summaryrefslogtreecommitdiff
path: root/bus/activation.c
Commit message (Collapse)AuthorAgeFilesLines
* Add SPDX license marker for the AFL-2.1 OR GPL-2.0-or-later licenseRalf Habacker2023-01-041-0/+2
| | | | | | | | | The full license texts are not added because they were already added in a previous commit. Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de> see #394
* Avoid assertation in bus_activation_reload()Ralf Habacker2021-12-091-7/+13
| | | | | | | | In the mentioned function a local DBusError instance is now used to fulfill the requirement of dbus_error_has_name() that the parameter 'error' must not be null. See #360
* Configure option to disable traditional activationTopi Miettinen2019-03-251-7/+34
| | | | | | | | Traditional activation could be disabled if all services use SystemdService activation instead. Provide an example of a hardened DBus systemd service drop-in file for such a setup. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* dbus-spawn: Don't take ownership of envpSimon McVittie2019-01-051-0/+1
| | | | | | | | | | | | It's unexpected for a function to take ownership of its arguments without indicating that in its name, or at least documenting it. The only caller with envp != NULL is in bus_activation_activate_service(), which has been updated. Based on part of a larger commit by Ralf Habacker. Signed-off-by: Simon McVittie <smcv@collabora.com>
* embedded tests: Conform to the same API for all testsSimon McVittie2018-12-171-3/+6
| | | | | | | | | This will make it possible to unify the wrapper code that runs them. I'm using a plain C string rather than a DBusString to make it more straightforward to carve out tests into their own executables. Signed-off-by: Simon McVittie <smcv@collabora.com>
* activation: Don't leak if delivering activation message is forbiddenSimon McVittie2018-12-031-0/+1
| | | | | | | | | | | | | This is technically a denial of service because the dbus-daemon will run out of memory eventually, but it's a very slow and noisy one, because all the rejected messages are also very likely to have been logged to the system log. Detected by AddressSanitizer. Signed-off-by: Simon McVittie <smcv@collabora.com> Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/234 Reviewed-by: pwithnall
* _DBUS_ASSERT_ERROR_XOR_BOOL: Add and useSimon McVittie2018-11-201-4/+1
| | | | | | As suggested by Philip Withnall in dbus!43. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Add and use _dbus_list_clear_fullSimon McVittie2018-08-021-6/+4
| | | | | | | | | | | In gcc 8, -Wall -Wextra includes -Wcast-function-type, which warns about passing an extra (unwanted) parameter to callbacks. Instead of using _dbus_list_foreach(), add a function to do what we actually wanted here. Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=107349 Reviewed-by: Thiago Macieira <thiago@kde.org>
* bus: Document arguments of bus_activation_activate_serviceSimon McVittie2018-06-211-0/+19
| | | | | | | | It isn't completely obvious that connection is allowed to be NULL here. Signed-off-by: Simon McVittie <smcv@collabora.com> Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=105656
* bus: Clear INVOCATION_ID when carrying out traditional activationSimon McVittie2018-03-221-1/+7
| | | | | | | | | We weren't sure whether this one should be inherited or not, so I asked on systemd-devel, and Lennart thought it shouldn't. Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=104641 Reviewed-by: Philip Withnall <withnall@endlessm.com>
* bus: Don't pass systemd environment variables to activated servicesSimon McVittie2018-03-021-0/+30
| | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=104641 Reviewed-by: Philip Withnall <withnall@endlessm.com>
* bus: Silence the output of the test services when doing OOM testingSimon McVittie2017-11-151-0/+5
| | | | | | | | | The echo service frequently fails to connect to the bus when we are testing OOM code paths, again causing a lot of noise in the log. Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103601
* bus: Silence most log messages when testing OOM handlingSimon McVittie2017-11-151-2/+3
| | | | | | | | | In parts of the OOM testing, our logging produces multiple megabytes of output. Let's not do that. Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103601
* Prefer to use _dbus_test_fatal() for assertion failures in testsSimon McVittie2017-11-151-3/+4
| | | | | | | | | | | | This is a little more self-documenting - it justifies why it's acceptable to fail hard on out-of-memory conditions. _dbus_test_fatal() isn't compiled unless we are compiling embedded tests, so compiling with embedded tests disabled provides reasonable confidence that we aren't using _dbus_test_fatal() inappropriately. Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <smcv@collabora.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103601
* Add a missing space in logging outputThomas Zajic2017-11-141-1/+1
| | | | | Reviewed-by: Philip Withnall <withnall@endlessm.com> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=103729
* activation: Add support for enforcing strict naming on .service filesSimon McVittie2017-02-211-4/+77
| | | | | | | | | | | This is done on a per-directory basis. The use of the BusContext here means we have to make the activation test a little more realistic, by providing a non-NULL BusContext. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99825 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* config-parser: Store service directories in structsSimon McVittie2017-02-211-2/+9
| | | | | | | | | | | | | | This lets us give them a flags word, which we immediately use to track whether this directory should be watched with inotify or equivalent. The struct name is unfortunately a bit odd, because I had aimed to use BusServiceDir, but activation.c already has BusServiceDirectory so that would have been too confusing. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99825 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* activation test: Use more realistic bus names for servicesSimon McVittie2017-02-201-3/+3
| | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99825 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* activation: Put activation directories in an ordered listSimon McVittie2017-02-201-20/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | There are two circumstances in which we load .service files. The first is bus_activation_reload(), which is given an ordered list of directory paths, and reads each one in its correct order, highest-precedence first (normally ~/.local/share > /usr/local/share > /usr/share). This seems correct. However, if we are asked to activate a service for which we do not know of a .service file, we opportunistically reload the search path and try again, in the hope that it was recently-installed and not yet discovered by inotify. Prior to this commit, this would iterate through the hash table in arbitrary hash order, so we might load a service from /usr/share even though it was meant to be masked by a higher-priority service file in ~/.local/share or /usr/local/share. Before I add more elements to the search path, we should make sure it is always searched in the expected order. We do not actually make use of the hash table's faster-than-O(n) lookup by directory path anywhere, so there is no point in using a hash table, and we can safely replace it with an ordered data structure. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99825 Reviewed-by: Philip Withnall <withnall@endlessm.com> Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* Merge branch 'dbus-1.10'Simon McVittie2017-02-161-15/+5
|\
| * activation test: Fix time-of-check/time-of-use bug waiting to happenSimon McVittie2017-02-161-15/+5
| | | | | | | | | | | | | | | | | | Creating a directory is atomic, stat'ing it to see whether to remove it is very much not. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=99828 Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Philip Withnall <withnall@endlessm.com>
| * dbus_activation_systemd_failure: do not use non-literal format stringSimon McVittie2016-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In principle this could lead to arbitrary memory overwrite via a format string attack in the message received from systemd, resulting in arbitrary code execution. This is not believed to be an exploitable security vulnerability on the system bus in practice: it can only be exploited by the owner of the org.freedesktop.systemd1 bus name, which is restricted to uid 0, so if systemd is attacker-controlled then the system is already doomed. Similarly, if a systemd system unit mentioned in the activation failure message has an attacker-controlled name, then the attacker likely already has sufficient access to execute arbitrary code as root in any case. However, prior to dbus 1.8.16 and 1.9.10, due to a missing check for systemd's identity, unprivileged processes could forge activation failure messages which would have gone through this code path. We thought at the time that this was a denial of service vulnerability (CVE-2015-0245); this bug means that it was in fact potentially an arbitrary code execution vulnerability. Bug found using -Wsuggest-attribute=format and -Wformat-security. Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Colin Walters <walters@verbum.org> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98157
| * Do not require systemd to have a service file if using it for activationSimon McVittie2015-12-021-12/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With --systemd-activation we special-case the name org.freedesktop.systemd1 by assuming that it will eventually connect to the bus. With that in mind, we can ignore whether it has a .service file, and let it be "activated" regardless. This fixes a regression test failure on non-systemd systems such as the Ubuntu 14.04 OS on travis-ci.org: UpdateActivationEnvironment failed, because it tried to update the (fake) systemd environment, but because systemd was not actually installed, there was no service file for it in the system's search paths. We could address this by placing a dummy service file with Exec=/bin/false in our search path like the real systemd does, but it seems cleaner to not require this; this would eventually enable the real systemd to stop installing that dummy service file. This would not happen outside the regression tests, because there is no sense in using --systemd-activation without systemd installed. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=93194 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
* | Mediate auto-activation attempts through AppArmorSimon McVittie2016-11-281-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Because the recipient process is not yet available, we have to make some assumption about its AppArmor profile. Parsing the first word of the Exec value and then chasing symlinks seems like too much magic, so I've gone for something more explicit. If the .service file contains AssumedAppArmorLabel=/foo/bar then we will do the AppArmor query on the assumption that the recipient AppArmor label will be as stated. Otherwise, we will do a query with an unspecified label, which means that AppArmor rules that do specify a peer label will never match it. Regardless of the result of this query, we will do an independent AppArmor query when the activation has actually happened, this time with the correct peer label; that second query will still be used to decide whether to deliver the message. As a result, if this change has any effect, it is to make the bus more restrictive; it does not allow anything that would previously have been denied. Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98666
* | Do not auto-activate services if we could not send a messageSimon McVittie2016-11-281-2/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We specifically do not check recipient policies, because the recipient policy is based on properties of the recipient process (in particular, its uid), which we do not necessarily know until we have already started it. In this initial implementation we do not check LSMs either, because we cannot know what LSM context the recipient process is going to have. However, LSM support will need to be added to make this feature useful, because StartServiceByName is normally allowed in non-LSM environments, and is more powerful than auto-activation anyway. The StartServiceByName method does not go through this check, because if access to that method has been granted, then it's somewhat obvious that you can start arbitrary services. Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98666
* | dbus_activation_systemd_failure: do not use non-literal format stringSimon McVittie2016-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In principle this could lead to arbitrary memory overwrite via a format string attack in the message received from systemd, resulting in arbitrary code execution. This is not believed to be an exploitable security vulnerability on the system bus in practice: it can only be exploited by the owner of the org.freedesktop.systemd1 bus name, which is restricted to uid 0, so if systemd is attacker-controlled then the system is already doomed. Similarly, if a systemd system unit mentioned in the activation failure message has an attacker-controlled name, then the attacker likely already has sufficient access to execute arbitrary code as root in any case. However, prior to dbus 1.8.16 and 1.9.10, due to a missing check for systemd's identity, unprivileged processes could forge activation failure messages which would have gone through this code path. We thought at the time that this was a denial of service vulnerability (CVE-2015-0245); this bug means that it was in fact potentially an arbitrary code execution vulnerability. Bug found using -Wsuggest-attribute=format and -Wformat-security. Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Colin Walters <walters@verbum.org> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98157
* | bus: Add sender name to bus activation log messagesPhilip Withnall2016-10-051-8/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This clarifies Activating via systemd: service name='com.example.Example' unit='example.service' to Activating via systemd: service name='com.example.Example' unit='example.service' requested by ':1.23' (uid 1000 pid 123 comm "whatever-activat") Similarly for the non-systemd code paths. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=68212 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Only redirect child processes to systemd Journal if using syslogSimon McVittie2016-09-301-0/+5
| | | | | | | | | | | | | | | | | | In particular this means the test suite won't spam the Journal any more. Signed-off-by: Simon McVittie <smcv@debian.org> Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=97009
* | Log max_pending_service_starts (aka max_pending_activations) when exceededSimon McVittie2016-08-161-4/+8
| | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86442
* | Log service_start_timeout (aka activation_timeout) when we exceed itSimon McVittie2016-08-161-4/+10
| | | | | | | | | | | | Also upgrade it to a warning. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86442
* | Add new functions _dbus_hash_table_to_array() and ↵Ralf Habacker2016-02-121-92/+2
| | | | | | | | | | | | | | | | | | _dbus_hash_table_from_array() from related activation code. These functions are required for dbus-run-session. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92899 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Do not require systemd to have a service file if using it for activationSimon McVittie2015-12-021-12/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With --systemd-activation we special-case the name org.freedesktop.systemd1 by assuming that it will eventually connect to the bus. With that in mind, we can ignore whether it has a .service file, and let it be "activated" regardless. This fixes a regression test failure on non-systemd systems such as the Ubuntu 14.04 OS on travis-ci.org: UpdateActivationEnvironment failed, because it tried to update the (fake) systemd environment, but because systemd was not actually installed, there was no service file for it in the system's search paths. We could address this by placing a dummy service file with Exec=/bin/false in our search path like the real systemd does, but it seems cleaner to not require this; this would eventually enable the real systemd to stop installing that dummy service file. This would not happen outside the regression tests, because there is no sense in using --systemd-activation without systemd installed. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=93194 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
* | monitor: use the addressed_recipient to select matchesSimon McVittie2015-11-171-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | This means we respect the destination keyword in arguments to BecomeMonitor. In bus_dispatch(), this means that we need to defer capturing until we have decided whether there is an addressed recipient; so instead of capturing once, we capture at each leaf of the decision tree. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92074 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk> Reviewed-by: Lars Uebernickel <lars@uebernic.de>
* | Merge branch 'dbus-1.10'Ralf Habacker2015-11-161-8/+9
|\ \ | |/
| * Fix memory leaks in bus_activation_service_reload_test() in case of errors.Ralf Habacker2015-11-111-8/+9
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92721 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
| * Revert "Fix memory leaks in bus_activation_service_reload_test() in case of ↵Ralf Habacker2015-11-111-9/+8
| | | | | | | | | | | | errors." This reverts commit d8569ac647da4d62c7a251d8e809f2d545a77837.
| * Fix memory leaks in bus_activation_service_reload_test() in case of errors.Ralf Habacker2015-11-111-8/+9
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92721 Reviewed-by: https://bugs.freedesktop.org/show_bug.cgi?id=92721
* | Use DBusString for all relocation and install-root codeSimon McVittie2015-10-051-3/+14
|/ | | | | | | | | | | | | | | | This means we handle OOM correctly, and makes it obvious that we are not overflowing buffers. This change does not affect the actual content of the strings. Instead of redefining DBUS_DATADIR to be a function call (which hides the fact that DBUS_DATADIR is used), this patch makes each use explicit: DBUS_DATADIR is always the #define from configure or cmake, before replacing the prefix. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83539 Tested-by: Ralf Habacker <ralf.habacker@freenet.de> Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
* Cancel pending activation on any activation errorSimon McVittie2015-10-021-25/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the error reporting if you make two attempts to activate a service that cannot be activated due to an error that is reported synchronously, such as a system service with no User= line in its .service file. This is easy to reproduce with the gdbus(1) tool, which sends an Introspect call in addition to the one you asked it to. If you try to activate a service using gdbus call --session -d com.example.FailToActivate \ -o / -m org.freedesktop.DBus.Peer.Ping then gdbus will actually send two method calls: one Introspect, and one Ping. The Introspect gets the correct error reply, but when dbus-daemon enters bus_activation_activate_service() for the Ping call, it sees that there is a pending activation and does an early-return. The pending activation does not finish until the timeout is reached. A couple of error cases handled this correctly, but the majority did not; make them all go into the same code path. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=92200 Reviewed-by: Thiago Macieira <thiago@kde.org>
* Fail to generate random bytes instead of falling back to rand()Simon McVittie2015-05-141-1/+1
| | | | | | | | | | This is more robust against broken setups where we run out of memory or cannot read /dev/urandom. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90414 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de> [smcv: document @error] Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* test_remove_directory: Fix 'variable iter going out of scope leaks the ↵Ralf Habacker2015-05-011-0/+1
| | | | | | | | | storage it points to' (CID 54729) Reported by Coverity: CID 54729: Resource leak (RESOURCE_LEAK) Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90021 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* Capture all messages received or sent, and send them to monitorsSimon McVittie2015-02-041-0/+11
| | | | | | | | Unlike eavesdropping, the point of capture is when the message is received, except for messages originating inside the dbus-daemon. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=46787 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
* bus_context_log_and_set_error: add and useSimon McVittie2015-02-031-5/+2
| | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810 Reviewed-by: Philip Withnall
* Use DBUS_SYSTEM_LOG_WARNING for failure to alter fd-limitsSimon McVittie2014-11-181-1/+1
| | | | | Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105
* Merge branch 'dbus-1.8'Simon McVittie2014-11-061-1/+27
|\ | | | | | | | | | | Conflicts: NEWS configure.ac
| * CVE-2014-7824: set fd rlimit to 64k for the system dbus-daemonSimon McVittie2014-11-061-1/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that our rlimit is actually high enough to avoid the denial of service described in CVE-2014-3636 part A. CVE-2014-7824 has been allocated for this incomplete fix. Restore the original rlimit for activated services, to avoid them getting undesired higher limits. (Thanks to Alban Crequy for various adjustments which have been included in this commit.) Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105 Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
* | free_pending_restore_data --> free_restore_pending_dataChengwei Yang2014-09-091-3/+3
| | | | | | | | | | | | | | | | This patch doesn't do any function change, but only the function name, to align its name with the struct RestorePendingData. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=72254 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Improve debug message to be able to see empty files.Ralf Habacker2014-09-081-1/+1
|/ | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* CVE-2014-3477: deliver activation errors correctly, fixing Denial of ServiceAlban Crequy2014-06-051-7/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | How it should work: When a D-Bus message activates a service, LSMs (SELinux or AppArmor) check whether the message can be delivered after the service has been activated. The service is considered activated when its well-known name is requested with org.freedesktop.DBus.RequestName. When the message delivery is denied, the service stays activated but should not receive the activating message (the message which triggered the activation). dbus-daemon is supposed to drop the activating message and reply to the sender with a D-Bus error message. However, it does not work as expected: 1. The error message is delivered to the service instead of being delivered to the sender. As an example, the error message could be something like: An SELinux policy prevents this sender from sending this message to this recipient, [...] member="MaliciousMethod" If the sender and the service are malicious confederates and agree on a protocol to insert information in the member name, the sender can leak information to the service, even though the LSM attempted to block the communication between the sender and the service. 2. The error message is delivered as a reply to the RequestName call from service. It means the activated service will believe it cannot request the name and might exit. The sender could activate the service frequently and systemd will give up activating it. Thus the denial of service. The following changes fix the bug: - bus_activation_send_pending_auto_activation_messages() only returns an error in case of OOM. The prototype is changed to return TRUE, or FALSE on OOM (and its only caller sets the OOM error). - When a client is not allowed to talk to the service, a D-Bus error message is pre-allocated to be delivered to the client as part of the transaction. The error is not propagated to the caller so RequestName will not fail (except on OOM). [fixed a misleading comment -smcv] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78979 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Colin Walters <walters@verbum.org>
* Merge branch 'dbus-1.6'Simon McVittie2013-11-121-1/+1
|\
View Lorry Controller Status