Add patch for system.conf to fix a local denial of service when using systemd activation (CVE-2015-0245)debian/1.6.8-1+deb7u6

3 files changed, 52 insertions, 0 deletions

diff --git a/debian/changelog b/debian/changelog
index de42e2ba..6ee2009d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+dbus (1.6.8-1+deb7u6) wheezy-security; urgency=high
+
+  * Add patch for system.conf to fix a local denial of service when
+    using systemd activation (CVE-2015-0245)
+
+ -- Simon McVittie <smcv@debian.org>  Thu, 05 Feb 2015 15:58:36 +0000
+
 dbus (1.6.8-1+deb7u5) wheezy-security; urgency=high
 
   * Fix CVE-2014-7824:
diff --git a/debian/patches/0001-CVE-2015-0245-prevent-forged-ActivationFailure-from-.patch b/debian/patches/0001-CVE-2015-0245-prevent-forged-ActivationFailure-from-.patch
new file mode 100644
index 00000000..062d1438
--- /dev/null
+++ b/debian/patches/0001-CVE-2015-0245-prevent-forged-ActivationFailure-from-.patch
@@ -0,0 +1,43 @@
+From f9697e04f1c9871cb54a99f087e97e4bb9e41e06 Mon Sep 17 00:00:00 2001
+From: Simon McVittie <simon.mcvittie@collabora.co.uk>
+Date: Mon, 26 Jan 2015 20:09:56 +0000
+Subject: [PATCH] CVE-2015-0245: prevent forged ActivationFailure from non-root
+ processes
+
+Without either this rule or better checking in dbus-daemon, non-systemd
+processes can make dbus-daemon think systemd failed to activate a system
+service, resulting in an error reply back to the requester.
+
+This is redundant with the fix in the C code (which I consider to be
+the real solution), but is likely to be easier to backport.
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88811
+Reviewed-by: Alban Crequy
+Reviewed-by: David King
+Reviewed-by: Philip Withnall
+---
+ bus/system.conf.in | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/bus/system.conf.in b/bus/system.conf.in
+index 92f4cc4..851b9e6 100644
+--- a/bus/system.conf.in
++++ b/bus/system.conf.in
+@@ -68,6 +68,14 @@
+     <deny send_destination="org.freedesktop.DBus"
+           send_interface="org.freedesktop.DBus"
+           send_member="UpdateActivationEnvironment"/>
++    <deny send_destination="org.freedesktop.DBus"
++          send_interface="org.freedesktop.systemd1.Activator"/>
++  </policy>
++
++  <!-- Only systemd, which runs as root, may report activation failures. -->
++  <policy user="root">
++    <allow send_destination="org.freedesktop.DBus"
++           send_interface="org.freedesktop.systemd1.Activator"/>
+   </policy>
+ 
+   <!-- Config files are placed here that among other things, punch 
+-- 
+2.1.4
+
diff --git a/debian/patches/series b/debian/patches/series
index 187f56e2..bb19ddd4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,3 +18,5 @@ If-loader-contains-two-messages-with-fds-don-t-corru.patch
 
 0001-Log-to-syslog-when-auth_timeout-drops-an-incomplete-.patch
 0002-Revert-config-change-default-auth_timeout-to-5-secon.patch
+
+0001-CVE-2015-0245-prevent-forged-ActivationFailure-from-.patch