summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Start 1.12.28dbus-1.12Simon McVittie2023-02-082-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Update AUTHORSSimon McVittie2023-02-081-0/+2
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare v1.12.26dbus-1.12.26Simon McVittie2023-02-082-3/+3
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Update NEWS for 1.12.xSimon McVittie2023-02-081-0/+9
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* cleanup: Use gitlab URI for bug reportingMarco Trevisan (Treviño)2023-02-082-2/+2
| | | | | | | Bugzilla is dead for long time now. (cherry picked from commit dc59aa5df2c0c9a8fce5f5f0c33b69f21258c1ac) (cherry picked from commit b5638c9882a9ce8d26b828abe1f9dffe19400aac)
* Permit access to /tmp dbus socketDave Jones2023-02-081-0/+4
| | | | | | | | | After 6e48c317 the test-apparmor-activation test fails as it can no longer access the dbus socket in /tmp. This commit updates the apparmor profile used within the test (cherry picked from commit 9950464761f0c44e08fb93155ca6e7f4b1d8a31f) (cherry picked from commit 849382fe6daaf06b99269410091aa96f718f346a)
* NEWS: Add #421Simon McVittie2023-02-081-1/+8
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* _dbus_string_skip_blank(): Let the final assert follow the previous searchRalf Habacker2023-02-081-1/+1
| | | | | | | | | | | | | | | | | | This appears to have been a copy/paste mistake. If only blanks (defined as spaces or tabs) were removed, then it cannot be right to check for white space (defined as spaces, tabs, carriage return or linefeed) afterwards. If libdbus was compiled with assertions enabled, then this is a denial-of-service issue for dbus-daemon or other users of DBusServer: an unauthenticated user with access to the server's socket can send whitespace that triggers this assertion failure. We recommend that production versions of dbus, for example in OS distributions, should be compiled with checks but without assertions. [smcv: expanded commit message] Thanks: Evgeny Vereshchagin Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/421
* Post-release version bumpSimon McVittie2022-10-052-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare v1.12.24dbus-1.12.24Simon McVittie2022-10-053-3/+107
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Update NEWSSimon McVittie2022-10-051-3/+28
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* test: Parse a message with a byteswapped Unix fd indexSimon McVittie2022-10-054-0/+46
| | | | | | | | | Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/417 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit bef693f442d854505e7013fd31efe41747d7493c) [backport to 1.14.x: discard Meson build system updates] (cherry picked from commit 71dd3ad20cf8aca3310fa8d533801fb1d8bdaf1a) [backport to 1.12.x: resolve conflicts in Autotools build system]
* test: Add infrastructure to parse valid raw message blobsSimon McVittie2022-10-054-0/+185
| | | | | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 7a2c13d21be702c7b5b7288fb82a60adc5bd7378) [backport to 1.14.x: discard Meson build system updates] (cherry picked from commit 7a8f3c2af94063e4994a9780d00d700aa0ea8aef) [backport to 1.12.x: resolve conflicts in build system; adjust signature of test function for absence of 39ef65d0 in this branch]
* dbus-marshal-byteswap: Byte-swap Unix fd indexes if neededSimon McVittie2022-10-051-5/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a D-Bus message includes attached file descriptors, the body of the message contains unsigned 32-bit indexes pointing into an out-of-band array of file descriptors. Some D-Bus APIs like GLib's GDBus refer to these indexes as "handles" for the associated fds (not to be confused with a Windows HANDLE, which is a kernel object). The assertion message removed by this commit is arguably correct up to a point: fd-passing is only reasonable on a local machine, and no known operating system allows processes of differing endianness even on a multi-endian ARM or PowerPC CPU, so it makes little sense for the sender to specify a byte-order that differs from the byte-order of the recipient. However, this doesn't account for the fact that a malicious sender doesn't have to restrict itself to only doing things that make sense. On a system with untrusted local users, a message sender could crash the system dbus-daemon (a denial of service) by sending a message in the opposite endianness that contains handles to file descriptors. Before this commit, if assertions are enabled, attempting to byteswap a fd index would cleanly crash the message recipient with an assertion failure. If assertions are disabled, attempting to byteswap a fd index would silently do nothing without advancing the pointer p, causing the message's type and the pointer into its contents to go out of sync, which can result in a subsequent crash (the crash demonstrated by fuzzing was a use-after-free, but other failure modes might be possible). In principle we could resolve this by rejecting wrong-endianness messages from a local sender, but it's actually simpler and less code to treat wrong-endianness messages as valid and byteswap them. Thanks: Evgeny Vereshchagin Fixes: ba7daa60 "unix-fd: add basic marshalling code for unix fds" Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/417 Resolves: CVE-2022-42012 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 236f16e444e88a984cf12b09225e0f8efa6c5b44) (cherry picked from commit 3fb065b0752db1e298e4ada52cf4adc414f5e946)
* test: Add targeted tests for dbus/dbus#413, dbus/dbus#418Simon McVittie2022-10-051-3/+98
| | | | | | | | | | | | | | | Unlike the message-internals test, these do not rely on extra debug instrumentation in libdbus, and so can be used for "as-installed" testing. (However, they do require GLib.) Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413 Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 3ef342410a1cefe3d0bfaf46279c6517f4b44a26) (cherry picked from commit 6b88e768d887470573bc746bf9f22a24f2c00dbf) [backport to 1.12.x: resolve conflicts; call _dbus_header_delete_field directly because _dbus_message_remove_unknown_fields didn't yet exist in this branch]
* dbus_message_demarshal: Set error if we can't allocate the loaderSimon McVittie2022-10-051-3/+6
| | | | | | | | | | | Backported from 1.13.0. Previously this was fixed in the dbus-1.14 branch but unfixed in the dbus-1.12 branch, but we need it fixed in dbus-1.12 if we want the additional test coverage for dbus#413 to pass. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100317 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit ecbcffae19ff1b811fc7d0d602458c0f00dd6771)
* test: Export G_TEST_BUILDDIR, G_TEST_SRCDIRSimon McVittie2022-10-052-0/+4
| | | | | | | | | | | | | | | | | | These environment variables are used by GLib's g_test_build_filename() and related convenience functions, which make it easier for unit tests to find data files in a way that works for both build-time tests and "as-installed" tests. During "as-installed" testing, both variables will normally be unset, and GLib uses the directory containing the executable. In most cases that results in the right thing happening, and this will also be true for dbus, since we install the test executables in ${libexecdir}/installed-tests, helper executables in the same place, and test data in ${libexecdir}/installed-tests/data. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 37e01259435a28b11a087867ea199cd09f0a5cff) [backport to 1.14.x: discard Meson build system updates] (cherry picked from commit bbf5ef008a629af62f817771adee6ae4adcf3bcd) [backport to 1.12.x: resolve conflicts in CMake build system]
* test/data: Add messages that reproduce dbus/dbus#413, dbus/dbus#418Simon McVittie2022-10-0511-0/+184
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In debug builds with "embedded tests" enabled, these will automatically be used as input for the message-internals test. Some of the messages themselves are output from a fuzzer, others are simplifications to include only one reason for lack of validity per message. I've included an annotated hex-dump for each message here, but the dbus test suite doesn't currently know how to convert hex to binary, so I've also committed the corresponding binary. See the comment at the top of each hex-dump for how to create the binary version (which requires the xxd tool shipped with vim). It would be nice for the dbus test suite to be able to convert the annotated hex-dump to binary, either at build-time with a Python script or at runtime by loading the text file and decoding the hex, but I don't want to block on that for dbus/dbus#413 and dbus/dbus#418. Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413 Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit d633016f7340f83142f19f4bcac08c57e1f2fd2f) [backport to 1.14.x: discard Meson build system updates] (cherry picked from commit c0bfcc097896fb57a96f55818fc5fe97db679cbf) [backport to 1.12.x: resolve conflicts vs. Autotools before 09076dfe]
* dbus-marshal-validate: Validate length of arrays of fixed-length itemsSimon McVittie2022-10-051-1/+12
| | | | | | | | | | | | | | | | | This fast-path previously did not check that the array was made up of an integer number of items. This could lead to assertion failures and out-of-bounds accesses during subsequent message processing (which assumes that the message has already been validated), particularly after the addition of _dbus_header_remove_unknown_fields(), which makes it more likely that dbus-daemon will apply non-trivial edits to messages. Thanks: Evgeny Vereshchagin Fixes: e61f13cf "Bug 18064 - more efficient validation for fixed-size type arrays" Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/413 Resolves: CVE-2022-42011 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 079bbf16186e87fb0157adf8951f19864bc2ed69) (cherry picked from commit b9e6a7523085a2cfceaffca7ba1ab4251f12a984)
* test-syntax: Exercise correctly- and incorrectly-nested structs, dictsSimon McVittie2022-10-051-0/+10
| | | | | | | Reproduces: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 67800ac5febc9f15d6c4f113c758797472842ff3) (cherry picked from commit fd73d1ef1ba6ba4e55c07f5e65300bf40a94917f)
* dbus-marshal-validate: Check brackets in signature nest correctlySimon McVittie2022-10-051-1/+37
| | | | | | | | | | | | | | | | | | In debug builds with assertions enabled, a signature with incorrectly nested `()` and `{}`, for example `a{i(u}` or `(a{ii)}`, could result in an assertion failure. In production builds without assertions enabled, a signature with incorrectly nested `()` and `{}` could potentially result in a crash or incorrect message parsing, although we do not have a concrete example of either of these failure modes. Thanks: Evgeny Vereshchagin Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/418 Resolves: CVE-2022-42010 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 9d07424e9011e3bbe535e83043d335f3093d2916) (cherry picked from commit 3e53a785dee8d1432156188a2c4260e4cbc78c4d)
* NEWS: Describe the behaviour change resulting from fixing dbus#416Simon McVittie2022-10-021-0/+22
| | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 1aa0d897c25b22ed9f23ce5bb164b4076687bf9c)
* dbus-server-socket: Make unix:tmpdir equivalent to unix:dirSimon McVittie2022-10-021-12/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On Linux, there are two classes of AF_UNIX socket, which D-Bus refers to as unix:path=... (portable to non-Linux systems) and unix:abstract=... (not portable). Back in 2003 when dbus gained support for abstract Unix sockets on Linux, everyone thought they were better in every way than path-based Unix sockets: if a DBusServer crashes or is terminated abnormally, there's no detritus left in the filesystem. What's not to like? As a result, since commit a70b042f (2003-06-04), when a DBusServer listens on a unix:tmpdir=... address on Linux, the default is for the result to be a unix:abstract=... address, with unix:path=... addresses only used on non-Linux platforms. However, the world has changed in the last 19 years, and namespace-based Linux containers (which didn't exist in 2003) are now very popular. This makes abstract sockets problematic. Abstract sockets are tied to the network namespace, which is all-or-nothing: if a container is to access the Internet without using some sort of proxy or intermediary (like slirp4netns) then it needs to share the network namespace with the host system, and that implies sharing all abstract sockets with the host system. If the well-known session bus is listening on an abstract socket, then it's a sandbox escape route for any sandboxed or containerized app running under the same uid. Conversely, if a container is *not* sharing the network namespace with the host system, then it cannot access a session bus that is listening on an abstract socket without using some sort of proxy (like xdg-dbus-proxy), even if it isn't intended to impose a security boundary and giving it direct access to the session bus would have been more desirable. Path-based sockets do not have this problem because they exist in the filesystem (part of the "everything is a file" Unix philosophy), allowing mount namespaces and bind-mounts to be used to share or unshare them selectively. On systems with `systemd --user` where dbus has been configured with `--enable-user-session`, in general the session bus will already be using a path-based socket for the "user bus", disregarding the listening address specified in /usr/share/dbus-1/session.conf. The default in many recent Linux distributions is either to use dbus-daemon in this way, or to use dbus-broker, a reimplementation of the message bus service which has similar "user bus" behaviour. However, the <listen> address in session.conf is used when dbus-launch(1) or dbus-run-session(1) is used to start a session bus, either manually, via autolaunching, or via system integration glue in operating systems that are not using `systemd --user`. This will occur particularly often in operating systems that boot using a non-systemd init system. Making unix:tmpdir=/tmp equivalent to unix:dir=/tmp ensures that the well-known session bus listens on a path-based socket, allowing container and sandboxing frameworks to mediate access to it in the same way they would for the user bus. The D-Bus Specification already allows (but does not require) this behaviour, because it is the only thing that was implementable on non-Linux systems such as *BSD. This change has the potential to cause regressions. If a container framework enters a chroot or unshares the mount namespace but does not unshare the network namespace, and is relying on the ability for a process inside a container to access the session bus outside the container via its abstract socket, then that assumption will be broken by this change. Some use cases of schroot(1) are likely to suffer from this. However, container frameworks with that assumption would already have found that it does not hold when using the user bus, and it is necessary to break that assumption if we want it to be possible to apply application-level sandboxing in a secure way. Another potential regression from this change is that if a dbus-daemon is terminated abnormally, it will leave a socket in /tmp. Distributors of operating systems where heavy use of dbus-launch(1) is expected might wish to run dbus-cleanup-sockets(1) periodically. This partially reverts commit a70b042f. Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/416 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit f01382ae310c7d63790c07ed280f575d91ea57b8) [backport to 1.14.x: adjust to absence of d98c98d1 in this branch] (cherry picked from commit b5a09fb11c05b3b1922e99d18720f586fc91cd0b)
* Update NEWS for 1.12.xSimon McVittie2022-09-191-1/+13
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* build: Opt out from using mingw-w64's replacement printf(), etc.Simon McVittie2022-09-192-0/+17
| | | | | | | | | | | | | | | | The Windows code in dbus is careful to use Windows-specific equivalents of the Standard C features that are not implemented by msvcrt.dll, so we don't need to substitute a Standard C printf implementation. This avoids compiler warnings/errors when gcc expects us to be using Microsoft printf syntax (`ms_printf` attribute), but newer versions of mingw-w64 expect us to be using GNU or Standard C printf syntax (`gnu_printf` attribute) as a result of `__USE_MINGW_ANSI_STDIO` being enabled by default if not otherwise specified. Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/380 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit daf362ee61170727be0ca5dec1cf39435485ad0c)
* bus/dir-watch: Do not crash with > 128 dirsJan Tojnar2022-09-192-2/+12
| | | | | | | | | | | | Without this running, dbus-daemon with long XDG_DATA_DIRS will crash on out-of-bounds write: $ XDG_DATA_DIRS=$(seq -f "/foo/%g" -s ':' 129) dbus-daemon --session *** stack smashing detected ***: terminated (cherry picked from commit b551b3e9737958216a1a9d359150a4110a9d0549) Backported-from: dbus!302 (cherry picked from commit 9e8fe0718c1abf93e92fcf98c3fe962fc524bfa8)
* Merge branch '1.12-ci' into 'dbus-1.12'Simon McVittie2022-09-132-21/+36
|\ | | | | | | | | Fix CI for 1.12.x See merge request dbus/dbus!342
| * CI: Use Debian 11 'bullseye' for most buildsSimon McVittie2022-09-131-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | dbus 1.12.x was included in both Debian 10 'buster', which is now EOL, and Debian 11 'bullseye', which continues to be supported. I need this branch to work on Debian 11 for security and bugfix backports, but I'm no longer supporting Debian 10. Leave one build variant, the "legacy" build, on Debian 10 to check that we can still build there, to be nice to the Debian LTS subproject. Also continue to use Debian 10 for mingw builds, since dbus#380 has not been fixed in this branch (which is now the security-fix-only old-stable branch, so the fix will not be backported). Signed-off-by: Simon McVittie <smcv@collabora.com>
| * CI: Don't pin msys2 packages to a specific version at allSimon McVittie2022-09-131-13/+15
| | | | | | | | | | | | | | | | | | | | | | | | Similar to dbus/dbus!286, but more so: just use the package names, ignoring their version numbers completely. pcre2 is not strictly needed at the moment, but it'll be a dependency for GLib >= 2.73.x (older versions used pcre). For a bit of future-proofing, download both pcre and pcre2. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 8aa34131dd3665df1c0d6a2c92600e04593d09c0)
| * tools/ci-install.sh: clean up the previously used installation prefix and ↵Ralf Habacker2022-09-131-0/+7
| | | | | | | | | | | | | | | | | | | | the downloaded mingw packages This is necessary to have a clean initial state when running the script locally. Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de> (cherry picked from commit 067733d4b0e7c9c03ee25cb85eecb80980f01f68)
| * tools/ci-install.sh: Use partially qualified versions with mingw package namesRalf Habacker2022-09-131-11/+11
| | | | | | | | | | | | | | Fixes dbus/dbus#388 Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de> (cherry picked from commit 85f5f0503855fed561c010b4676f8aeb3a77424f)
| * tools/ci-install.sh: on debian|ubuntu reduce the need for mingw package name ↵Ralf Habacker2022-09-131-2/+9
|/ | | | | | | | | | | | | | | changes Instead of having to specify an exact version that needs to be adjusted with each repository update, it is now possible to specify package names without version or partially qualified versions, which reduces the frequency of necessary adjustments. This is achieved by searching for the package names in a previously downloaded list of available packages. Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de> (cherry picked from commit 7e9d3708b1fea32c71ede2087083eeb179fc164b)
* Post-release version bumpSimon McVittie2022-02-252-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare v1.12.22dbus-1.12.22Simon McVittie2022-02-252-3/+3
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* doc: Uninstall *.svg generated by DoxygenSimon McVittie2022-02-251-0/+1
| | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 8afc535770f2b82467311c6f6e486f5b88a93941)
* NEWS: UpdateSimon McVittie2022-02-251-0/+21
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Merge branch '1.12-backports' into 'dbus-1.12'Simon McVittie2022-02-256-24/+146
|\ | | | | | | | | [1.12.x] Backport various fixes to dbus-1.12 See merge request dbus/dbus!258
| * bus/signal: fix compilation when only -Dembedded-testsMarc-André Lureau2022-02-251-2/+2
| | | | | | | | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> (cherry picked from commit a58d46b78957de03119dd54ab1a8346ff850abdb)
| * sysdeps-unix: Diagnose failure to open /proc/self/oom_score_adjSimon McVittie2022-02-251-3/+10
| | | | | | | | | | | | | | | | | | | | Previously, we silently ignored this, but now that we're more careful about the contexts in which we try to reset the OOM score and whether we log failures as a warning, we can let the dbus-daemon-launch-helper show a message if it can't write there. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 226f24144a4db4898a1f5958293d200b975baee0)
| * spawn-unix: Don't log an error if unable to reset Linux OOM scoreSimon McVittie2022-02-251-7/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We cannot safely log between fork() and exec() because it isn't an async-signal-safe operation (in particular it might allocate memory). We also don't want to treat a failure here as a real problem, because it might legitimately not work: in a system dbus-daemon that has dropped privileges from root, the pseudo-file representing this process parameter remains owned by root and cannot be altered by the unprivileged user. For the main use-case for this operation, the system dbus-daemon, we have another opportunity to do this in the dbus-daemon-launch-helper (see the previous commit). Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 7ee72a27957be5d3436beaa02ccd01b9ce042962)
| * dbus-daemon-launch-helper: Reset Linux OOM score adjustment hereSimon McVittie2022-02-251-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, we were relying on the system bus being able to reset its OOM score adjustment after it forks, but before it execs the dbus-daemon-launch-helper. However, it can't actually do that (leading to dbus#378), because the system bus typically starts as root, uses its root privileges to adjust resource limits, and then drops privileges to the `@DBUS_USER@`, typically `dbus` or `messagebus`. This leaves the pseudo-files in /proc for its process parameters owned by root, and the `@DBUS_USER@` is not allowed to open them for writing. The dbus-daemon-launch-helper is setuid root, so it can certainly alter its OOM score adjustment before exec'ing the actual activated service. We need to do this before dropping privileges, because after dropping privileges we would be unable to write to this process parameter. This is a non-async-signal-safe context, so we can safely log errors here, unlike the fork-and-exec code paths. Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/378 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 2efb462466d628d47d7f80c5a8e864a62b6154cc)
| * spawn-unix: On Linux, don't try to increase OOM-killer protectionSimon McVittie2022-02-251-6/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The oom_score_adj parameter is a signed integer, with increasingly positive values being more likely to be killed by the OOM-killer, and increasingly negative values being less likely. Previously, we assumed that oom_score_adj would be negative or zero, and reset it to zero, which does not require privileges because it meant we're voluntarily giving up our OOM-killer protection. In particular, bus/dbus.service.in has OOMScoreAdjust=-900, which we don't want system services to inherit. However, systemd >= 250 has started putting a positive oom_score_adj on user processes, to make it more likely that the OOM killer will kill a user process rather than a system process. Changing from a positive oom_score_adj to zero is increasing protection from the OOM-killer, which only a privileged process is allowed to do, resulting in warnings whenever we carry out traditional (non-systemd) service activation on the session bus. To avoid this, do the equivalent of: if (oom_score_adj < 0) oom_score_adj = 0; which is always allowed. Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/374 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit c42bb64457c3b31e561ad9885c618e051af1171a)
| * sysdeps-unix: Factor out _dbus_reset_oom_score_adjSimon McVittie2022-02-253-16/+71
| | | | | | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit f3ffe9a873708c679df88b9fc12b6b831539cf8a)
| * spawn-unix: Correct indentationSimon McVittie2022-02-251-1/+1
| | | | | | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 715a1a920d06f5c7ee66629691ff892d7870ff04)
| * tests: Ensure session bus has started before integration testSimon McVittie2022-02-251-2/+13
|/ | | | | | | | | | | The session dbus-daemon won't necessarily be run immediately on login if we are using systemd socket activation for it, and the transient services directory $XDG_RUNTIME_DIR/dbus-1/services isn't created until it's actually run. Ping the dbus-daemon to make sure it's available. Signed-off-by: Simon McVittie <smcv@debian.org> Bug-Debian: https://bugs.debian.org/1005889 (cherry picked from commit 47a4bdfaf8f31ebb20f2d0b549109cb946b08440)
* Merge branch '1.12-ci' into 'dbus-1.12'Simon McVittie2022-02-254-167/+195
|\ | | | | | | | | [1.12.x] CI: Partially catch up with 1.13.x See merge request dbus/dbus!259
| * CI: Remove EOL versions of Debian and UbuntuSimon McVittie2022-02-253-82/+9
| | | | | | | | | | | | | | | | | | | | | | Debian 9 'stretch' is EOL, and Ubuntu 16.04 is EOL unless you enter into a special subscription with Canonical. This puts them outside our informal security-support policy, and realistically, anyone sufficiently change-averse to be following these distributions is not going to be backporting a current version of dbus. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 69c610f6f084a3f68994043d2bf11f18016e8052)
| * .gitlab-ci.yml: Use x86_64 build chain to cross build 64bit executablesRalf Habacker2022-02-251-2/+2
| | | | | | | | | | | | | | This error was discovered when working with the merge request dbus/dbus!158. (cherry picked from commit 74717a9c0cec5879f405b4e439aded80c2b6dc7f)
| * Remove `build:` prefix from jobs to make labels more visible in pipeline pageRalf Habacker2022-02-251-11/+11
| | | | | | | | | | | | | | | | | | The length if the displayed jobs is limited on the gitlab CI pipeline page and is occupied partly be the prefix. Cherry-picked from dbus/dbus/!192 (cherry picked from commit d2bab84329e7ca34011d64cafd6af5d1399789ec)
| * CI: Don't build on Debian 8 'jessie'Simon McVittie2022-02-252-9/+0
| | | | | | | | | | | | | | | | Debian 8 'jessie' has reached EOL for mainstream security support, which puts it outside our usual distribution/OS support policy. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 3ce28815e9bd07bc8ebf2e36cc5e75815f535c19)
View Lorry Controller Status