summaryrefslogtreecommitdiff
path: root/bus
Commit message (Collapse)AuthorAgeFilesLines
* bus/selinux: Move vsnprintf call to avoid va_list reuseJeremi Piotrowski2023-01-091-3/+2
| | | | | | | | | | | | | | | In log_callback() the same va_list is reused for a call to vsnprintf and vsyslog. A va_list can't be reused in this manner, such use is undefined behavior that changes depending on glibc version. In current glibc versions a segfault can be observed from the callsite at bus/selinux.c:412. When trying to log a non-auditable event, the segfault happens in strlen inside vsyslog. Moving the call to vsnprintf closer to audit_log_user_avc_message (which is followed by a 'goto out') avoids the reuse and segfault. Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
* Add SPDX license marker for the AFL-2.1 OR GPL-2.0-or-later licenseRalf Habacker2023-01-0450-0/+100
| | | | | | | | | The full license texts are not added because they were already added in a previous commit. Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de> see #394
* Use 'continue' keyword in preference to 'goto' where possibleSimon McVittie2022-11-292-6/+3
| | | | | | | | | | | | | | | In some more complicated loops, we do need to use 'goto' to exit from an inner loop, or to jump to cleanup or an increment of an iterator immediately before the next loop iteration. However, in these simple cases, jumping to a label immediately before the 'while' keyword is unnecessary: we can use an equivalent 'continue' statement for flow control. This makes it easier for maintainers to notice the loops where we are doing something more complicated, which still use 'goto', and know that they need to pay more attention in those cases. Signed-off-by: Simon McVittie <smcv@collabora.com>
* build: Put system bus socket in runstatedir by defaultIssam E. Maghni2022-10-112-2/+2
| | | | | | | | | | | | | | | | | | | | | | This lets OS distributors configure --runstatedir=/run if they want to, although for interoperability, they should only do this if they can guarantee that their /run and /var/run are equivalent. A previous commit adds a warning if we are using the default path on a system where /run and /var/run are not synoymous, mitigating the compatibility impact of this change. For CMake, this requires version 3.9, released in 2017. For Meson, this is currently controlled by the runtime_dir option, which defaults to /run if the prefix is /usr. The rationale for this is that /run is correct for modern Unix systems, and distributors who switch from Autotools or CMake to Meson need to review all their build options at that time, which is an ideal opportunity to check that they are doing the right thing around /run. Helps: https://gitlab.freedesktop.org/dbus/dbus/-/issues/180 Co-authored-by: Simon McVittie <smcv@collabora.com>
* config-parser: no longer get past the last NULL passed to locate_attributesEvgeny Vereshchagin2022-10-101-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: bc86794f23fa53 Fixes: ``` ==302818==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7ffd6ac253c0 at pc 0x000000534d0b bp 0x7ffd6ac24e10 sp 0x7ffd6ac24e08 READ of size 8 at 0x7ffd6ac253c0 thread T0 #0 0x534d0a in locate_attributes /home/vagrant/dbus/build/../bus/config-parser.c:658:16 #1 0x52ea3f in start_busconfig_child /home/vagrant/dbus/build/../bus/config-parser.c:1080:12 #2 0x52cca4 in bus_config_parser_start_element /home/vagrant/dbus/build/../bus/config-parser.c:2039:14 #3 0x52b82b in expat_StartElementHandler /home/vagrant/dbus/build/../bus/config-loader-expat.c:107:8 #4 0x7f2179f2d2bd (/lib64/libexpat.so.1+0xd2bd) (BuildId: 0165eed77c910f6ef2227d21afa9c5c5ed5849c2) #5 0x7f2179f2aed3 (/lib64/libexpat.so.1+0xaed3) (BuildId: 0165eed77c910f6ef2227d21afa9c5c5ed5849c2) #6 0x7f2179f2c9ec (/lib64/libexpat.so.1+0xc9ec) (BuildId: 0165eed77c910f6ef2227d21afa9c5c5ed5849c2) #7 0x7f2179f30a8e in XML_ParseBuffer (/lib64/libexpat.so.1+0x10a8e) (BuildId: 0165eed77c910f6ef2227d21afa9c5c5ed5849c2) #8 0x52b040 in bus_config_load /home/vagrant/dbus/build/../bus/config-loader-expat.c:259:9 #9 0x523c8a in bus_context_new /home/vagrant/dbus/build/../bus/bus.c:828:12 #10 0x521056 in main /home/vagrant/dbus/build/../bus/main.c:716:13 #11 0x7f2179a2954f in __libc_start_call_main (/lib64/libc.so.6+0x2954f) (BuildId: 9c5863396a11aab52ae8918ae01a362cefa855fe) #12 0x7f2179a29608 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x29608) (BuildId: 9c5863396a11aab52ae8918ae01a362cefa855fe) #13 0x42a914 in _start (/home/vagrant/dbus/build/bus/dbus-daemon+0x42a914) (BuildId: df5369f85137975aff9bd398ae859706cc3c52ff) Address 0x7ffd6ac253c0 is located in stack of thread T0 at offset 0 in frame #0 0x52cfaf in start_busconfig_child /home/vagrant/dbus/build/../bus/config-parser.c:733 ``` Signed-off-by: Evgeny Vereshchagin <evvers@ya.ru>
* Use project relative paths in CMake filesJordan Williams2022-07-251-2/+2
| | | | | | | This makes it possible for projects to incorporate D-Bus as a CMake sub-project in a larger CMake project. Before this PR, doing so would result in many errors. This is because CMAKE_SOURCE_DIR and CMAKE_BINARY_DIR would point to directories above the D-Bus project. Using paths relative to the project directory, PROJECT_SOURCE_DIR and PROJECT_BINARY_DIR, corrects for this.
* dispatch test: Pass in test data directory as a C stringSimon McVittie2022-07-181-24/+16
| | | | | | This reduces duplication a little bit. Signed-off-by: Simon McVittie <smcv@collabora.com>
* test/bus: Break up dispatch test into three separate testsSimon McVittie2022-07-182-12/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is really three separate test-cases: one for traditional activation as a direct child process of the dbus-daemon, and two for traditional activation (successful and failing) via the setuid dbus-daemon-launch-helper on Unix. The ones where activation succeeds extremely slow, as a result of the instrumentation for simulating malloc() failures combined with a large number of memory operations, particularly when using AddressSanitizer. Splitting up "OOM" tests like these has a disproportionately good impact on the time they take, because the simulated malloc() failure instrumentation repeats the entire test making the first malloc() fail, then making the second malloc() fail, and so on. For allocation failures in the second half of the test, this means we repeat the first half of the test with no malloc() failures a very large number of times, which is not a good use of time, because we already tested it successfully. Even when not using the "OOM" instrumentation, splitting up these tests lets them run in parallel, which is also a major time saving. Needless to say, this speeds up testing considerably. On my modern but unexceptional x86 laptop, in a typical debug build with Meson, the old dispatch test took just over 21 minutes, which drops to about 40 seconds each for the new normal-activation and helper-activation tests (and for most of that time, they're running in parallel, so the wall-clock time taken for the whole test suite is somewhere around a minute). In a debug build with Meson, gcc and AddressSanitizer, the old dispatch test takes longer than my patience will allow, and the new separate tests take about 5-6 minutes each. Reduce their timeout accordingly, but not as far as the default for slow tests (5 minutes) to allow some headroom for AddressSanitizer or slower systems. The failed-helper-activation test is almost instantaneous, and no longer needs to be marked as slow. Signed-off-by: Simon McVittie <smcv@collabora.com>
* activation-helper: Never crash if unable to write oom_score_adjSimon McVittie2022-07-161-1/+1
| | | | | | | | | | | | _dbus_warn() normally only logs a warning, but can be made fatal by environment variables. In particular, we do that during unit testing, which can result in a build-time test failure if dbus is built in a sandbox environment that prevents write access. _dbus_log() does only the logging part of _dbus_warn(), which seems more appropriate here. Signed-off-by: Simon McVittie <smcv@collabora.com>
* dbus: simplify socket close() & invalidate() callsMarc-André Lureau2022-07-151-3/+0
| | | | | | Now that _dbus_close_socket() invalidates the socket on its own already. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* dbus: make _dbus_close_socket() take DBusSocket*Marc-André Lureau2022-07-152-6/+6
| | | | | | This will allow to invalidate the socket in the following commit. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* build: Change how we create empty directories from MesonSimon McVittie2022-07-131-0/+13
| | | | | | | | | Use install_emptydir() in Meson versions that support it, or a script with similar invocation in versions that do not. This will make it straightforward to migrate to install_emptydir() when we drop support for Meson versions older than 0.60.0. Signed-off-by: Simon McVittie <smcv@collabora.com>
* build: Change how we create symlinks from MesonSimon McVittie2022-07-131-0/+25
| | | | | | | | | | | | Use install_symlink() in Meson versions that support it, or a script with similar invocation in versions that do not. This will make it straightforward to migrate to install_symlink() when we drop support for Meson versions older than 0.61.0. Based on an implementation in the game-data-packager package, which used a shell script. Signed-off-by: Simon McVittie <smcv@collabora.com>
* bus: Install example systemd hardening when using MesonSimon McVittie2022-07-131-0/+5
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* build: Add machine-readable licensing markers to the Meson build systemSimon McVittie2022-07-135-0/+5
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* build: Distribute Meson build system in release tarballsSimon McVittie2022-07-131-0/+5
| | | | | | | As long as we are treating Autotools as a first-class citizen, what we release will be `make distcheck` output. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Add Meson build systemFélix Piédallu2022-07-135-0/+299
| | | | | Signed-off-by: Félix Piédallu <felix@piedallu.me> Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* dir-watch-kqueue: Silence -Wshadow warningAlex Richardson2022-05-151-1/+2
| | | | | This should be the last warning that is preventing us from using -Werror for FreeBSD builds.
* bus_service_remove_owner(): Assert that service has an ownerRalf Habacker2022-04-211-0/+4
| | | | | | | | | | | gcc 10.3 warns that link->data is a possible NULL dereference. However, that can't actually happen without an earlier programming error, because bus_service_remove_owner() is only valid to call for a connection that is currently in the queue to own the service, in which case we know _bus_service_find_owner_link() will succeed. Part-of: https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/275 Reviewed-by: Simon McVittie <smcv@collabora.com>
* bus: Add assertions to silence compiler warningsRalf Habacker2022-04-211-0/+2
| | | | | | | | | | gcc 10.3 warns that link->data might be NULL, which would make new_owner->conn a null pointer dereference. However, we know that we only add valid, non-null BusOwner objects to the list, so that can't happen in reality. Part-of: https://gitlab.freedesktop.org/dbus/dbus/-/merge_requests/275 Reviewed-by: Simon McVittie <smcv@collabora.com>
* bus/dir-watch: Do not crash with > 128 dirsJan Tojnar2022-04-202-2/+12
| | | | | | | | Without this running, dbus-daemon with long XDG_DATA_DIRS will crash on out-of-bounds write: $ XDG_DATA_DIRS=$(seq -f "/foo/%g" -s ':' 129) dbus-daemon --session *** stack smashing detected ***: terminated
* build: Define DBUS_INT64_MODIFIER, analogous to G_GINT64_MODIFIERSimon McVittie2022-04-191-3/+1
| | | | | | | | | | | | | | | | | | | Using PRId64, etc. to print dbus_int64_t or dbus_uint64_t is not 100% portable. On platforms where both long and long long are 64-bit (such as Linux and macOS), we will prefer to define dbus_int64_t as long. If the operating system has chosen to define int64_t as long long, which is apparently the case on macOS, then the compiler can warn that we are passing a long argument to PRId64, which is "lld" and therefore expects a long long argument (even though that ends up with the same bit-pattern being used). We can't necessarily just use int64_t and uint64_t directly, even if all our supported platforms have them available now, because swapping dbus_int64_t between long and long long might change C++ name mangling, causing ABI breaks in third-party libraries if they define C++ functions that take a dbus_int64_t argument. Signed-off-by: Simon McVittie <smcv@collabora.com>
* cmake: Drop an unnecessary include directoryAlex Richardson2022-03-241-1/+0
| | | | | | | There should be no need to include the directory above the DBus sources, if that is actually required users can always pass -I flags to CMake. I noticed this because CLion started indexing all my cloned projects when I opened DBus due to this include path.
* bus: Show the errno if inotify cannot be initializedSimon McVittie2022-02-281-1/+1
| | | | Signed-off-by: Simon McVittie <smcv@collabora.com>
* bus: Correct check for inotify_init() failureSimon McVittie2022-02-281-1/+1
| | | | | | | fd 0 is a valid fd - although if we are using stdin as our inotify fd, something is weird somewhere. Signed-off-by: Simon McVittie <smcv@collabora.com>
* dbus-daemon-launch-helper: Reset Linux OOM score adjustment hereSimon McVittie2022-02-221-0/+8
| | | | | | | | | | | | | | | | | | | | | | | Previously, we were relying on the system bus being able to reset its OOM score adjustment after it forks, but before it execs the dbus-daemon-launch-helper. However, it can't actually do that (leading to dbus#378), because the system bus typically starts as root, uses its root privileges to adjust resource limits, and then drops privileges to the `@DBUS_USER@`, typically `dbus` or `messagebus`. This leaves the pseudo-files in /proc for its process parameters owned by root, and the `@DBUS_USER@` is not allowed to open them for writing. The dbus-daemon-launch-helper is setuid root, so it can certainly alter its OOM score adjustment before exec'ing the actual activated service. We need to do this before dropping privileges, because after dropping privileges we would be unable to write to this process parameter. This is a non-async-signal-safe context, so we can safely log errors here, unlike the fork-and-exec code paths. Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/378 Signed-off-by: Simon McVittie <smcv@collabora.com>
* dbus-daemon: Implement signal 'ActivatableServicesChanged'Ralf Habacker2022-02-162-0/+78
| | | | | | | | | | | | After any reload of the activatable service files the mentioned signal is emitted to the current bus to inform clients. The calls to signal emmission have not been implemented in the platform specific functions _dbus_daemon_report_reloaded() to avoid duplicate implementations. Fixes #376 Signed-off-by: Ralf Habacker <ralf.habacker@freenet.de>
* bus/signal: fix compilation when only -Dembedded-testsMarc-André Lureau2022-01-211-2/+2
| | | | Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
* Disable the Containers interfaceSimon McVittie2021-12-104-10/+6
| | | | | | | | We've had a request for a 1.14.x stable-branch, but the Containers interface is only partially implemented, not yet described in the D-Bus Specification, and not ready to be part of our API guarantees. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Avoid assertation in bus_activation_reload()Ralf Habacker2021-12-091-7/+13
| | | | | | | | In the mentioned function a local DBusError instance is now used to fulfill the requirement of dbus_error_has_name() that the parameter 'error' must not be null. See #360
* tools/dbus-run-session: fix race between manual and automatically started ↵Ralf Habacker2021-11-234-2/+40
| | | | | | | | | | | | | | | | | | | | | | | dbus-daemon on Windows dbus-run-session starts a dbus-daemon before the client application. We must avoid letting the application try to connect before the dbus-daemon's DBusServer is listening for connections. In the Unix implementation, we already achieved this via the --print-address option. If the client tried to connect too soon, the server would not yet be listening and the client would fail. In the Windows implementation, we communicate the bus address to the client application as an autolaunch: address, so if the client tried to connect too soon, it would autolaunch a new dbus-daemon instead of using the one that it was intended to use. We can avoid this by using a new option to pass in a Windows event object, which will be set when the server has started and is ready to process connections. Fixes #297
* bus: Separate RemoveMatch into prepare and commit stagesSimon McVittie2021-11-223-29/+60
| | | | | | | This means we don't send a spurious successful reply if a caller removes a match rule that they never added. Signed-off-by: Simon McVittie <smcv@collabora.com>
* Put dbus-daemon into session sliceDavid Redondo2021-11-181-0/+1
| | | | | | | | | | | | The session slice and the app and background slices are special slices defined by https://systemd.io/DESKTOP_ENVIRONMENTS/, where: session.slice: Contains only processes essential to run the user’s graphical session app.slice: Contains all normal applications that the user is running This allows users or sysadmins to control resource allocation depending on the type of the service. Since v249 (https://github.com/systemd/systemd/commit/23dce98e89616092007005692a4574ab908db5a6) systemd puts user services into the app slice by default so dbus needs to manually state that it belongs in the session slice.
* bus/selinux: Fix audit message types.Chris PeBenito2020-11-231-3/+27
| | | | | | | | | | | | | The SELinux log callback includes a message type. Not all messages are auditable and those that are have varying audit types. An audit message is a security-relevant event: security state changes, MAC permission denied, etc. A message that is auditable is not necessarily sensitive. Messages that are not auditable are not security-relevant, like messages about socket polling errors. Update the auditing accordingly. If the message is not auditable, fall through and write it to syslog. Signed-off-by: Chris PeBenito <chpebeni@linux.microsoft.com>
* cmake: make support for traditional activation optionalRalf Habacker2020-09-231-6/+9
| | | | | | | | Traditional activation is enabled/disabled with the cmake configure parameter -DENABLE_TRADITIONAL_ACTIVATION, which is enabled by default. This was added to the Autotools build system as part of dbus/dbus!107 but until now was not possible to disable when building with CMake.
* cmake: install dbus-daemon-launch-helper on UnixRalf Habacker2020-09-221-0/+4
| | | | | | | | | | | | | Previously it was built on Unix platforms, but not installed. This would prevent traditional activation on the system bus (on Linux without systemd or non-Linux, or for services without SystemdService), which requires the activation helper. Because the executable is an internal implementation detail of how traditional activation is implemented on Unix, it is not exported to the generated cmake support files. Resolves: dbus#310
* cmake: add support for user session semantic on Linux operating systemsRalf Habacker2020-06-101-0/+7
| | | | | | | | | | Systemd user support is controlled by the cmake variable ENABLE_USER_SESSION, which and WITH_SYSTEMD_USERUNITDIR to specify a custom installation location. If WITH_SYSTEMD_USERUNITDIR is not specified, the related install path is determined from an installed systemd package, if present. This was added to the Autotools build system as part of fd.o#61301, but until now was not possible to enable when building with CMake.
* cmake: Add support for systemd integration on Linux operating systemsRalf Habacker2020-06-101-0/+7
| | | | | | | | | | | | | | Previously, only the Autotools build system could do this. This commit includes most of the same features as in the Autotools build, although not the user-session semantics, which will be added separately. Systemd support is controlled by the cmake variable ENABLE_SYSTEMD, which can have the values OFF, ON and AUTO, the latter enabling support by default if the required libraries are available. With WITH_SYSTEMD_SYSTEMUNITDIR a custom installation location can be specified. If it is not specified, the related install path is determined from the installed systemd package, if present.
* cmake: Use CMAKE_INSTALL_FULL_<dir> for configuration and stateRalf Habacker2020-06-101-3/+3
| | | | | | | This means we apply GNUInstallDirs' various special cases when the prefix is /, /usr or something starting with /opt; these are not applied when installing to CMAKE_INSTALL_<dir>. See https://cmake.org/cmake/help/latest/module/GNUInstallDirs.html#special-cases
* cmake: fix installation of example filesRalf Habacker2020-06-101-10/+12
|
* Normalize C source files to end with exactly one newlineSimon McVittie2020-06-108-8/+0
| | | | | | | | | | | | | | | | | | | Some editors automatically remove trailing blank lines, or automatically add a trailing newline to avoid having a trailing non-blank line that is not terminated by a newline. To avoid unrelated whitespace changes when users of such editors contribute to dbus, let's pre-emptively normalize all files. Unlike more intrusive whitespace normalization like removing trailing whitespace from each line, this seems unlikely to cause significant issues with cherry-picking changes to stable branches. Implemented by: find . -name '*.[ch]' -print0 | \ xargs -0 perl -0777 -p -i -e 's/\n+\z//g; s/\z/\n/g' Signed-off-by: Simon McVittie <smcv@collabora.com>
* Fix indentation in bus source fileTaras Zaporozhets2020-03-251-7/+7
|
* bus: Don't explicitly clear BusConnections.monitorsSimon McVittie2020-02-201-3/+4
| | | | | | | | | | | | | | Each connection that is an active monitor holds a pointer to its own link in this list, via BusConnectionData.link_in_monitors. We can't validly free the list while these pointers exist: that would be a use-after-free, when each connection gets disconnected and tries to remove itself from the list. Instead, let each connection remove itself from the list, then assert that the list has become empty. Signed-off-by: Simon McVittie <smcv@collabora.com> Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/291
* cmake: complete adding version info to all installed executables on WindowsRalf Habacker2020-02-191-2/+6
|
* Stop using selinux_set_mapping() functionLaurent Bigonville2019-10-221-33/+42
| | | | | | | | | | | | | | | | | Currently, if the "dbus" security class or the associated AV doesn't exist, dbus-daemon fails to initialize and exits immediately. Also the security classes or access vector cannot be reordered in the policy. This can be a problem for people developing their own policy or trying to access a machine where, for some reasons, there is not policy defined at all. The code here copy the behaviour of the selinux_check_access() function. We cannot use this function here as it doesn't allow us to define the AVC entry reference. See the discussion at https://marc.info/?l=selinux&m=152163374332372&w=2 Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/198
* bus: Make audit initialization idempotentSimon McVittie2019-07-031-1/+8
| | | | | | | | The audit module is initialized every time a new BusContext is created, which is only once in the real dbus-daemon, but can happen several times in some unit tests. Signed-off-by: Simon McVittie <smcv@collabora.com>
* bus: Clarify names of methods that query owned namesSimon McVittie2019-05-305-17/+17
| | | | | | | | | | | | It wasn't immediately clear from the names of these method whether they should return TRUE or FALSE for queued owners other than the primary owner. Renaming them makes it obvious that the answer should be TRUE. While I'm there, make the corresponding _dbus_verbose() messages more precise. Signed-off-by: Simon McVittie <smcv@collabora.com> Resolves: https://gitlab.freedesktop.org/dbus/dbus/issues/270
* Merge branch 'send_destination_prefix' into 'master'Simon McVittie2019-05-305-15/+114
|\ | | | | | | | | Send destination prefix See merge request dbus/dbus!85
| * dbus-daemon: add send_destination_prefix supportAdrian Szyndela2019-04-265-6/+111
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This extends dbus-daemon with support for send_destination_prefix attribute in XML policies. It allows having policy rules for sending to bus names generated within namespaces defined by a prefix. The similar behaviour can be emulated by owning an additional name, not used for addressing messages, as described in https://lists.freedesktop.org/archives/dbus/2017-May/017188.html However, introducing send_destination_prefix creates possibility of communicating intentions in a more direct way, which is easier to understand. Signed-off-by: Adrian Szyndela <adrian.s@samsung.com> Change-Id: I0016ad93f1c16b7742fef5f45ebaf01b55694d3c
| * DBusString: extend with checking for starting with wordsAdrian Szyndela2019-04-261-9/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This extracts a few lines of code and adds it as a DBusString function that checks if a DBusString starts with words given with a C string and a word separator. In other words, it checks if: - a DBusString is a given C string, or - a DBusString starts with a given C string and the next character is a given word separator. It is used for matching names to prefixes when checking the policy. Signed-off-by: Adrian Szyndela <adrian.s@samsung.com> Change-Id: Ie39d33916863d950dde38d3b8b20c8a539217302
View Lorry Controller Status