summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* tests: On Unix, include <netinet/in.h> for IPPROTO_TCPcherry-pick-f0e526bcSimon McVittie2020-08-141-0/+1
| | | | | | | | | | | | | | | Otherwise, dbus doesn't compile on FreeBSD if the GLib-based tests are enabled (which suggests that no FreeBSD user has run those tests successfully). We already include <netinet/in.h> in other places with no conditions or checks other than "is Unix", so apparently it's portable enough that specifically testing for its presence is not necessary. POSIX requires it to exist. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit f0e526bca8a5e47246c97199f5c388b0bd00d9f3)
* v1.12.20dbus-1.12.20Simon McVittie2020-07-022-3/+3
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Update NEWSSimon McVittie2020-07-021-1/+20
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* userdb: Reference-count DBusUserInfo, DBusGroupInfoSimon McVittie2020-07-024-27/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the hash table indexed by uid (or gid) took ownership of the single reference to the heap-allocated struct, and the hash table indexed by username (or group name) had a borrowed pointer to the same struct that exists in the other hash table. However, this can break down if you have two or more distinct usernames that share a numeric identifier. This is generally a bad idea, because the user-space model in such situations does not match the kernel-space reality, and in particular there is no effective kernel-level security boundary between such users, but it is sometimes done anyway. In this case, when the second username is looked up in the userdb, it overwrites (replaces) the entry in the hash table that is indexed by uid, freeing the DBusUserInfo. This results in both the key and the value in the hash table that is indexed by username becoming dangling pointers (use-after-free), leading to undefined behaviour, which is certainly not what we want to see when doing access control. An equivalent situation can occur with groups, in the rare case where a numeric group ID has two names (although I have not heard of this being done in practice). Solve this by reference-counting the data structure. There are up to three references in practice: one held temporarily while the lookup function is populating and storing it, one held by the hash table that is indexed by uid, and one held by the hash table that is indexed by name. Closes: dbus#305 Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 2b7948ef907669e844b52c4fa2268d6e3162a70c)
* userdb: Make lookups return a const pointerSimon McVittie2020-07-023-9/+13
| | | | | | | | | | | | This makes it more obvious that the returned pointer points to a struct owned by the userdb, which must not be freed or have its contents modified, and is only valid to dereference until the next modification to the userdb's underlying hash tables (which in practice means until the lock is released, because after that we have no guarantees about what might be going on in another thread). Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 6ee66ff7bcc91803111d950512f02651e664f74f)
* Solaris and derivatives do not adjust cmsg_len on MSG_CTRUNCAndy Fiddaman2020-07-021-1/+20
| | | | (cherry picked from commit b96ef23e406baa08648339a53b0161fc80de7ce4)
* Start 1.12.20 developmentSimon McVittie2020-06-022-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare 1.12.18dbus-1.12.18Simon McVittie2020-06-022-4/+17
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* fdpass test: Assert that we don't leak file descriptorsSimon McVittie2020-06-021-0/+14
| | | | | | | | | | This version is for the dbus-1.12 branch, and doesn't rely on dbus!153 or dbus!120. Reproduces: dbus#294 Reproduces: CVE-2020-12049 Reproduces: GHSL-2020-057 Signed-off-by: Simon McVittie <smcv@collabora.com>
* sysdeps-unix: On MSG_CTRUNC, close the fds we did receiveSimon McVittie2020-06-021-12/+20
| | | | | | | | | | | | | | | MSG_CTRUNC indicates that we have received fewer fds that we should have done because the buffer was too small, but we were treating it as though it indicated that we received *no* fds. If we received any, we still have to make sure we close them, otherwise they will be leaked. On the system bus, if an attacker can induce us to leak fds in this way, that's a local denial of service via resource exhaustion. Reported-by: Kevin Backhouse, GitHub Security Lab Fixes: dbus#294 Fixes: CVE-2020-12049 Fixes: GHSL-2020-057
* Update NEWSSimon McVittie2020-05-151-0/+4
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* dbus-daemon test: Don't test fd limits if in an unprivileged containerSimon McVittie2020-05-151-2/+28
| | | | | | | | | | | | | | | | | | | | In an unprivileged container, uid 0 doesn't have CAP_SYS_RESOURCE, so we can't expect the dbus-daemon to be able to escalate its fd limit. This can be reproduced using bubblewrap: sudo bwrap \ --cap-drop CAP_SYS_RESOURCE \ --ro-bind / / \ --dev /dev \ env \ DBUS_TEST_DAEMON=.../bus/dbus-daemon \ DBUS_TEST_DATA=.../test/data \ .../test/test-dbus-daemon \ -p /fd-limit \ --verbose Bug-Debian: https://bugs.debian.org/908092
* Update NEWSSimon McVittie2020-04-201-0/+3
|
* doxygen: fix example for dbus_message_append_argsFelipe Franciosi2020-04-201-4/+10
| | | | | | | Commit 724adb2f6 mangled the dbus_message_append_args() code example. This fixes it by breaking the lines and aligning at the right places. Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
* Update NEWSSimon McVittie2020-04-201-0/+11
|
* cmake: Add X11 include path for toolsTuomo Rinne2020-04-201-0/+1
| | | | Fixes compilation issues for case when X11 is not in a standard location
* doc: replace dbus-send's --address with --peer and --busChristopher Morin2020-04-201-3/+9
| | | | | | See merge request dbus/dbus!115 (cherry picked from commit fd41caa3664d480605628f08c217581bc42fa3e7)
* Update NEWSSimon McVittie2020-04-201-1/+4
|
* Merge branch 'cherry-pick-b034b83b' into 'dbus-1.12'Simon McVittie2020-02-251-3/+4
|\ | | | | | | | | [1.12] bus: Don't explicitly clear BusConnections.monitors See merge request dbus/dbus!142
| * bus: Don't explicitly clear BusConnections.monitorsSimon McVittie2020-02-251-3/+4
|/ | | | | | | | | | | | | | | | Each connection that is an active monitor holds a pointer to its own link in this list, via BusConnectionData.link_in_monitors. We can't validly free the list while these pointers exist: that would be a use-after-free, when each connection gets disconnected and tries to remove itself from the list. Instead, let each connection remove itself from the list, then assert that the list has become empty. Signed-off-by: Simon McVittie <smcv@collabora.com> Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/291 (cherry picked from commit b034b83b59efffd4cc819ad42d0cd078d91d53df)
* Merge branch 'cherry-pick-bf71a58e' into 'dbus-1.12'Simon McVittie2020-02-201-1/+1
|\ | | | | | | | | doc: Fix environment variable name in dbus-daemon(1) See merge request dbus/dbus!141
| * doc: Fix environment variable name in dbus-daemon(1)Philip Withnall2020-02-201-1/+1
|/ | | | | | | | | | Spotted by Mubin. This documentation relates to the code in add_bus_environment() in bus/activation.c. Signed-off-by: Philip Withnall <withnall@endlessm.com> Fixes: #275 (cherry picked from commit bf71a58e4ab496c1726209aaad94a1abe670a01f)
* Start 1.12.18 developmentSimon McVittie2019-06-112-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Prepare version 1.12.16dbus-1.12.16Simon McVittie2019-06-092-4/+17
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* test: Add basic test coverage for DBUS_COOKIE_SHA1Simon McVittie2019-06-097-3/+184
| | | | | | | | | We don't actually complete successful authentication, because that would require us to generate a cookie and compute the correct SHA1, which is difficult to do in a deterministic authentication script. However, we do assert that dbus#269 (CVE-2019-12749) has been fixed. Signed-off-by: Simon McVittie <smcv@collabora.com>
* auth: Reject DBUS_COOKIE_SHA1 for users other than the server ownerSimon McVittie2019-06-091-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The DBUS_COOKIE_SHA1 authentication mechanism aims to prove ownership of a shared home directory by having the server write a secret "cookie" into a .dbus-keyrings subdirectory of the desired identity's home directory with 0700 permissions, and having the client prove that it can read the cookie. This never actually worked for non-malicious clients in the case where server uid != client uid (unless the server and client both have privileges, such as Linux CAP_DAC_OVERRIDE or traditional Unix uid 0) because an unprivileged server would fail to write out the cookie, and an unprivileged client would be unable to read the resulting file owned by the server. Additionally, since dbus 1.7.10 we have checked that ~/.dbus-keyrings is owned by the uid of the server (a side-effect of a check added to harden our use of XDG_RUNTIME_DIR), further ruling out successful use by a non-malicious client with a uid differing from the server's. Joe Vennix of Apple Information Security discovered that the implementation of DBUS_COOKIE_SHA1 was susceptible to a symbolic link attack: a malicious client with write access to its own home directory could manipulate a ~/.dbus-keyrings symlink to cause the DBusServer to read and write in unintended locations. In the worst case this could result in the DBusServer reusing a cookie that is known to the malicious client, and treating that cookie as evidence that a subsequent client connection came from an attacker-chosen uid, allowing authentication bypass. This is mitigated by the fact that by default, the well-known system dbus-daemon (since 2003) and the well-known session dbus-daemon (in stable releases since dbus 1.10.0 in 2015) only accept the EXTERNAL authentication mechanism, and as a result will reject DBUS_COOKIE_SHA1 at an early stage, before manipulating cookies. As a result, this vulnerability only applies to: * system or session dbus-daemons with non-standard configuration * third-party dbus-daemon invocations such as at-spi2-core (although in practice at-spi2-core also only accepts EXTERNAL by default) * third-party uses of DBusServer such as the one in Upstart Avoiding symlink attacks in a portable way is difficult, because APIs like openat() and Linux /proc/self/fd are not universally available. However, because DBUS_COOKIE_SHA1 already doesn't work in practice for a non-matching uid, we can solve this vulnerability in an easier way without regressions, by rejecting it early (before looking at ~/.dbus-keyrings) whenever the requested identity doesn't match the identity of the process hosting the DBusServer. Signed-off-by: Simon McVittie <smcv@collabora.com> Closes: https://gitlab.freedesktop.org/dbus/dbus/issues/269 Closes: CVE-2019-12749
* Start 1.12.16 developmentSimon McVittie2019-05-172-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* Release 1.12.14dbus-1.12.14Simon McVittie2019-05-172-3/+5
|
* Update NEWSSimon McVittie2019-05-131-1/+36
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* bus: Try to raise soft fd limit to match hard limitSimon McVittie2019-05-134-34/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux systems have traditionally set the soft limit to 1024 and the hard limit to 4096. Recent versions of systemd keep the soft fd limit at 1024 to avoid breaking programs that still use select(), but raise the hard limit to 512*1024, while in recent Debian versions a complicated interaction between components gives a soft limit of 1024 and a hard limit of 1024*1024. If we can, we might as well elevate our soft limit to match the hard limit, minimizing the chance that we will run out of file descriptor slots. Unlike the previous code to raise the hard and soft limits to at least 65536, we do this even if we don't have privileges: privileges are unnecessary to raise the soft limit up to the hard limit. If we *do* have privileges, we also continue to raise the hard and soft limits to at least 65536 if they weren't already that high, making it harder to carry out a denial of service attack on the system bus on systems that use the traditional limit (CVE-2014-7824). As was previously the case on the system bus, we'll drop the limits back to our initial limits before we execute a subprocess for traditional (non-systemd) activation, if enabled. systemd activation doesn't involve us starting subprocesses at all, so in both cases activated services will still inherit the same limits they did previously. This change also fixes a bug when the hard limit is very large but the soft limit is not, for example seen as a regression when upgrading to systemd >= 240 (Debian #928877). In such environments, dbus-daemon would previously have changed its fd limit to 64K soft/64K hard. Because this hard limit is less than its original hard limit, it was unable to restore its original hard limit as intended when carrying out traditional activation, leaving activated subprocesses with unintended limits (while logging a warning). Reviewed-by: Lennart Poettering <lennart@poettering.net> [smcv: Correct a comment based on Lennart's review, reword commit message] Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 7eacbfece70f16bb54d0f3ac51f87ae398759ef5) [smcv: Mention that this also fixes Debian #928877]
* cmake: Avoid overwriting PKG_CONFIG_PATH env varClemens Lang2019-05-131-0/+27
| | | | | | | | | | | | | | | | | | | | The CMake config file installed by DBus will run in the context of other projects. Consequently, changing the value of the PKG_CONFIG_DIR, PKG_CONFIG_PATH or PKG_CONFIG_LIBDIR environment variables will affect any further calls to pkg-config made by such projects, which can cause problems. A common case of this happening are pkg-config files installed in usr/share/pkgconfig for .pc files that are architecture-independent, as for example systemd does. Avoid clobbering the environment variables by saving and restoring their values. Note that for some of the variables, setting them to an empty string is different from not setting them at all. Signed-off-by: Clemens Lang <clemens.lang@bmw-carit.de> (cherry picked from commit 3525cc045d4c683dfc6048f5be795cc372c323a3) Closes: dbus#267
* Merge branch 'cherry-pick-14f46d14' into 'dbus-1.12'Simon McVittie2019-04-181-1/+4
|\ | | | | | | | | build: Don't assume we can set permissions on a directory See merge request dbus/dbus!112
| * build: Don't assume we can set permissions on a directorycherry-pick-14f46d14Simon McVittie2019-04-181-1/+4
|/ | | | | | | | | | MSYS2 has enough of a Unixish environment to run Autotools, but apparently not enough of a Unixish environment to have functional permissions. Closes: dbus#216 (cherry picked from commit 14f46d14a0526f137f81a3fff5d32f26733323cd)
* Merge branch '1-12-logical-op' into 'dbus-1.12'Simon McVittie2019-04-173-7/+22
|\ | | | | | | | | Backport -Wlogical-op fixes to 1.12.x See merge request dbus/dbus!109
| * _dbus_get_is_errno_eagain_or_ewouldblock: Avoid warningDavid King2019-04-171-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | EAGAIN and EWOULDBLOCK are documented to possibly be numerically equal, for instance in errno(3), and a simple logical OR check will trigger the -Wlogical-op warning of GCC. The GCC developers consider the warning to work as-designed in this case: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=69602 Avoid such a warning by explicitly checking if the values are identical. Fixes: https://gitlab.freedesktop.org/dbus/dbus/issues/225 Signed-off-by: David King <dking@redhat.com> Reviewed-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit a65319134209d39f5eb6e5425ec6a35fad05bcd7)
| * dbus-send: Avoid duplicated-branches warningDavid King2019-04-171-4/+7
| | | | | | | | | | | | | | | | | | Switch the order of the argument checks to avoid the -Wduplicated-branches warning. Signed-off-by: David King <dking@redhat.com> Reviewed-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit c0bf0d185d72e20e70da9a98e13f69e19f2a87d5)
| * desktop-file: Justify implementation of is_valid_section_name()Simon McVittie2019-04-171-1/+6
| | | | | | | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 99580298f305e1e2426f0c016d797a1ff9ea0b79)
| * is_valid_section_name: Fix logical expressionDavid King2019-04-171-2/+1
| | | | | | | | | | | | | | | | | | | | | | Group names in desktop files may contain all ASCII characters, except control characters and '[' and ']'. Rather than accepting all values, thanks to a logical operator confusion found by GCC warning -Wlogical-op, instead explicitly reject the invalid values. Signed-off-by: David King <dking@redhat.com> Fixes: https://gitlab.freedesktop.org/dbus/dbus/issues/208 (cherry picked from commit 3ef9e789c1b99f420078f4debabd4f5c4fa0a748)
* | Merge branch '1-12-code-coverage' into 'dbus-1.12'Simon McVittie2019-04-1711-7/+443
|\ \ | |/ |/| | | | | Adapt to API change in AX_CODE_COVERAGE version 28 See merge request dbus/dbus!108
| * Adapt to API change in AX_CODE_COVERAGE version 28Simon McVittie2019-04-1711-7/+443
|/ | | | | | | | | | | | | | | | | | AX_CODE_COVERAGE recently changed the way it embedded its Makefile rules in the output file: instead of using @CODE_COVERAGE_RULES@, users are now meant to include aminclude_static.am. The new AX_CODE_COVERAGE is only in the latest autoconf-archive release, version 2019.01.06, which is inconveniently new, so bundle everything we need for the moment. This requires us to stop using the deprecated CODE_COVERAGE_LDFLAGS (which we still used to support older versions of autoconf-archive) and replace them with CODE_COVERAGE_LIBS. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 2938c2125ebcd001e470aeac1ffac45b6b1ebe89) Closes: dbus#265
* configure.ac: Forbid AX_-prefixed patterns more selectivelySimon McVittie2019-01-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | We want to make autoconf fail early and with a user-comprehensible message if autoconf-archive isn't installed, rather than generating a configure script with syntax errors, or a configure script that runs successfully but doesn't do what we intended. However, autoconf-archive doesn't actually guarantee not to use AX_-prefixed shell variable names without m4_pattern_allow'ing them (unlike Autoconf, Automake, Libtool and pkg-config, which explicitly use m4_pattern_allow for variables with AC_, AM_, LT_ and PKG_ prefixes), so it isn't safe to assume that they won't be used. In particular, recent versions of AX_CHECK_GNU_MAKE appear to be using $AX_CHECK_GNU_MAKE_HEADLINE as a shell variable. Instead, specifically forbid the names of the finite list of macros that we actually use. Signed-off-by: Simon McVittie <smcv@collabora.com> Resolves: dbus#249 (cherry picked from commit ee09cc0acdc1c34e8ae999adf9922f3d0d66f407)
* Start working on dbus 1.12.14Simon McVittie2018-12-042-1/+6
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* 1.12.12dbus-1.12.12Simon McVittie2018-12-042-3/+5
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* CI: Start supporting Debian 10 'buster', currently under developmentSimon McVittie2018-12-042-0/+9
| | | | | | | | This gives us a way to build on a more recent host OS if we want to. For Gitlab-CI it's disabled by default. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 28c27349e252e33215e21b570d41853badd770ef)
* CI: Exercise maintainer-only documentation buildSimon McVittie2018-12-042-0/+33
| | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit bcc34caa43d8e5dba8266cf163d8a24e4fb55dce)
* CI: Stop building on Ubuntu 14.04 'trusty'Simon McVittie2018-12-043-30/+8
| | | | | | | | | | The version of gcc in trusty is too old for AddressSanitizer, which we want to be able to start using, and Travis-CI finally supports Ubuntu 16.04 'xenial' now. This lets us remove some workarounds, but we need to update others. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit 0c553afcd9c79bc19ffdad67980f421def5d0613)
* ci-build.sh: Show file size in list of files to be able to compare generated ↵Ralf Habacker2018-12-041-1/+1
| | | | | | file size (cherry picked from commit bac2fd3aa458c7dfd002f7ec96a245d630c5830f)
* CI: Remove unimplemented --with-glib optionSimon McVittie2018-12-041-1/+0
| | | | | | | dbus has never actually had this option. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit e0a1bfb26a9f72e8fe59af770d394a90810a7cea)
* CI: List attributes, sizes etc. of installed files, not just namesSimon McVittie2018-12-041-1/+1
| | | | | Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit d71049799a3f87de95151e00c667c05dd0b5386c)
* doc: Remove obsolete message about man2htmlSimon McVittie2018-12-041-1/+0
| | | | | | | We no longer run man2html. Signed-off-by: Simon McVittie <smcv@collabora.com> (cherry picked from commit f134e2d2c7ae53965dfba0c85bf76ad38fb7fa4c)
View Lorry Controller Status