool _panic_mode; + bool _lockdown_mode;
DBusMethodTable _dbus_method_table; std::mutex _dbus_method_mutex; diff --git a/src/Daemon/LockdownWhitelist.cpp b/src/Daemon/LockdownWhitelist.cpp index 4fcd1ef..d05816f 100644 --- a/src/Daemon/LockdownWhitelist.cpp +++ b/src/Daemon/LockdownWhitelist.cpp @@ -35,42 +35,87 @@ namespace firewalld LOG(DEBUG) << "Added SELinux context "" << secontext << "" to lockdown whitelist"; }
+ bool LockdownWhitelist::SEContextInList(const UString& secontext) const + { + return (_secontexts.count(secontext) == 1); + } + + bool LockdownWhitelist::removeSEContext(const UString& secontext) + { + return (_secontexts.erase(secontext) > 0); + } + + UStringVector LockdownWhitelist::getSEContexts() const + { + UStringVector contexts; + for (auto const& map_entry : _secontexts) { + contexts.push_back(map_entry.first); + } + return std::move(contexts); + } + void LockdownWhitelist::addUsername(const UString& username) { _usernames[username] = true; LOG(DEBUG) << "Added username "" << username << "" to lockdown whitelist"; }
+ bool LockdownWhitelist::UsernameInList(const UString& username) const + { + return (_usernames.count(username) == 1); + } + + bool LockdownWhitelist::removeUsername(const UString& username) + { + return (_usernames.erase(username) > 0); + } + + UStringVector LockdownWhitelist::getUsernames() const + { + UStringVector usernames; + for (auto const& map_entry : _usernames) { + usernames.push_back(map_entry.first); + } + return std::move(usernames); + } + void LockdownWhitelist::addUID(uid_t uid) { _uids[uid] = true; LOG(DEBUG) << "Added UID "" << uid << "" to lockdown whitelist"; }
- void LockdownWhitelist::addCommand(const UString& command) + bool LockdownWhitelist::UIDInList(uid_t uid) const { - if (command[command.length() - 1] == '*') { - _commands_partial.push_back(command); - LOG(DEBUG) << "Added command pattern "" << command << "" to lockdown whitelist"; - } else { - _commands_full[command] = true; - LOG(DEBUG) << "Added command "" << command << "" to lockdown whitelist"; - } + return (_uids.count(uid) == 1); }
- bool LockdownWhitelist::SEContextInList(const UString& secontext) const + bool LockdownWhitelist::removeUID(uid_t uid) { - return (_secontexts.count(secontext) == 1); + return (_uids.erase(uid) > 0); }
- bool LockdownWhitelist::UsernameInList(const UString& username) const + std::vector<uid_t> LockdownWhitelist::getUIDs() const { - return (_usernames.count(username) == 1); + std::vector<uid_t> uid_vector; + for (auto const& map_entry : _uids) { + uid_vector.push_back(map_entry.first); + } + return std::move(uid_vector); }
- bool LockdownWhitelist::UIDInList(uid_t uid) const + void LockdownWhitelist::addCommand(const UString& command) { - return (_uids.count(uid) == 1); + if (command.length() < 1) { + return; + } + if (command[command.length() - 1] == '*') { + _commands_partial.push_back(command); + LOG(DEBUG) << "Added command pattern "" << command << "" to lockdown whitelist"; + } else { + _commands_full[command] = true; + LOG(DEBUG) << "Added command "" << command << "" to lockdown whitelist"; + } }
bool LockdownWhitelist::commandInList(const UString& command) const @@ -88,6 +133,36 @@ namespace firewalld return false; }
+ bool LockdownWhitelist::removeCommand(const UString& command) + { + if (command.length() < 1) { + return false; + } + if (command[command.length() - 1] == '*') { + for (auto it = _commands_partial.begin(); it != _commands_partial.end(); ++it) { + if (*it == command) { + _commands_partial.erase(it); + return true; + } + } + return false; + } else { + return (_commands_full.erase(command) > 0); + } + } + + UStringVector LockdownWhitelist::getCommands() const + { + UStringVector commands; + for (auto const& map_entry : _commands_full) { + commands.push_back(map_entry.first); + } + for (auto const& command : _commands_partial) { + commands.push_back(command); + } + return std::move(commands); + } + void LockdownWhitelist::clear() { _secontexts.clear(); diff --git a/src/Daemon/LockdownWhitelist.hpp b/src/Daemon/LockdownWhitelist.hpp index 525938f..7860d13 100644 --- a/src/Daemon/LockdownWhitelist.hpp +++ b/src/Daemon/LockdownWhitelist.hpp @@ -34,34 +34,44 @@ namespace firewalld LockdownWhitelist();
/** + * Add a SELinux context to the list. + */ + void addSEContext(const UString& secontext); + + /** * Check is the given SELinux context is in the list. */ bool SEContextInList(const UString& secontext) const;
/** - * Check if the given username is in the list. + * Remove a SELinux context from the list. */ - bool UsernameInList(const UString& username) const; + bool removeSEContext(const UString& secontext);
/** - * Check if the given UID is in the list. + * Return a vector of SELinux contexts. */ - bool UIDInList(uid_t uid) const; + UStringVector getSEContexts() const;
/** - * Check if the given command is in the list. + * Add a username to the list. */ - bool commandInList(const UString& command) const; + void addUsername(const UString& username);
/** - * Add a SELinux context to the list. + * Check if the given username is in the list. */ - void addSEContext(const UString& secontext); + bool UsernameInList(const UString& username) const;
/** - * Add a username to the list. + * Remove a username from the list. */ - void addUsername(const UString& username); + bool removeUsername(const UString& username); + + /** + * Get a vector of all username from the list. + */ + UStringVector getUsernames() const;
/** * Add a UID to the list. @@ -69,11 +79,41 @@ namespace firewalld void addUID(uid_t uid);
/** + * Check if the given UID is in the list. + */ + bool UIDInList(uid_t uid) const; + + /** + * Remove a UID from the list. + */ + bool removeUID(uid_t uid); + + /** + * Get a vector of all UIDs from the list. + */ + std::vector<uid_t> getUIDs() const; + + /** * Add a command to the list. */ void addCommand(const UString& command);
/** + * Check if the given command is in the list. + */ + bool commandInList(const UString& command) const; + + /** + * Remove a command from the list. + */ + bool removeCommand(const UString& command); + + /** + * Get a vector of all commands from the list. + */ + UStringVector getCommands() const; + + /** * Remove all items from the list. */ void clear();