| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
We want to make use of it for reading the ConsoleKit database which will
need to be implemented in dbus/dbus-userdb-util.c, so let's
move this to dbus/.
|
|\
| |
| |
| |
| |
| |
| | |
Conflicts:
dbus/dbus-connection.c
dbus/dbus-message-util.c
dbus/dbus-sysdeps-unix.c
|
| |
| |
| |
| |
| |
| | |
This simply verifies that we forward unix fds only on connection that
support it. We willr eturn an error if a client attempts to send a
message with unix fds to another client that cannot do it.
|
| |
| |
| |
| |
| | |
Create configuration settings and enforce message unix fd limits the
same way we do for allocated message memory.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This adds two new directives to the auth protocol:
NEGOTIATE_UNIX_FD is sent by the client after the authentication was
sucessful, i.e. OK was received.
AGREE_UNIX_FD is then sent by the server if it can do unix fd passing as
well.
ERROR is returned when the server cannot or is unwilling to do unix fd
passing.
This should be compatible with existing D-Bus implementations which will
naturally return ERROR on NEGOTIATE_UNIX_FD.
|
| |
| |
| |
| |
| | |
Instead of having everyone define _GNU_SOURCE and similar macros
seperately, simply do so centrally by using AC_USE_SYSTEM_EXTENSIONS
|
| |
| |
| |
| |
| |
| |
| | |
All users of full duplex pipes enable FD_CLOEXEC later anyway so let's
just do it as part of _dbus_full_duplex_pipe. By side effect this allows
to make use of SOCK_CLOEXEC which fixes a race when forking/execing from
a different thread at the same time as we ar in this function.
|
| |
| |
| |
| |
| | |
This adds a full test for passing multiple fds across a D-Bus
connection.
|
| |
| |
| |
| |
| |
| | |
This prevents it leaking into spawned child processes.
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| |
| |
| | |
No comment.
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| |
| |
| |
| | |
* bus/session.conf.in: Remove the reply_timeout stanza, previously
intended to increase the reply timeout, this now reduces it.
Signed-off-by: Scott James Remnant <scott@ubuntu.com>
|
| |
| |
| |
| |
| |
| |
| | |
* bus/config-parser.c (bus_config_parser_new): change the default reply
timeout to "never"
Signed-off-by: Scott James Remnant <scott@ubuntu.com>
|
| |
| |
| |
| |
| |
| |
| |
| | |
* bus/expirelist.c (do_expiration_with_current_time): Don't check for
expiry if expire_after is negative, will just disable the expiry timer
after the call.
Signed-off-by: Scott James Remnant <scott@ubuntu.com>
|
|/
|
|
|
|
|
| |
* bus/expirelist.c (do_expiration_with_current_time): If the item added
time fields are both zero, always expire.
Signed-off-by: Scott James Remnant <scott@ubuntu.com>
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Conflicts:
bus/bus.c
bus/config-parser-common.c
bus/config-parser-common.h
bus/config-parser.c
bus/connection.c
bus/dbus-daemon.1.in
dbus/dbus-marshal-validate-util.c
dbus/dbus-marshal-validate.c
dbus/dbus-sysdeps-util-unix.c
test/name-test/tmp-session-like-system.conf
|
| |
| |
| |
| |
| |
| |
| | |
* bus/bus.c: Initialize AVC earlier:
http://lists.freedesktop.org/archives/dbus/2008-October/010493.html
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| | |
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| | |
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| | |
Signed-off-by: Colin Walters <walters@verbum.org>
|
| | |
|
| |
| |
| |
| |
| |
| | |
The requested_reply field is necessary in send denials too because
it's used in the policy language. The connection loginfo lack in
"would deny" was just an oversight.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Extend the current security logs with even more relevant
information than just the message content. This requires
some utility code to look up and cache (as a string)
the data such as the uid/pid/command when a connection is
authenticated.
|
| |\ |
|
| | |
| | |
| | |
| | |
| | | |
The former was too reliant on old bugs and was generally unclear.
This one makes explicit exactly what is allowed and not.
|
| | |
| | |
| | |
| | |
| | | |
This lets us have a backwards compatibility allow rule but still easily
see when that rule is being used.
|
| | |
| | |
| | |
| | | |
It's part of the security check, we should have it in the log.
|
| |/
| |
| |
| |
| | |
We need to start logging denials so that they become more easily trackable
and debuggable.
|
| |
| |
| |
| |
| | |
We need to fix all of the bare send_interface rules; see:
https://bugs.freedesktop.org/show_bug.cgi?id=18961
|
| |
| |
| |
| | |
We need some sort of general advice here.
|
| |
| |
| |
| |
| |
| |
| | |
Our previous fix went too far towards lockdown; many things rely
on signals to work, and there's no really good reason to restrict
which signals can be emitted on the bus because we can't tie
them to a particular sender.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The previous rule <allow send_requested_reply="true"/> was actually
applied to all messages, even if they weren't a reply. This meant
that in fact the default DBus policy was effectively allow, rather
than deny as claimed.
This fix ensures that the above rule only applies to actual reply
messages.
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Stephen Smalley wrote:
> On Tue, 2009-04-21 at 16:32 -0400, Joshua Brindle wrote:
>
>> Stephen Smalley wrote:
>>
>>> On Thu, 2009-04-16 at 20:47 -0400, Eamon Walsh wrote:
>>>
>>>> Stephen Smalley wrote:
>>>>
>> <snip>
>>
>>
>>> No, I don't want to change the behavior upon context_to_sid calls in
>>> general, as we otherwise lose all context validity checking in
>>> permissive mode.
>>>
>>> I think I'd rather change compute_sid behavior to preclude the situation
>>> from arising in the first place, possibly altering the behavior in
>>> permissive mode upon an invalid context to fall back on the ssid
>>> (process) or the tsid (object). But I'm not entirely convinced any
>>> change is required here.
>>>
>>>
>> I just want to follow up to make sure we are all on the same page here. Was the
>> suggestion to change avc_has_perm in libselinux or context_to_sid in the kernel
>> or leave the code as is and fix the callers of avc_has_perm to correctly handle
>> error codes?
>>
>> I prefer the last approach because of Eamon's explanation, EINVAL is already
>> passed in errno to specify the context was invalid (and if object managers
>> aren't handling that correctly now there is a good chance they aren't handling
>> the ENOMEM case either).
>>
>
> I'd be inclined to change compute_sid (not context_to_sid) in the kernel
> to prevent invalid contexts from being formed even in permissive mode
> (scenario is a type transition where role is not authorized for the new
> type). That was originally to allow the system to boot in permissive
> mode. But an alternative would be to just stay in the caller's context
> (ssid) in that situation.
>
> Changing the callers of avc_has_perm() to handle EINVAL and/or ENOMEM
> may make sense, but that logic should not depend on enforcing vs.
> permissive mode.
>
>
FWIW, the following patch to D-Bus should help:
bfo21072 - Log SELinux denials better by checking errno for the cause
Note that this does not fully address the bug report since
EINVAL can still be returned in permissive mode. However the log
messages will now reflect the proper cause of the denial.
Signed-off-by: Eamon Walsh <ewalsh@tycho.nsa.gov>
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| |
| |
| |
| | |
This patch makes various things that should be static static,
corrects some "return FALSE" where it should be NULL, etc.
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| | |
Patch suggested by Tomas Hoger <thoger@redhat.com>
|
| |
| |
| |
| | |
Signed-off-by: Colin Walters <walters@verbum.org>
|
| | |
|
| |
| |
| |
| |
| | |
The former was too reliant on old bugs and was generally unclear.
This one makes explicit exactly what is allowed and not.
|
| |
| |
| |
| |
| |
| | |
The requested_reply field is necessary in send denials too because
it's used in the policy language. The connection loginfo lack in
"would deny" was just an oversight.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Extend the current security logs with even more relevant
information than just the message content. This requires
some utility code to look up and cache (as a string)
the data such as the uid/pid/command when a connection is
authenticated.
|
| |
| |
| |
| |
| | |
This lets us have a backwards compatibility allow rule but still easily
see when that rule is being used.
|
| |
| |
| |
| | |
It's part of the security check, we should have it in the log.
|
| |
| |
| |
| |
| | |
We need to start logging denials so that they become more easily trackable
and debuggable.
|
| |
| |
| |
| |
| | |
We need to fix all of the bare send_interface rules; see:
https://bugs.freedesktop.org/show_bug.cgi?id=18961
|
| |
| |
| |
| | |
We need some sort of general advice here.
|
|\ \ |
|
| | |
| | |
| | |
| | | |
See https://bugs.freedesktop.org/show_bug.cgi?id=18229
|
|/ /
| |
| |
| |
| |
| |
| | |
Our previous fix went too far towards lockdown; many things rely
on signals to work, and there's no really good reason to restrict
which signals can be emitted on the bus because we can't tie
them to a particular sender.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The previous rule <allow send_requested_reply="true"/> was actually
applied to all messages, even if they weren't a reply. This meant
that in fact the default DBus policy was effectively allow, rather
than deny as claimed.
This fix ensures that the above rule only applies to actual reply
messages.
Signed-off-by: Colin Walters <walters@verbum.org>
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* bus/bus.c: Set allow_anonymous if specified from
parser.
* bus/config-parser.c: Parse it.
* bus/config-parser-common.h: Declare it.
Signed-off-by: Colin Walters <walters@verbum.org>
|