summaryrefslogtreecommitdiff
path: root/bus
Commit message (Collapse)AuthorAgeFilesLines
* bus_context_log_and_set_error: add and useSimon McVittie2015-02-034-25/+39
| | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810 Reviewed-by: Philip Withnall
* bus_context_log_literal: add simplified version of bus_context_logSimon McVittie2015-02-032-1/+24
| | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810 Reviewed-by: Philip Withnall
* bus: put the printf attribute in the header where it will do more goodSimon McVittie2015-02-032-4/+1
| | | | | | | | Now we can actually notice incorrect format strings in other translation units. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810 Reviewed-by: Philip Withnall
* bus driver: factor out bus_driver_check_caller_is_privileged, and allow rootSimon McVittie2015-02-031-29/+107
| | | | | | | | | | | | Unlike the initial mitigation for CVE-2014-8148, we now allow uid 0 to call UpdateActivationEnvironment. There's no point in root doing that, but there's also no reason why it's particularly bad - if an attacker is uid 0 we've already lost - and it simplifies use of this function for future things that do want to be callable by root, like BecomeMonitor for #46787. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810 Reviewed-by: Philip Withnall
* Update .gitignore filesLukasz Skalski2015-02-031-0/+2
| | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88943 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* bus: exit on fatal errors even if not sysloggingSimon McVittie2015-02-021-0/+4
| | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88808 Reviewed-by: Philip Withnall
* selinux: avoid leaking on systems where va_start allocates memorySimon McVittie2015-01-061-1/+3
| | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88087
* Fix assertion in regression test to be equality test, not assignmentSimon McVittie2015-01-061-1/+1
| | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88088
* Merge branch 'dbus-1.8' and prepare 1.9.6dbus-1.9.6Simon McVittie2015-01-013-2/+79
|\ | | | | | | | | | | | | Conflicts: NEWS configure.ac test/dbus-daemon.c
| * Hardening: only accept Stats function calls at the canonical object pathSimon McVittie2015-01-011-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These function calls are not a privilege escalation risk like UpdateActivationEnvironment, but they might provide sensitive information or be enhanced to provide sensitive information in future, so the default system.conf locks them down to root-only. Apply the same canonical-object-path hardening as for UpdateActivationEnvironment. We do not apply the uid check here because they are less dangerous than UpdateActivationEnvironment, and because the ability to unlock these function calls for specific uids is a documented configuration for developers. Reviewed-by: Thiago Macieira <thiago@kde.org> [added missing #include; extended commit message -smcv]
| * Hardening: only allow the uid of the dbus-daemon to call ↵Simon McVittie2015-01-011-0/+35
| | | | | | | | | | | | | | | | | | | | | | UpdateActivationEnvironment As with the previous commit, this is probably not actually privilege escalation due to the use of an activation helper that cleans up its environment, but let's be extra-careful here. Reviewed-by: Thiago Macieira <thiago@kde.org> [adjusted commit message -smcv]
| * Hardening: reject UpdateActivationEnvironment on non-canonical pathSimon McVittie2015-01-012-2/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UpdateActivationEnvironment is the one dbus-daemon API call that is obviously dangerous (it is intended for the session bus), so the default system.conf does not allow anyone to call it. It has recently come to the D-Bus maintainers' attention that some system services incorrectly install D-Bus policy rules that allow arbitrary method calls to any destination as long as they have a "safe" object path. This is not actually safe: some system services that use low-level D-Bus bindings like libdbus, including dbus-daemon itself, provide the same API on all object paths. Unauthorized calls to UpdateActivationEnvironment are probably just resource consumption rather than privilege escalation, because on the system bus, the modified environment is only used to execute a setuid wrapper that avoids LD_PRELOAD etc. via normal setuid handling, and sanitizes its own environment before executing the real service. However, it's safest to assume the worst and treat it as a potential privilege escalation. Accordingly, as a hardening measure to avoid privilege escalation on systems with these faulty services, stop allowing calls to ("/com/example/Whatever", "org.freedesktop.DBus.UpdateActivationEnvironment") and only allow ("/org/freedesktop/DBus", "org.freedesktop.DBus.UpdateActivationEnvironment"). We deliberately continue to provide read-only APIs like GetConnectionUnixUser at all object paths, for backwards compatibility. Reviewed-by: Thiago Macieira <thiago@kde.org> [adjusted commit message to note that this is probably only DoS -smcv]
* | Upgrade auth_timeout violation to a warning, since this branch has thoseSimon McVittie2014-11-241-1/+1
| |
* | Merge branch 'dbus-1.8'Simon McVittie2014-11-242-1/+9
|\ \ | |/ | | | | | | | | Conflicts: NEWS configure.ac
| * Revert "config: change default auth_timeout to 5 seconds"Simon McVittie2014-11-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 54d26df52b6a394bea175651d1d7ad2ab3f87dea. It appears this change may cause intermittent slow or failed boot, more commonly on slower/older machines, in at least Mageia and possibly also Debian. This would indicate that while the system is under load, system services are not completing authentication within 5 seconds. This change was not the main part of fixing CVE-2014-3639, but does help to mitigate that attack. As such, increasing this timeout makes the denial of service attack described by CVE-2014-3639 somewhat more effective: a local user connecting to the system bus repeatedly from many parallel processes can cause other users' attempts to connect to take longer. If your machine boots reliably with the shorter timeout, and resilience against local denial of service attacks is important to you, putting this in /etc/dbus-1/system-local.conf or a file matching /etc/dbus-1/system.d/*.conf can restore the lower limit: <busconfig> <limit name="auth_timeout">5000</limit> </busconfig> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431
| * Log to syslog when auth_timeout drops an incomplete connectionSimon McVittie2014-11-221-0/+8
| | | | | | | | | | | | | | This is a symptom of either a denial of service attack, or a serious performance problem. Either way, sysadmins should know. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431
* | Use DBUS_SYSTEM_LOG_WARNING for failure to alter fd-limitsSimon McVittie2014-11-182-3/+3
| | | | | | | | | | Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105
* | Merge branch 'dbus-1.8'Simon McVittie2014-11-141-1/+1
|\ \ | |/
| * Set error when message delivery is denied due to receive ruleJacek Bukarewicz2014-11-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This makes bus_context_check_security_policy follow convention of setting errors if function indicates failure and has error parameter. Notable implication is that AccessDenied error will be sent if sending message to addressed recipient is denied due to receive rule. Previously, message was silently dropped. This also fixes assertion failure when message is denied at addressed recipient while sending pending auto activation messages. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86194
* | Merge branch 'dbus-1.8'Simon McVittie2014-11-063-11/+68
|\ \ | |/ | | | | | | | | Conflicts: NEWS configure.ac
| * CVE-2014-7824: set fd rlimit to 64k for the system dbus-daemonSimon McVittie2014-11-063-11/+68
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that our rlimit is actually high enough to avoid the denial of service described in CVE-2014-3636 part A. CVE-2014-7824 has been allocated for this incomplete fix. Restore the original rlimit for activated services, to avoid them getting undesired higher limits. (Thanks to Alban Crequy for various adjustments which have been included in this commit.) Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85105 Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
* | Implement NetBSD credentials-passing with LOCAL_PEEREIDPatrick Welche2014-11-061-0/+5
| | | | | | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=69702 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk> Tested-by: Patrick Welche <prlw1@cam.ac.uk>
* | Use a better NoReply message for disconnection with reply pendingSimon McVittie2014-10-291-1/+6
| | | | | | | | | | | | | | | | | | | | As an implementation detail, dbus-daemon handles this situation by artificially triggering a timeout (even if its configured timeout for method calls is in fact infinite). However, using the same debug message for both is misleading, and can lead people who are debugging a service crash to blame dbus-daemon instead, wasting their time. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=76112
* | build: include dbus-sysdeps-unix.h for _dbus_fd_set_close_on_execPatrick Welche2014-10-281-0/+1
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85563 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | test-bus, test-dbus: close any inherited fds from callerSimon McVittie2014-10-241-0/+9
| | | | | | | | | | | | | | | | | | | | It is probably a bug for them to pass us any fds without close-on-exec; but apparently CMake has this bug, and so does at least some NetBSD GUI environment. Cope. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73689 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83899 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
* | config: add examples to show how to enable/disable the Stats interfaceAlban Crequy2014-10-013-1/+40
| | | | | | | | | | | | | | [install examples to ${docdir}/examples -smcv] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80759 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Enable Stats interface by default; disallow non-root use on system busSimon McVittie2014-10-011-1/+14
| | | | | | | | | | | | | | [fix typo in interface name -alban] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80759 Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Use ISO C strchr() instead of BSD index()Simon McVittie2014-09-251-2/+4
| | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
* | match_rule_to_string: add testAlban Crequy2014-09-251-1/+23
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | match_rule_to_string: fix escapingAlban Crequy2014-09-251-14/+51
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | match_rule_to_string: returns NULL if no memory instead of loopingAlban Crequy2014-09-251-14/+7
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Stats: GetAllMatchRules: add testsAlban Crequy2014-09-251-14/+150
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Implement GetAllMatchRules on the Stats interfaceAlban Crequy2014-09-255-2/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usage: $ dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus \ org.freedesktop.DBus.Debug.Stats.GetAllMatchRules method return sender=org.freedesktop.DBus -> dest=:1.13 reply_serial=2 array [ dict entry( string ":1.4" array [ ] ) dict entry( string ":1.9" array [ string "type='signal',interface='org.freedesktop.DBus',member='NameOwnerChanged'" ] ) dict entry( string ":1.11" array [ string "eavesdrop='true'" ] ) ] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | inotify: make sure we set the close-on-exec flagSimon McVittie2014-09-231-0/+6
| | | | | | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73689 Reviewed-by: Ralf Habacker [add <dbus/dbus-sysdeps-unix.h> which is now required for _dbus_fd_set_close_on_exec -smcv]
* | Merge branch 'dbus-1.8'Simon McVittie2014-09-166-28/+154
|\ \ | |/ | | | | | | | | Conflicts: NEWS configure.ac
| * bus: enforce pending_fd_timeoutAlban Crequy2014-09-151-0/+71
| | | | | | | | | | | | | | | | | | | | | | | | This is one of four commits needed to address CVE-2014-3637. The bus uses _dbus_connection_set_pending_fds_function and _dbus_connection_get_pending_fds_count to be notified when there are pending file descriptors. A timeout per connection is armed and disarmed when the file descriptor list is used and emptied. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80559 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
| * config: add new limit: pending_fd_timeoutAlban Crequy2014-09-154-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is one of four commits needed to address CVE-2014-3637. When a file descriptor is passed to dbus-daemon, the associated D-Bus message might not be fully sent to dbus-daemon yet. Dbus-daemon keeps the file descriptor in the DBusMessageLoader of the connection, waiting for the rest of the message. If the client stops sending the remaining bytes, dbus-daemon will wait forever and keep that file descriptor. This patch adds pending_fd_timeout (milliseconds) in the configuration to disconnect a connection after a timeout when a file descriptor was sent but not the remaining message. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80559 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
| * Stop listening on DBusServer sockets when reaching max_incomplete_connectionsAlban Crequy2014-09-154-25/+58
| | | | | | | | | | | | | | | | | | This addresses the parts of CVE-2014-3639 not already addressed by reducing the default authentication timeout. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80851 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80919 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
| * config: change default auth_timeout to 5 secondsAlban Crequy2014-09-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This partially addresses CVE-2014-3639. This will change the default on the system bus where the limit <limit name="auth_timeout">...</limit> is not specified. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80919 Reviewed-by: Thiago Macieira <thiago@kde.org> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
| * config: change DEFAULT_MESSAGE_UNIX_FDS to 16Simon McVittie2014-09-151-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This addresses CVE-2014-3636. Based on a patch by Alban Crequy. Now that it's the same on all platforms, there's little point in it being set by configure/cmake. This change fixes two distinct denials of service: fd.o#82820, part A ------------------ Before this patch, the system bus had the following default configuration: - max_connections_per_user: 256 - DBUS_DEFAULT_MESSAGE_UNIX_FDS: usually 1024 (or 256 on QNX, see fd.o#61176) as defined by configure.ac - max_incoming_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS*4 = usually 4096 - max_outgoing_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS*4 = usually 4096 - max_message_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS = usually 1024 This means that a single user could create 256 connections and transmit 256*4096 = 1048576 file descriptors. The file descriptors stay attached to the dbus-daemon process while they are in the message loader, in the outgoing queue or waiting to be dispatched before D-Bus activation. dbus-daemon is usually limited to 65536 file descriptors (ulimit -n). If the limit is reached and dbus-daemon needs to receive a message with a file descriptor attached, this is signalled by recvfrom with the flag MSG_CTRUNC. Dbus-daemon cannot recover from that error because the kernel does not have any API to retrieve a file descriptor which has been discarded with MSG_CTRUNC. Therefore, it closes the connection of the sender. This is not necessarily the connection which generated the most file descriptors so it can lead to denial-of-service attacks. In order to prevent DoS issues, this patch reduces DEFAULT_MESSAGE_UNIX_FDS to 16: max_connections_per_user * max_incoming_unix_fds = 256 * 64 = 16384 This is less than the usual "ulimit -n" (65536) with a good margin to accomodate the other sources of file descriptors (stdin/stdout/stderr, listening sockets, message loader, etc.). Distributors on non-Linux may need to configure a smaller limit in system.conf, if their limit on the number of fds is smaller than Linux's. fd.o#82820, part B ------------------ On Linux, it's not possible to send more than 253 fds in a single sendmsg() call: sendmsg() would return -EINVAL. #define SCM_MAX_FD 253 SCM_MAX_FD changed value during Linux history: - it used to be (OPEN_MAX-1) - commit c09edd6eb (Jul 2007) changed it to 255 - commit bba14de98 (Nov 2010) changed it to 253 Libdbus always sends all of a message's fds, and the beginning of the message itself, in a single sendmsg() call. Combining these two, a malicious sender could split a message across two or more sendmsg() calls to construct a composite message with 254 or more fds. When dbus-daemon attempted to relay that message to its recipient in a single sendmsg() call, it would receive EINVAL, interpret that as a fatal socket error and disconnect the recipient, resulting in denial of service. This is fixed by keeping max_message_unix_fds <= SCM_MAX_FD. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=82820 Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
| * system bus limit: use max_replies_per_connection=128 by defaultAlban Crequy2014-09-151-1/+1
| | | | | | | | | | | | | | This addresses CVE-2014-3638. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=81053 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Make various system-bus-related things Unix-onlySimon McVittie2014-09-151-7/+11
| | | | | | | | | | | | | | | | There is no system bus on Windows, and there won't be until/unless it can be secure. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83583 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
* | free_pending_restore_data --> free_restore_pending_dataChengwei Yang2014-09-091-3/+3
| | | | | | | | | | | | | | | | This patch doesn't do any function change, but only the function name, to align its name with the struct RestorePendingData. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=72254 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Improve debug message to be able to see empty files.Ralf Habacker2014-09-081-1/+1
| | | | | | | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | Merge branch 'dbus-1.8'Simon McVittie2014-09-051-1/+3
|\ \ | |/
| * Stats: fix compilation issueAlban Crequy2014-09-041-1/+3
| | | | | | | | | | | | Bug-Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=507232 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=81043 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* | bus_set_watched_dirs: portability patch for systems which lack O_CLOEXECPatrick Welche2014-06-111-0/+17
|/ | | | | Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77032 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
* CVE-2014-3477: deliver activation errors correctly, fixing Denial of ServiceAlban Crequy2014-06-053-11/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | How it should work: When a D-Bus message activates a service, LSMs (SELinux or AppArmor) check whether the message can be delivered after the service has been activated. The service is considered activated when its well-known name is requested with org.freedesktop.DBus.RequestName. When the message delivery is denied, the service stays activated but should not receive the activating message (the message which triggered the activation). dbus-daemon is supposed to drop the activating message and reply to the sender with a D-Bus error message. However, it does not work as expected: 1. The error message is delivered to the service instead of being delivered to the sender. As an example, the error message could be something like: An SELinux policy prevents this sender from sending this message to this recipient, [...] member="MaliciousMethod" If the sender and the service are malicious confederates and agree on a protocol to insert information in the member name, the sender can leak information to the service, even though the LSM attempted to block the communication between the sender and the service. 2. The error message is delivered as a reply to the RequestName call from service. It means the activated service will believe it cannot request the name and might exit. The sender could activate the service frequently and systemd will give up activating it. Thus the denial of service. The following changes fix the bug: - bus_activation_send_pending_auto_activation_messages() only returns an error in case of OOM. The prototype is changed to return TRUE, or FALSE on OOM (and its only caller sets the OOM error). - When a client is not allowed to talk to the service, a D-Bus error message is pre-allocated to be delivered to the client as part of the transaction. The error is not propagated to the caller so RequestName will not fail (except on OOM). [fixed a misleading comment -smcv] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78979 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Colin Walters <walters@verbum.org>
* Add "Documentation=man:dbus-daemon(1)" line to systemd serviceCameron Norman2014-04-281-0/+1
| | | | | | | | Enhances usability under systemd by making the documentation available with systemctl status or systemctl help. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77447 Reviewed-by: Simon McVittie
* Rename bus-test-launch-helper to test-bus-launch_helper to match common test ↵Ralf Habacker2014-01-172-5/+5
| | | | | | | application naming scheme. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73495 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
View Lorry Controller Status