Update su request process

Due to changes in ec3705f2ed, the app can
no longer communicate with the dameon through a socket opened on the
daemon side due to SELinux restrictions. The workaround here is to have
the daemon decide a socket name, send it to the app, have the app create
the socket server, then finally the daemon connects to the app through
the socket.
This commit is contained in:
topjohnwu
2020-06-19 03:52:25 -07:00
parent b71b4bd4e5
commit 43146b8316
12 changed files with 136 additions and 110 deletions

View File

@ -139,12 +139,9 @@ static shared_ptr<su_info> get_su_info(unsigned uid) {
}
// If still not determined, ask manager
struct sockaddr_un addr;
int sockfd = create_rand_socket(&addr);
// Connect manager
app_socket(addr.sun_path + 1, info);
int fd = socket_accept(sockfd, 60);
char socket_name[32];
gen_rand_str(socket_name, sizeof(socket_name));
int fd = app_socket(socket_name, info);
if (fd < 0) {
info->access.policy = DENY;
} else {
@ -153,7 +150,6 @@ static shared_ptr<su_info> get_su_info(unsigned uid) {
info->access.policy = ret < 0 ? DENY : static_cast<policy_t>(ret);
close(fd);
}
close(sockfd);
return info;
}