gdbusauthobserver.c 8.22 KB
Newer Older
1 2
/* GDBus - GLib D-Bus Library
 *
3
 * Copyright (C) 2008-2010 Red Hat, Inc.
4 5 6 7
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
8
 * version 2.1 of the License, or (at your option) any later version.
9 10 11 12 13 14 15
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General
16
 * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
17 18 19 20 21 22 23 24 25 26
 *
 * Author: David Zeuthen <davidz@redhat.com>
 */

#include "config.h"

#include "gdbusauthobserver.h"
#include "gcredentials.h"
#include "gioenumtypes.h"
#include "giostream.h"
27
#include "gdbusprivate.h"
28

David Zeuthen's avatar
David Zeuthen committed
29 30
#include "glibintl.h"

31 32 33
/**
 * SECTION:gdbusauthobserver
 * @short_description: Object used for authenticating connections
David Zeuthen's avatar
David Zeuthen committed
34
 * @include: gio/gio.h
35 36 37 38 39 40 41
 *
 * The #GDBusAuthObserver type provides a mechanism for participating
 * in how a #GDBusServer (or a #GDBusConnection) authenticates remote
 * peers. Simply instantiate a #GDBusAuthObserver and connect to the
 * signals you are interested in. Note that new signals may be added
 * in the future
 *
42 43
 * ## Controlling Authentication # {#auth-observer}
 *
44
 * For example, if you only want to allow D-Bus connections from
45 46
 * processes owned by the same uid as the server, you would use a
 * signal handler like the following:
47
 * 
48
 * |[<!-- language="C" -->
49
 * static gboolean
50 51 52 53
 * on_authorize_authenticated_peer (GDBusAuthObserver *observer,
 *                                  GIOStream         *stream,
 *                                  GCredentials      *credentials,
 *                                  gpointer           user_data)
54
 * {
55
 *   gboolean authorized;
56
 *
57
 *   authorized = FALSE;
58 59 60 61 62 63 64 65
 *   if (credentials != NULL)
 *     {
 *       GCredentials *own_credentials;
 *       own_credentials = g_credentials_new ();
 *       if (g_credentials_is_same_user (credentials, own_credentials, NULL))
 *         authorized = TRUE;
 *       g_object_unref (own_credentials);
 *     }
66
 *
67
 *   return authorized;
68
 * }
69
 * ]|
70 71
 */

72 73
typedef struct _GDBusAuthObserverClass GDBusAuthObserverClass;

74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92
/**
 * GDBusAuthObserverClass:
 * @authorize_authenticated_peer: Signal class handler for the #GDBusAuthObserver::authorize-authenticated-peer signal.
 *
 * Class structure for #GDBusAuthObserverClass.
 *
 * Since: 2.26
 */
struct _GDBusAuthObserverClass
{
  /*< private >*/
  GObjectClass parent_class;

  /*< public >*/

  /* Signals */
  gboolean (*authorize_authenticated_peer) (GDBusAuthObserver  *observer,
                                            GIOStream          *stream,
                                            GCredentials       *credentials);
93 94 95

  gboolean (*allow_mechanism) (GDBusAuthObserver  *observer,
                               const gchar        *mechanism);
96 97
};

98 99 100 101 102 103 104 105 106
/**
 * GDBusAuthObserver:
 *
 * The #GDBusAuthObserver structure contains only private data and
 * should only be accessed using the provided API.
 *
 * Since: 2.26
 */
struct _GDBusAuthObserver
107
{
108
  GObject parent_instance;
109 110 111 112
};

enum
{
113
  AUTHORIZE_AUTHENTICATED_PEER_SIGNAL,
114
  ALLOW_MECHANISM_SIGNAL,
115 116 117 118 119
  LAST_SIGNAL,
};

static guint signals[LAST_SIGNAL] = { 0 };

120
G_DEFINE_TYPE (GDBusAuthObserver, g_dbus_auth_observer, G_TYPE_OBJECT)
121 122 123 124 125 126

/* ---------------------------------------------------------------------------------------------------- */

static void
g_dbus_auth_observer_finalize (GObject *object)
{
127
  G_OBJECT_CLASS (g_dbus_auth_observer_parent_class)->finalize (object);
128 129 130
}

static gboolean
131 132 133 134 135 136 137
g_dbus_auth_observer_authorize_authenticated_peer_real (GDBusAuthObserver  *observer,
                                                        GIOStream          *stream,
                                                        GCredentials       *credentials)
{
  return TRUE;
}

138 139 140 141 142 143 144
static gboolean
g_dbus_auth_observer_allow_mechanism_real (GDBusAuthObserver  *observer,
                                           const gchar        *mechanism)
{
  return TRUE;
}

145 146 147 148 149
static void
g_dbus_auth_observer_class_init (GDBusAuthObserverClass *klass)
{
  GObjectClass *gobject_class = G_OBJECT_CLASS (klass);

150
  gobject_class->finalize = g_dbus_auth_observer_finalize;
151

152
  klass->authorize_authenticated_peer = g_dbus_auth_observer_authorize_authenticated_peer_real;
153
  klass->allow_mechanism = g_dbus_auth_observer_allow_mechanism_real;
154 155

  /**
156
   * GDBusAuthObserver::authorize-authenticated-peer:
157 158
   * @observer: The #GDBusAuthObserver emitting the signal.
   * @stream: A #GIOStream for the #GDBusConnection.
159
   * @credentials: (nullable): Credentials received from the peer or %NULL.
160 161
   *
   * Emitted to check if a peer that is successfully authenticated
162
   * is authorized.
163
   *
164
   * Returns: %TRUE if the peer is authorized, %FALSE if not.
165 166
   *
   * Since: 2.26
167
   */
168
  signals[AUTHORIZE_AUTHENTICATED_PEER_SIGNAL] =
169
    g_signal_new (I_("authorize-authenticated-peer"),
170 171
                  G_TYPE_DBUS_AUTH_OBSERVER,
                  G_SIGNAL_RUN_LAST,
172 173
                  G_STRUCT_OFFSET (GDBusAuthObserverClass, authorize_authenticated_peer),
                  _g_signal_accumulator_false_handled,
174
                  NULL, /* accu_data */
175
                  NULL,
176 177 178 179
                  G_TYPE_BOOLEAN,
                  2,
                  G_TYPE_IO_STREAM,
                  G_TYPE_CREDENTIALS);
180 181 182 183

  /**
   * GDBusAuthObserver::allow-mechanism:
   * @observer: The #GDBusAuthObserver emitting the signal.
184
   * @mechanism: The name of the mechanism, e.g. `DBUS_COOKIE_SHA1`.
185 186 187 188 189 190 191 192
   *
   * Emitted to check if @mechanism is allowed to be used.
   *
   * Returns: %TRUE if @mechanism can be used to authenticate the other peer, %FALSE if not.
   *
   * Since: 2.34
   */
  signals[ALLOW_MECHANISM_SIGNAL] =
193
    g_signal_new (I_("allow-mechanism"),
194 195 196 197 198 199 200 201 202
                  G_TYPE_DBUS_AUTH_OBSERVER,
                  G_SIGNAL_RUN_LAST,
                  G_STRUCT_OFFSET (GDBusAuthObserverClass, allow_mechanism),
                  _g_signal_accumulator_false_handled,
                  NULL, /* accu_data */
                  NULL,
                  G_TYPE_BOOLEAN,
                  1,
                  G_TYPE_STRING);
203 204 205 206 207 208 209 210 211 212 213 214 215
}

static void
g_dbus_auth_observer_init (GDBusAuthObserver *observer)
{
}

/**
 * g_dbus_auth_observer_new:
 *
 * Creates a new #GDBusAuthObserver object.
 *
 * Returns: A #GDBusAuthObserver. Free with g_object_unref().
216 217
 *
 * Since: 2.26
218 219 220 221 222 223 224 225 226 227
 */
GDBusAuthObserver *
g_dbus_auth_observer_new (void)
{
  return g_object_new (G_TYPE_DBUS_AUTH_OBSERVER, NULL);
}

/* ---------------------------------------------------------------------------------------------------- */

/**
228
 * g_dbus_auth_observer_authorize_authenticated_peer:
229 230
 * @observer: A #GDBusAuthObserver.
 * @stream: A #GIOStream for the #GDBusConnection.
231
 * @credentials: (nullable): Credentials received from the peer or %NULL.
232
 *
233
 * Emits the #GDBusAuthObserver::authorize-authenticated-peer signal on @observer.
234
 *
235
 * Returns: %TRUE if the peer is authorized, %FALSE if not.
236 237
 *
 * Since: 2.26
238 239
 */
gboolean
240 241 242
g_dbus_auth_observer_authorize_authenticated_peer (GDBusAuthObserver  *observer,
                                                   GIOStream          *stream,
                                                   GCredentials       *credentials)
243 244 245 246 247
{
  gboolean denied;

  denied = FALSE;
  g_signal_emit (observer,
248
                 signals[AUTHORIZE_AUTHENTICATED_PEER_SIGNAL],
249 250 251 252 253 254
                 0,
                 stream,
                 credentials,
                 &denied);
  return denied;
}
255 256 257 258

/**
 * g_dbus_auth_observer_allow_mechanism:
 * @observer: A #GDBusAuthObserver.
259
 * @mechanism: The name of the mechanism, e.g. `DBUS_COOKIE_SHA1`.
260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281
 *
 * Emits the #GDBusAuthObserver::allow-mechanism signal on @observer.
 *
 * Returns: %TRUE if @mechanism can be used to authenticate the other peer, %FALSE if not.
 *
 * Since: 2.34
 */
gboolean
g_dbus_auth_observer_allow_mechanism (GDBusAuthObserver  *observer,
                                      const gchar        *mechanism)
{
  gboolean ret;

  ret = FALSE;
  g_signal_emit (observer,
                 signals[ALLOW_MECHANISM_SIGNAL],
                 0,
                 mechanism,
                 &ret);
  return ret;
}