diff --git a/man/rules/meson.build b/man/rules/meson.build index 1e8747e4ef4..b0b56af1f04 100644 --- a/man/rules/meson.build +++ b/man/rules/meson.build @@ -202,6 +202,7 @@ manpages = [ 'sd_bus_creds_get_fsuid', 'sd_bus_creds_get_gid', 'sd_bus_creds_get_owner_uid', + 'sd_bus_creds_get_pidfd_dup', 'sd_bus_creds_get_ppid', 'sd_bus_creds_get_selinux_context', 'sd_bus_creds_get_session', @@ -227,6 +228,7 @@ manpages = [ '3', ['sd_bus_creds_get_augmented_mask', 'sd_bus_creds_get_mask', + 'sd_bus_creds_new_from_pidfd', 'sd_bus_creds_ref', 'sd_bus_creds_unref', 'sd_bus_creds_unrefp'], diff --git a/man/sd_bus_creds_get_pid.xml b/man/sd_bus_creds_get_pid.xml index 62deb229ac8..6f3e1ee07b6 100644 --- a/man/sd_bus_creds_get_pid.xml +++ b/man/sd_bus_creds_get_pid.xml @@ -17,6 +17,7 @@ sd_bus_creds_get_pid + sd_bus_creds_get_pidfd_dup sd_bus_creds_get_ppid sd_bus_creds_get_tid sd_bus_creds_get_uid @@ -64,6 +65,12 @@ pid_t *pid + + int sd_bus_creds_get_pidfd_dup + sd_bus_creds *c + int *ret_fd + + int sd_bus_creds_get_ppid sd_bus_creds *c @@ -289,11 +296,14 @@ sd_bus_creds_get_mask3 to determine the mask of fields available. - sd_bus_creds_get_pid() will retrieve - the PID (process identifier). Similarly, - sd_bus_creds_get_ppid() will retrieve the - parent PID. Note that PID 1 has no parent process, in which case - -ENXIO is returned. + sd_bus_creds_get_pid() will retrieve the PID (process identifier). Similarly, + sd_bus_creds_get_ppid() will retrieve the parent PID. Note that PID 1 has no parent + process, in which case -ENXIO is returned. + + sd_bus_creds_get_pidfd_dup() will retrieve the PID file descriptor (pidfd), + see pidfd_open2 for + details. The file descriptor is duplicated and thus must be closed by the caller. sd_bus_creds_get_tid() will retrieve the TID (thread identifier). @@ -543,6 +553,7 @@ sd_bus_creds_get_tty(), and sd_bus_creds_get_description() were added in version 220. sd_bus_creds_get_user_slice() was added in version 223. + sd_bus_creds_get_pidfd_dup() was added in version 256. diff --git a/man/sd_bus_creds_new_from_pid.xml b/man/sd_bus_creds_new_from_pid.xml index ca9cab72926..4b39f4a0032 100644 --- a/man/sd_bus_creds_new_from_pid.xml +++ b/man/sd_bus_creds_new_from_pid.xml @@ -17,6 +17,7 @@ sd_bus_creds_new_from_pid + sd_bus_creds_new_from_pidfd sd_bus_creds_get_mask sd_bus_creds_get_augmented_mask sd_bus_creds_ref @@ -37,6 +38,13 @@ sd_bus_creds **ret + + int sd_bus_creds_new_from_pidfd + int pidfd + uint64_t creds_mask + sd_bus_creds **ret + + uint64_t sd_bus_creds_get_mask sd_bus_creds *c @@ -98,6 +106,7 @@ SD_BUS_CREDS_UNIQUE_NAME, SD_BUS_CREDS_WELL_KNOWN_NAMES, SD_BUS_CREDS_DESCRIPTION, + SD_BUS_CREDS_PIDFD, SD_BUS_CREDS_AUGMENT, _SD_BUS_CREDS_ALL @@ -116,91 +125,65 @@ and sd_bus_message_get_creds3. - The information that will be stored is determined by - creds_mask. It may contain a subset of ORed - constants SD_BUS_CREDS_PID, - SD_BUS_CREDS_PPID, - SD_BUS_CREDS_TID, - SD_BUS_CREDS_UID, - SD_BUS_CREDS_EUID, - SD_BUS_CREDS_SUID, - SD_BUS_CREDS_FSUID, - SD_BUS_CREDS_GID, - SD_BUS_CREDS_EGID, - SD_BUS_CREDS_SGID, - SD_BUS_CREDS_FSGID, - SD_BUS_CREDS_SUPPLEMENTARY_GIDS, - SD_BUS_CREDS_COMM, - SD_BUS_CREDS_TID_COMM, - SD_BUS_CREDS_EXE, - SD_BUS_CREDS_CMDLINE, - SD_BUS_CREDS_CGROUP, - SD_BUS_CREDS_UNIT, - SD_BUS_CREDS_SLICE, - SD_BUS_CREDS_USER_UNIT, - SD_BUS_CREDS_USER_SLICE, - SD_BUS_CREDS_SESSION, - SD_BUS_CREDS_OWNER_UID, - SD_BUS_CREDS_EFFECTIVE_CAPS, - SD_BUS_CREDS_PERMITTED_CAPS, - SD_BUS_CREDS_INHERITABLE_CAPS, - SD_BUS_CREDS_BOUNDING_CAPS, - SD_BUS_CREDS_SELINUX_CONTEXT, - SD_BUS_CREDS_AUDIT_SESSION_ID, - SD_BUS_CREDS_AUDIT_LOGIN_UID, - SD_BUS_CREDS_TTY, - SD_BUS_CREDS_UNIQUE_NAME, - SD_BUS_CREDS_WELL_KNOWN_NAMES, and - SD_BUS_CREDS_DESCRIPTION. Use the special - value _SD_BUS_CREDS_ALL to request all - supported fields. The SD_BUS_CREDS_AUGMENT - constant may not be ORed into the mask for invocations of - sd_bus_creds_new_from_pid(). + sd_bus_creds_new_from_pidfd() is identical to + sd_bus_creds_new_from_pid(), but takes a PID file descriptor rather than a numeric + PID as reference to the process. See pidfd_open2. + + The information that will be stored is determined by creds_mask. It may + contain a subset of ORed constants SD_BUS_CREDS_PID, + SD_BUS_CREDS_PPID, SD_BUS_CREDS_TID, + SD_BUS_CREDS_UID, SD_BUS_CREDS_EUID, + SD_BUS_CREDS_SUID, SD_BUS_CREDS_FSUID, + SD_BUS_CREDS_GID, SD_BUS_CREDS_EGID, + SD_BUS_CREDS_SGID, SD_BUS_CREDS_FSGID, + SD_BUS_CREDS_SUPPLEMENTARY_GIDS, SD_BUS_CREDS_COMM, + SD_BUS_CREDS_TID_COMM, SD_BUS_CREDS_EXE, + SD_BUS_CREDS_CMDLINE, SD_BUS_CREDS_CGROUP, + SD_BUS_CREDS_UNIT, SD_BUS_CREDS_SLICE, + SD_BUS_CREDS_USER_UNIT, SD_BUS_CREDS_USER_SLICE, + SD_BUS_CREDS_SESSION, SD_BUS_CREDS_OWNER_UID, + SD_BUS_CREDS_EFFECTIVE_CAPS, SD_BUS_CREDS_PERMITTED_CAPS, + SD_BUS_CREDS_INHERITABLE_CAPS, SD_BUS_CREDS_BOUNDING_CAPS, + SD_BUS_CREDS_SELINUX_CONTEXT, SD_BUS_CREDS_AUDIT_SESSION_ID, + SD_BUS_CREDS_AUDIT_LOGIN_UID, SD_BUS_CREDS_TTY, + SD_BUS_CREDS_UNIQUE_NAME, SD_BUS_CREDS_WELL_KNOWN_NAMES, + SD_BUS_CREDS_DESCRIPTION, and SD_BUS_CREDS_PIDFD. Use the + special value _SD_BUS_CREDS_ALL to request all supported fields. The + SD_BUS_CREDS_AUGMENT constant may not be ORed into the mask for invocations of + sd_bus_creds_new_from_pid() or + sd_bus_creds_new_from_pidfd(). Fields can be retrieved from the credentials object using sd_bus_creds_get_pid3 and other functions which correspond directly to the constants listed above. - A mask of fields which were actually successfully retrieved - can be retrieved with - sd_bus_creds_get_mask(). If the credentials - object was created with - sd_bus_creds_new_from_pid(), this will be a - subset of fields requested in creds_mask. + A mask of fields which were actually successfully retrieved can be retrieved with + sd_bus_creds_get_mask(). If the credentials object was created with + sd_bus_creds_new_from_pid() or sd_bus_creds_new_from_pidfd(), + this will be a subset of fields requested in creds_mask. - Similar to sd_bus_creds_get_mask(), the - function sd_bus_creds_get_augmented_mask() - returns a bitmask of field constants. The mask indicates which - credential fields have been retrieved in a non-atomic fashion. For - credential objects created via - sd_bus_creds_new_from_pid(), this mask will be - identical to the mask returned by - sd_bus_creds_get_mask(). However, for - credential objects retrieved via - sd_bus_get_name_creds(), this mask will be set - for the credential fields that could not be determined atomically - at peer connection time, and which were later added by reading - augmenting credential data from - /proc/. Similarly, for credential objects - retrieved via sd_bus_get_owner_creds(), the - mask is set for the fields that could not be determined atomically - at bus creation time, but have been augmented. Similarly, for - credential objects retrieved via - sd_bus_message_get_creds(), the mask is set - for the fields that could not be determined atomically at message - sending time, but have been augmented. The mask returned by - sd_bus_creds_get_augmented_mask() is always a - subset of (or identical to) the mask returned by - sd_bus_creds_get_mask() for the same - object. The latter call hence returns all credential fields - available in the credential object, the former then marks the - subset of those that have been augmented. Note that augmented - fields are unsuitable for authorization decisions, as they may be - retrieved at different times, thus being subject to races. Hence, - augmented fields should be used exclusively for informational - purposes. + Similar to sd_bus_creds_get_mask(), the function + sd_bus_creds_get_augmented_mask() returns a bitmask of field constants. The mask + indicates which credential fields have been retrieved in a non-atomic fashion. For credential objects + created via sd_bus_creds_new_from_pid() or + sd_bus_creds_new_from_pidfd(), this mask will be identical to the mask returned by + sd_bus_creds_get_mask(). However, for credential objects retrieved via + sd_bus_get_name_creds(), this mask will be set for the credential fields that could + not be determined atomically at peer connection time, and which were later added by reading augmenting + credential data from /proc/. Similarly, for credential objects retrieved via + sd_bus_get_owner_creds(), the mask is set for the fields that could not be + determined atomically at bus creation time, but have been augmented. Similarly, for credential objects + retrieved via sd_bus_message_get_creds(), the mask is set for the fields that could + not be determined atomically at message sending time, but have been augmented. The mask returned by + sd_bus_creds_get_augmented_mask() is always a subset of (or identical to) the mask + returned by sd_bus_creds_get_mask() for the same object. The latter call hence + returns all credential fields available in the credential object, the former then marks the subset of + those that have been augmented. Note that augmented fields are unsuitable for authorization decisions, as + they may be retrieved at different times, thus being subject to races. Hence, augmented fields should be + used exclusively for informational purposes. sd_bus_creds_ref() creates a new @@ -234,9 +217,9 @@ Return Value - On success, sd_bus_creds_new_from_pid() - returns 0 or a positive integer. On failure, it returns a negative - errno-style error code. + On success, sd_bus_creds_new_from_pid() and + sd_bus_creds_new_from_pidfd() return 0 or a positive integer. On failure, they return + a negative errno-style error code. sd_bus_creds_get_mask() returns the mask of successfully acquired fields. @@ -256,9 +239,9 @@ Reference ownership - Function sd_bus_creds_new_from_pid() - creates a new object and the caller owns the sole reference. When - not needed anymore, this reference should be destroyed with + The functions sd_bus_creds_new_from_pid() and + sd_bus_creds_new_from_pidfd() create a new object and the caller owns the sole + reference. When not needed anymore, this reference should be destroyed with sd_bus_creds_unref3. @@ -307,6 +290,7 @@ sd_bus_creds_unref() were added in version 209. sd_bus_creds_get_augmented_mask() was added in version 223. sd_bus_creds_unrefp() was added in version 229. + sd_bus_creds_new_from_pidfd() was added in version 256.