gboolean
nm_auth_uid_in_acl (NMConnection *connection,
NMSessionMonitor *smon,
gulong uid,
char **out_error_desc)
{
NMSettingConnection *s_con;
const char *user = NULL;
GError *local = NULL;
g_return_val_if_fail (connection != NULL, FALSE);
g_return_val_if_fail (smon != NULL, FALSE);
/* Root gets a free pass */
if (0 == uid)
return TRUE;
/* Reject the request if the request comes from no session at all */
if (!nm_session_monitor_uid_has_session (smon, uid, &user, &local)) {
if (out_error_desc) {
*out_error_desc = g_strdup_printf ("No session found for uid %lu (%s)",
uid,
local && local->message ? local->message : "unknown");
}
g_clear_error (&local);
return FALSE;
}
if (!user) {
if (out_error_desc)
*out_error_desc = g_strdup_printf ("Could not determine username for uid %lu", uid);
return FALSE;
}
s_con = nm_connection_get_setting_connection (connection);
if (!s_con) {
/* This can only happen when called from AddAndActivate, so we know
* the user will be authorized when the connection is completed.
*/
return TRUE;
}
/* Match the username returned by the session check to a user in the ACL */
if (!nm_setting_connection_permissions_user_allowed (s_con, user)) {
if (out_error_desc)
*out_error_desc = g_strdup_printf ("uid %lu has no permission to perform this operation", uid);
return FALSE;
}
return TRUE;
}
gboolean
nm_session_monitor_user_has_session (NMSessionMonitor *monitor,
const char *username,
uid_t *out_uid,
GError **error)
{
uid_t uid;
if (!nm_session_user_to_uid (username, &uid, error))
return FALSE;
if (out_uid)
*out_uid = uid;
return nm_session_monitor_uid_has_session (monitor, uid, NULL, error);
}
