summaryrefslogtreecommitdiffstats
path: root/bus
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'dbus-1.2'Thiago Macieira2009-04-282-23/+22
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | Conflicts: bus/bus.c bus/config-parser-common.c bus/config-parser-common.h bus/config-parser.c bus/connection.c bus/dbus-daemon.1.in dbus/dbus-marshal-validate-util.c dbus/dbus-marshal-validate.c dbus/dbus-sysdeps-util-unix.c test/name-test/tmp-session-like-system.conf
| * Initialize AVC earlier so we can look up service security contextsJames Carter2009-01-061-5/+5
| | | | | | | | | | | | | | * bus/bus.c: Initialize AVC earlier: http://lists.freedesktop.org/archives/dbus/2008-October/010493.html Signed-off-by: Colin Walters <walters@verbum.org>
| * [win32] Protect usage of SIGHUP with #ifdefTor Lillqvist2009-01-061-9/+14
| | | | | | | | Signed-off-by: Colin Walters <walters@verbum.org>
| * Bug 18446: Keep umask for session busMatt McCutchen2009-01-067-4/+56
| | | | | | | | Signed-off-by: Colin Walters <walters@verbum.org>
| * Avoid possible use of uninitialized variablePeter Breitenlohner2009-01-061-1/+1
| | | | | | | | Signed-off-by: Colin Walters <walters@verbum.org>
| * Various compiler warning fixesColin Walters2009-01-062-1/+2
| |
| * Add requested_reply to send denials, and connection loginfo to "would deny"Colin Walters2008-12-181-31/+38
| | | | | | | | | | | | The requested_reply field is necessary in send denials too because it's used in the policy language. The connection loginfo lack in "would deny" was just an oversight.
| * Add uid, pid, and command to security logsColin Walters2008-12-183-21/+127
| | | | | | | | | | | | | | | | Extend the current security logs with even more relevant information than just the message content. This requires some utility code to look up and cache (as a string) the data such as the uid/pid/command when a connection is authenticated.
| * Merge commit '3d6abf64d0abb2718e082e120f14f8f923a4af59' into dbus-1.2Colin Walters2008-12-161-23/+19
| |\
| | * Clean up and clarify default system policyColin Walters2008-12-121-23/+19
| | | | | | | | | | | | | | | The former was too reliant on old bugs and was generally unclear. This one makes explicit exactly what is allowed and not.
| * | Add optional logging on allow rulesColin Walters2008-12-164-16/+34
| | | | | | | | | | | | | | | This lets us have a backwards compatibility allow rule but still easily see when that rule is being used.
| * | Add message type to security syslog entriesColin Walters2008-12-121-2/+6
| | | | | | | | | | | | It's part of the security check, we should have it in the log.
| * | Add syslog of security denials and configuration file reloadsColin Walters2008-12-129-19/+133
| |/ | | | | | | | | We need to start logging denials so that they become more easily trackable and debuggable.
| * Another manpage update explicitly mentioning bare send_interfaceColin Walters2008-12-091-2/+6
| | | | | | | | | | We need to fix all of the bare send_interface rules; see: https://bugs.freedesktop.org/show_bug.cgi?id=18961
| * Add at_console docs to manpage, as well as brief <policy> forewardColin Walters2008-12-091-2/+17
| | | | | | | | We need some sort of general advice here.
| * Bug 18229: Allow signalsColin Walters2008-12-091-0/+2
| | | | | | | | | | | | | | Our previous fix went too far towards lockdown; many things rely on signals to work, and there's no really good reason to restrict which signals can be emitted on the bus because we can't tie them to a particular sender.
| * Bug 18229 - Change system.conf to correctly deny non-reply sends by defaultTomas Hoger2008-12-051-2/+12
| | | | | | | | | | | | | | | | | | | | | | The previous rule <allow send_requested_reply="true"/> was actually applied to all messages, even if they weren't a reply. This meant that in fact the default DBus policy was effectively allow, rather than deny as claimed. This fix ensures that the above rule only applies to actual reply messages. Signed-off-by: Colin Walters <walters@verbum.org>
* | libselinux behavior in permissive mode wrt invalid domainsEamon Walsh2009-04-221-2/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Stephen Smalley wrote: > On Tue, 2009-04-21 at 16:32 -0400, Joshua Brindle wrote: > >> Stephen Smalley wrote: >> >>> On Thu, 2009-04-16 at 20:47 -0400, Eamon Walsh wrote: >>> >>>> Stephen Smalley wrote: >>>> >> <snip> >> >> >>> No, I don't want to change the behavior upon context_to_sid calls in >>> general, as we otherwise lose all context validity checking in >>> permissive mode. >>> >>> I think I'd rather change compute_sid behavior to preclude the situation >>> from arising in the first place, possibly altering the behavior in >>> permissive mode upon an invalid context to fall back on the ssid >>> (process) or the tsid (object). But I'm not entirely convinced any >>> change is required here. >>> >>> >> I just want to follow up to make sure we are all on the same page here. Was the >> suggestion to change avc_has_perm in libselinux or context_to_sid in the kernel >> or leave the code as is and fix the callers of avc_has_perm to correctly handle >> error codes? >> >> I prefer the last approach because of Eamon's explanation, EINVAL is already >> passed in errno to specify the context was invalid (and if object managers >> aren't handling that correctly now there is a good chance they aren't handling >> the ENOMEM case either). >> > > I'd be inclined to change compute_sid (not context_to_sid) in the kernel > to prevent invalid contexts from being formed even in permissive mode > (scenario is a type transition where role is not authorized for the new > type). That was originally to allow the system to boot in permissive > mode. But an alternative would be to just stay in the caller's context > (ssid) in that situation. > > Changing the callers of avc_has_perm() to handle EINVAL and/or ENOMEM > may make sense, but that logic should not depend on enforcing vs. > permissive mode. > > FWIW, the following patch to D-Bus should help: bfo21072 - Log SELinux denials better by checking errno for the cause Note that this does not fully address the bug report since EINVAL can still be returned in permissive mode. However the log messages will now reflect the proper cause of the denial. Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov> Signed-off-by: Colin Walters <walters@verbum.org>
* | Bug 19502 - Sparse warning cleanupsKjartan Maraas2009-04-212-2/+2
| | | | | | | | | | | | | | This patch makes various things that should be static static, corrects some "return FALSE" where it should be NULL, etc. Signed-off-by: Colin Walters <walters@verbum.org>
* | Always append closing quote in log commandColin Walters2009-03-121-6/+5
| | | | | | | | Patch suggested by Tomas Hoger <thoger@redhat.com>
* | Avoid possible use of uninitialized variablePeter Breitenlohner2009-01-061-1/+1
| | | | | | | | Signed-off-by: Colin Walters <walters@verbum.org>
* | Various compiler warning fixesColin Walters2008-12-192-1/+2
| |
* | Clean up and clarify default system policyColin Walters2008-12-181-23/+19
| | | | | | | | | | The former was too reliant on old bugs and was generally unclear. This one makes explicit exactly what is allowed and not.
* | Add requested_reply to send denials, and connection loginfo to "would deny"Colin Walters2008-12-171-31/+38
| | | | | | | | | | | | The requested_reply field is necessary in send denials too because it's used in the policy language. The connection loginfo lack in "would deny" was just an oversight.
* | Add uid, pid, and command to security logsColin Walters2008-12-173-21/+127
| | | | | | | | | | | | | | | | Extend the current security logs with even more relevant information than just the message content. This requires some utility code to look up and cache (as a string) the data such as the uid/pid/command when a connection is authenticated.
* | Add optional logging on allow rulesColin Walters2008-12-164-16/+34
| | | | | | | | | | This lets us have a backwards compatibility allow rule but still easily see when that rule is being used.
* | Add message type to security syslog entriesColin Walters2008-12-121-2/+6
| | | | | | | | It's part of the security check, we should have it in the log.
* | Add syslog of security denials and configuration file reloadsColin Walters2008-12-129-17/+131
| | | | | | | | | | We need to start logging denials so that they become more easily trackable and debuggable.
* | Another manpage update explicitly mentioning bare send_interfaceColin Walters2008-12-091-2/+6
| | | | | | | | | | We need to fix all of the bare send_interface rules; see: https://bugs.freedesktop.org/show_bug.cgi?id=18961
* | Add at_console docs to manpage, as well as brief <policy> forewardColin Walters2008-12-091-2/+4
| | | | | | | | We need some sort of general advice here.
* | Merge branch 'manpage'Colin Walters2008-12-091-3/+13
|\ \
| * | Bug 18229: Update manpage with better adviceColin Walters2008-12-081-3/+13
| | | | | | | | | | | | See https://bugs.freedesktop.org/show_bug.cgi?id=18229
* | | Bug 18229: Allow signalsColin Walters2008-12-091-0/+2
|/ / | | | | | | | | | | | | Our previous fix went too far towards lockdown; many things rely on signals to work, and there's no really good reason to restrict which signals can be emitted on the bus because we can't tie them to a particular sender.
* | Bug 18229 - Change system.conf to correctly deny non-reply sends by defaultTomas Hoger2008-12-051-2/+12
| | | | | | | | | | | | | | | | | | | | | | The previous rule <allow send_requested_reply="true"/> was actually applied to all messages, even if they weren't a reply. This meant that in fact the default DBus policy was effectively allow, rather than deny as claimed. This fix ensures that the above rule only applies to actual reply messages. Signed-off-by: Colin Walters <walters@verbum.org>
* | Bug 15393 - support allow_anonymous config variableDennis Kaarsemaker2008-11-124-1/+37
| | | | | | | | | | | | | | | | | | * bus/bus.c: Set allow_anonymous if specified from parser. * bus/config-parser.c: Parse it. * bus/config-parser-common.h: Declare it. Signed-off-by: Colin Walters <walters@verbum.org>
* | Bug 18446: Keep umask for session busMatt McCutchen2008-11-107-2/+55
| | | | | | | | Signed-off-by: Colin Walters <walters@verbum.org>
* | Initialize AVC earlier so we can look up service security contextsJames Carter2008-10-011-5/+5
| | | | | | | | | | | | | | * bus/bus.c: Initialize AVC earlier: http://lists.freedesktop.org/archives/dbus/2008-October/010493.html Signed-off-by: Colin Walters <walters@verbum.org>
* | [win32] Protect usage of SIGHUP with #ifdefTor Lillqvist2008-09-181-9/+14
|/ | | | Signed-off-by: Colin Walters <walters@verbum.org>
* Bug 16294: Don't lose inotify watch when config fails to parseColin Walters2008-07-281-9/+12
| | | | | | * bus/dir-watch-inotify.c: Always drop the watch in handle_inotify_watch; this ensures we always readd it correctly in bus_drop_all_directory_watches.
* Fix leaks in bus_activation_get_environment error pathsRay Strode2008-07-151-2/+5
| | | | | | | | Commit 91306ef938873fce8f2ae2d4a6b3282d0379c65a introduced two memory leaks on OOM error paths. In one case the environment string array wasn't getting freed, and in the other case it was getting freed with dbus_free instead of dbus_free_string_array.
* Update man page to make the point of the <type> element more clearRay Strode2008-07-121-1/+15
| | | | | | | | There have been a number of patches in the past try to key system versus session bus policy off of the message bus type, when the policy should be distinguished from more fine-grained options in the individulal policy files. Hopefully, this man page update will make that more clear.
* Add new UpdateActivationEnvironment bus messageRay Strode2008-07-122-0/+135
| | | | | | | | It adjusts the environment of activated bus clients. This is important for session managers that get started after the session bus daemon and want to influence the environment of desktop services that are started by the bus.
* Store what environment to activate with on activation objectRay Strode2008-07-122-18/+217
| | | | | | | | We now keep the environment in a hash table member of the activation object and provide a method bus_activation_set_environment_variable to modify the hash table. This hash table is seeded initially with the environment of the bus daemon itself.
* Bug 15740: Solaris/ADT auditing support (simon zheng)Colin Walters2008-06-051-0/+79
| | | | | | | | | | | | | | | | | | | | | | | * bus/driver.c: Add GetAdtAuditSessionData method which returns audit data for a connection. * configure.in: Detect ADT auditing support * dbus/dbus-auth.c: Read ADT auditing creds. * dbus/dbus-connection.c: Implement dbus_connection_get_adt_audit_session_data. * dbus/dbus-connection.h: Export it. * dbus/dbus-credentials.c: Add support for gathering adt_audit_data and retrieving it via _dbus_credentials_get_adt_audit_data. * dbus/dbus-credentials.h: Add DBUS_CREDENTIAL_ADT_AUDIT_DATA_ID. * dbus/dbus-protocol.h: New error DBUS_ERROR_ADT_AUDIT_DATA_UNKNOWN. * dbus/dbus-sysdeps.c: Support for reading audit credentials via ADT API. * dbus/dbus-transport.c: New function _dbus_transport_get_adt_audit_session_data to retrieve credentials. * dbus/dbus-transport.h: Export it.
* fix expiration of pending repliesKimmo Hämäläinen2008-04-031-16/+25
| | | | | | | | | | * bus/expirelist.c (do_expiration_with_current_time): calculate correct min wait time and next interval (bus_expire_list_add, bus_expire_list_add_link): if the timeout is disabled when we add an item to the expire list, enable the timeout (do_expiration_with_current_time): only set timeout if there are items to expire
* Merge branch 'master' of git+ssh://johnp@git.freedesktop.org/git/dbus/dbusJohn (J5) Palmieri2008-04-031-3/+3
|\ | | | | | | | | | | Conflicts: ChangeLog
| * Fixes for the inotify configuration file monitor backend.Frederic Crozat2008-04-011-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | 2008-04-01 Timo Hoenig <thoenig@suse.de> Patch from Frederic Crozat <fcrozat@mandriva.com> * bus/dir-watch-inotify.c (bus_watch_directory): Only monitor IN_CLOSE_WRITE, IN_DELETE, IN_MOVE_TO and IN_MOVE_FROM events. This way, only atomic changes to configuration file are monitored. * bus/dir-watch-inotify.c (_handle_inotify_watch): Fix typo in _dbus_verbose function call * bus/dir-watch-inotify.c (bus_drop_all_directory_watches): Use _dbus_strerror instead of perror
* | Make BusExpireList an opaque data typeHavoc Pennington2008-03-043-53/+142
|/ | | | | | | | | | | | 2007-11-08 Havoc Pennington <hp@redhat.com> * bus/connection.c, bus/expirelist.c: Make the BusExpireList struct opaque, adding accessors for manipulating the list. In this commit there should be no change in functionality or behavior. The purpose of this change is to improve encapsulation prior to fixing some bugs Kimmo Hämäläinen found where the timeout is not properly updated, since we need to e.g. take some action whenever adding and removing stuff from the expire list.
* CVE-2008-0595 dbus security policy circumventionJohn (J5) Palmieri2008-02-261-6/+26
| | | | | | | | | | | | * CVE-2008-0595 - security policy of the type <allow send_interface= "some.interface.WithMethods"/> work as an implicit allow for messages sent without an interface bypassing the default deny rules and potentially allowing restricted methods exported on the bus to be executed by unauthorized users. This patch fixes the issue. * bus/policy.c (bus_client_policy_check_can_send, bus_client_policy_check_can_receive): skip messages without an interface when evaluating an allow rule, and thus pass it to the default deny rules
* fix build against the latest gcc/glibcJohn (J5) Palmieri2008-02-211-0/+1
| | | | | | * dbus/dbus-sysdeps-unix.c: define _GNU_SOURCE * bus/selinux.c: include limits.h * Patch by Matthias Clasen <mclasen at redhat.com>
generated by cgit (git 2.34.1) at 2024-06-01 23:04:38 +0000