Daan De Meyer
87fbd33372
- Remove unused includes - Add common false positive headers to misc-include-cleaner.IgnoreHeaders - Add IWYU pragma keep for uncommon false positive headers
105 lines
3.1 KiB
C
105 lines
3.1 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include "alloc-util.h"
|
|
#include "extract-word.h"
|
|
#include "securebits-util.h"
|
|
#include "string-util.h"
|
|
#include "strv.h"
|
|
|
|
static inline const char* secure_bit_to_string(int i) {
|
|
/* match a single bit */
|
|
|
|
switch (i) {
|
|
case SECURE_KEEP_CAPS:
|
|
return "keep-caps";
|
|
case SECURE_KEEP_CAPS_LOCKED:
|
|
return "keep-caps-locked";
|
|
case SECURE_NO_SETUID_FIXUP:
|
|
return "no-setuid-fixup";
|
|
case SECURE_NO_SETUID_FIXUP_LOCKED:
|
|
return "no-setuid-fixup-locked";
|
|
case SECURE_NOROOT:
|
|
return "noroot";
|
|
case SECURE_NOROOT_LOCKED:
|
|
return "noroot-locked";
|
|
default:
|
|
assert_not_reached();
|
|
}
|
|
}
|
|
|
|
int secure_bits_to_string_alloc(int i, char **ret) {
|
|
_cleanup_strv_free_ char **sv = NULL;
|
|
_cleanup_free_ char *joined = NULL;
|
|
int r;
|
|
|
|
assert(ret);
|
|
|
|
r = secure_bits_to_strv(i, &sv);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
joined = strv_join(sv, " ");
|
|
if (!joined)
|
|
return -ENOMEM;
|
|
|
|
*ret = TAKE_PTR(joined);
|
|
return 0;
|
|
}
|
|
|
|
int secure_bits_to_strv(int i, char ***ret) {
|
|
_cleanup_strv_free_ char **sv = NULL;
|
|
static const int bits[] = {
|
|
SECURE_KEEP_CAPS,
|
|
SECURE_KEEP_CAPS_LOCKED,
|
|
SECURE_NO_SETUID_FIXUP,
|
|
SECURE_NO_SETUID_FIXUP_LOCKED,
|
|
SECURE_NOROOT,
|
|
SECURE_NOROOT_LOCKED,
|
|
};
|
|
int r;
|
|
|
|
assert(ret);
|
|
|
|
FOREACH_ELEMENT(bit, bits) {
|
|
if (i & (1 << *bit)) {
|
|
r = strv_extend(&sv, secure_bit_to_string(*bit));
|
|
if (r < 0)
|
|
return r;
|
|
}
|
|
}
|
|
|
|
*ret = TAKE_PTR(sv);
|
|
return 0;
|
|
}
|
|
|
|
int secure_bits_from_string(const char *s) {
|
|
int secure_bits = 0;
|
|
const char *p;
|
|
int r;
|
|
|
|
for (p = s;;) {
|
|
_cleanup_free_ char *word = NULL;
|
|
|
|
r = extract_first_word(&p, &word, NULL, EXTRACT_UNQUOTE);
|
|
if (r == -ENOMEM)
|
|
return r;
|
|
if (r <= 0)
|
|
break;
|
|
|
|
if (streq(word, "keep-caps"))
|
|
secure_bits |= 1 << SECURE_KEEP_CAPS;
|
|
else if (streq(word, "keep-caps-locked"))
|
|
secure_bits |= 1 << SECURE_KEEP_CAPS_LOCKED;
|
|
else if (streq(word, "no-setuid-fixup"))
|
|
secure_bits |= 1 << SECURE_NO_SETUID_FIXUP;
|
|
else if (streq(word, "no-setuid-fixup-locked"))
|
|
secure_bits |= 1 << SECURE_NO_SETUID_FIXUP_LOCKED;
|
|
else if (streq(word, "noroot"))
|
|
secure_bits |= 1 << SECURE_NOROOT;
|
|
else if (streq(word, "noroot-locked"))
|
|
secure_bits |= 1 << SECURE_NOROOT_LOCKED;
|
|
}
|
|
|
|
return secure_bits;
|
|
}
|