X Tutup
Skip to content

Commit 786d19f

Browse files
poetteringpoettering
committed
util: add creds-util.[ch] with helpers for dealing with credentials
1 parent b240c08 commit 786d19f

File tree

9 files changed

+79
-15
lines changed

9 files changed

+79
-15
lines changed

‎src/basic/creds-util.c‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
/* SPDX-License-Identifier: LGPL-2.1-or-later */
2+
3+
#include "creds-util.h"
4+
#include "fd-util.h"
5+
#include "fileio.h"
6+
#include "path-util.h"
7+
8+
bool credential_name_valid(const char *s) {
9+
/* We want that credential names are both valid in filenames (since that's our primary way to pass
10+
* them around) and as fdnames (which is how we might want to pass them around eventually) */
11+
return filename_is_valid(s) && fdname_is_valid(s);
12+
}
13+
14+
int get_credentials_dir(const char **ret) {
15+
const char *e;
16+
17+
assert(ret);
18+
19+
e = secure_getenv("CREDENTIALS_DIRECTORY");
20+
if (!e)
21+
return -ENXIO;
22+
23+
if (!path_is_absolute(e) || !path_is_normalized(e))
24+
return -EINVAL;
25+
26+
*ret = e;
27+
return 0;
28+
}
29+
30+
int read_credential(const char *name, void **ret, size_t *ret_size) {
31+
_cleanup_free_ char *fn = NULL;
32+
const char *d;
33+
int r;
34+
35+
assert(ret);
36+
37+
if (!credential_name_valid(name))
38+
return -EINVAL;
39+
40+
r = get_credentials_dir(&d);
41+
if (r < 0)
42+
return r;
43+
44+
fn = path_join(d, name);
45+
if (!fn)
46+
return -ENOMEM;
47+
48+
return read_full_file_full(
49+
AT_FDCWD, fn,
50+
UINT64_MAX, SIZE_MAX,
51+
READ_FULL_FILE_SECURE,
52+
NULL,
53+
(char**) ret, ret_size);
54+
}

‎src/basic/creds-util.h‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
/* SPDX-License-Identifier: LGPL-2.1-or-later */
2+
#pragma once
3+
4+
#include <inttypes.h>
5+
#include <stdbool.h>
6+
#include <sys/types.h>
7+
8+
bool credential_name_valid(const char *s);
9+
10+
int get_credentials_dir(const char **ret);
11+
12+
int read_credential(const char *name, void **ret, size_t *ret_size);

‎src/basic/meson.build‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ basic_sources = files('''
3535
conf-files.h
3636
copy.c
3737
copy.h
38+
creds-util.c
39+
creds-util.h
3840
def.h
3941
device-nodes.c
4042
device-nodes.h

‎src/basic/path-util.c‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1190,9 +1190,3 @@ bool prefixed_path_strv_contains(char **l, const char *path) {
11901190

11911191
return false;
11921192
}
1193-
1194-
bool credential_name_valid(const char *s) {
1195-
/* We want that credential names are both valid in filenames (since that's our primary way to pass
1196-
* them around) and as fdnames (which is how we might want to pass them around eventually) */
1197-
return filename_is_valid(s) && fdname_is_valid(s);
1198-
}

‎src/basic/path-util.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,5 +183,3 @@ static inline const char *empty_to_root(const char *path) {
183183

184184
bool path_strv_contains(char **l, const char *path);
185185
bool prefixed_path_strv_contains(char **l, const char *path);
186-
187-
bool credential_name_valid(const char *s);

‎src/core/dbus-execute.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include "cap-list.h"
1414
#include "capability-util.h"
1515
#include "cpu-set-util.h"
16+
#include "creds-util.h"
1617
#include "dbus-execute.h"
1718
#include "dbus-util.h"
1819
#include "env-util.h"

‎src/core/load-fragment.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@
1616
#include "sd-messages.h"
1717

1818
#include "af-list.h"
19-
#include "alloc-util.h"
2019
#include "all-units.h"
20+
#include "alloc-util.h"
2121
#include "bpf-firewall.h"
2222
#include "bus-error.h"
2323
#include "bus-internal.h"
@@ -28,6 +28,7 @@
2828
#include "conf-parser.h"
2929
#include "core-varlink.h"
3030
#include "cpu-set-util.h"
31+
#include "creds-util.h"
3132
#include "env-util.h"
3233
#include "errno-list.h"
3334
#include "escape.h"

‎src/core/manager.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
#include "clean-ipc.h"
3131
#include "clock-util.h"
3232
#include "core-varlink.h"
33+
#include "creds-util.h"
3334
#include "dbus-job.h"
3435
#include "dbus-manager.h"
3536
#include "dbus-unit.h"
@@ -49,8 +50,8 @@
4950
#include "install.h"
5051
#include "io-util.h"
5152
#include "label.h"
52-
#include "locale-setup.h"
5353
#include "load-fragment.h"
54+
#include "locale-setup.h"
5455
#include "log.h"
5556
#include "macro.h"
5657
#include "manager.h"
@@ -852,8 +853,8 @@ int manager_new(UnitFileScope scope, ManagerTestRunFlags test_run_flags, Manager
852853
if (r < 0)
853854
return r;
854855

855-
e = secure_getenv("CREDENTIALS_DIRECTORY");
856-
if (e) {
856+
r = get_credentials_dir(&e);
857+
if (r >= 0) {
857858
m->received_credentials = strdup(e);
858859
if (!m->received_credentials)
859860
return -ENOMEM;

‎src/nspawn/nspawn.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include "cgroup-util.h"
3636
#include "copy.h"
3737
#include "cpu-set-util.h"
38+
#include "creds-util.h"
3839
#include "dev-setup.h"
3940
#include "discover-image.h"
4041
#include "dissect-image.h"
@@ -1592,9 +1593,9 @@ static int parse_argv(int argc, char *argv[]) {
15921593
else {
15931594
const char *e;
15941595

1595-
e = getenv("CREDENTIALS_DIRECTORY");
1596-
if (!e)
1597-
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Credential not available (no credentials passed at all): %s", word);
1596+
r = get_credentials_dir(&e);
1597+
if (r < 0)
1598+
return log_error_errno(r, "Credential not available (no credentials passed at all): %s", word);
15981599

15991600
j = path_join(e, p);
16001601
if (!j)

0 commit comments

Comments
 (0)
X Tutup