int bus_job_method_cancel(sd_bus_message *message, void *userdata, sd_bus_error *error) { Job *j = userdata; int r; assert(message); assert(j); r = mac_selinux_unit_access_check(j->unit, message, "stop", error); if (r < 0) return r; /* Access is granted to the job owner */ if (!sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) { /* And for everybody else consult PolicyKit */ r = bus_verify_manage_units_async(j->unit->manager, message, error); if (r < 0) return r; if (r == 0) return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */ } job_finish_and_invalidate(j, JOB_CANCELED, true); return sd_bus_reply_method_return(message, NULL); }
static int verify_sys_admin_or_owner_sync(sd_bus_message *message, Job *j, sd_bus_error *error) { int r; if (sd_bus_track_contains(j->clients, sd_bus_message_get_sender(message))) return 0; /* One of the job owners is calling us */ r = sd_bus_query_sender_privilege(message, CAP_SYS_ADMIN); if (r < 0) return r; if (r == 0) return sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Access denied to perform action"); /* Root has called us */ return 0; }