From 83bc033837f7525d898f1de91119f669f9bf97f5 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Mon, 13 May 2019 15:46:32 +0200 Subject: [PATCH] global: combine all permissions of the object tree To get the permissions of an object, combine the permissions of the object and all the parent nodes up to the root. This is necessary to enforce that a client can never see and object id (in this case the parent id) it is not allowed to see. --- src/pipewire/global.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/pipewire/global.c b/src/pipewire/global.c index 00258ff88..c963965e7 100644 --- a/src/pipewire/global.c +++ b/src/pipewire/global.c @@ -38,9 +38,15 @@ uint32_t pw_global_get_permissions(struct pw_global *global, struct pw_client *c { uint32_t perms = PW_PERM_RWX; - if (client->permission_func != NULL) - perms &= client->permission_func(global, client, client->permission_data); + if (client->permission_func == NULL) + return perms; + perms = client->permission_func(global, client, client->permission_data); + + while (global != global->parent) { + global = global->parent; + perms &= client->permission_func(global, client, client->permission_data); + } return perms; }