summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2015-02-19Imported Upstream version 1.9.12upstream/1.9.12Simon McVittie63-205/+4233
2015-02-191.9.12Simon McVittie3-11/+55
2015-02-19apparmor: Fix build failure with --disable-apparmorTyler Hicks1-24/+24
The bus_apparmor_confinement_unref() function definition must exist even when building with --disable-apparmor. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Revert "Add DBus method to return the AA context of a connection"Simon McVittie4-107/+0
This reverts commit 24f1502e42b58a7c238779c023c6bfe870dc78cc, which wasn't meant to go upstream (it's backwards compatibility with older versions of this patchset).
2015-02-18Add DBus method to return the AA context of a connectionTyler Hicks4-0/+107
This is not intended for upstream inclusion. It implements a bus method (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor security context but upstream D-Bus has recently added a generic way of getting a connection's security credentials (GetConnectionCredentials). Ubuntu should carry this patch until packages in the archive are moved over to the new, generic method of getting a connection's credentials. [Altered by Simon McVittie: survive non-UTF-8 contexts which would otherwise be a local denial of service, except that Ubuntu inherits a non-fatal warnings patch from Debian; new commit message taken from the Ubuntu changelog; do not emit unreachable code if AppArmor is disabled.]
2015-02-18apparmor: tighten up terminology for context vs. label vs. profileSimon McVittie1-38/+40
The thing returned by SO_PEERSEC (which we're calling LinuxSecurityLabel within D-Bus) can have a different meaning for each LSM. In AppArmor it's the AppArmor context, which is made up of an AppArmor label and an optional confinement mode; the label further subdivides into one or more profiles. See https://bazaar.launchpad.net/~apparmor-dev/apparmor/master/revision/2862 and subsequent commits for recent clarification of this terminology. In practice, the part that dbus-daemon deals with is the label, and occasionally also the mode. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18Mediation of processes becoming a monitorTyler Hicks1-0/+7
When an AppArmor confined process wants to become a monitor, a check is performed to see if eavesdropping should be allowed. The check is based on the connection's label and the bus type. This patch reuses the bus_apparmor_allows_eavesdropping() hook. An example AppArmor rule that would allow a process to become a monitor on the system bus would be: dbus eavesdrop bus=system, Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Mediation of processes eavesdroppingTyler Hicks5-1/+141
When an AppArmor confined process wants to eavesdrop on a bus, a check is performed to see if the action should be allowed. The check is based on the connection's label and the bus type. This patch adds a new hook, which was not previously included in the SELinux mediation, to mediate eavesdropping from bus_driver_handle_add_match(). A new function is added to bus/signals.c to see if a match rule is an eavesdropping rule since the rule flags field is private to signals.c. An example AppArmor rule that would allow a process to eavesdrop on the session bus would be: dbus eavesdrop bus=session, Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Mediation of processes sending and receiving messagesJohn Johansen3-1/+369
When an AppArmor confined process wants to send or receive a message, a check is performed to see if the action should be allowed. When a message is going through dbus-daemon, there are two checks performed at once. One for the sending process and one for the receiving process. The checks are based on the process's label, the bus type, destination, path, interface, and member, as well as the peer's label and/or destination name. This allows for the traditional connection-based enforcement, as well as any fine-grained filtering desired by the system administrator. It is important to note that error and method_return messages are allowed to cut down on the amount of rules needed. If a process was allowed to send a message, it can receive error and method_return messages. An example AppArmor rule that would be needed to allow a process to call the UpdateActivationEnvironment method of the session bus itself would be: dbus send bus=session path=/org/freedesktop/DBus interface=org.freedesktop.DBus member=UpdateActivationEnvironment peer=(name=org.freedesktop.DBus), To receive any message on the system bus from a process confined by the "confined-client" AppArmor profile: dbus receive bus=system peer=(label=confined-client), Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Use BusAppArmorConfinement, bug fixes, cleanup, commit msg] [tyhicks: Pass the message type to the AppArmor hook] [tyhicks: Don't audit unrequested reply message denials] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> [smcv: when AA denies sending, don't label requested_reply as "matched rules"] Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18Do LSM checks after determining if the message is a requested replyTyler Hicks1-24/+29
Move the call to bus_selinux_allows_send() after the call to bus_connections_check_reply(). This allows LSMs to know if the message is a reply and whether or not it was requested. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Mediation of processes that acquire well-known namesJohn Johansen5-2/+310
When an AppArmor confined process wants to acquire a well-known name, a check is performed to see if the action should be allowed. The check is based on the connection's label, the bus type, and the name being requested. An example AppArmor rule that would allow the name "com.example.ExampleName" to be acquired on the system bus would be: dbus bind bus=system name=com.example.ExampleName, To let a process acquire any name on any bus, the rule would be: dbus bind, Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Use BusAppArmorConfinement, bug fixes, cleanup, commit msg] [tyhicks: initialize reserved area at the start of the query string] [tyhicks: Use empty string for NULL bustypes when building queries] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Store AppArmor label of connecting processesTyler Hicks4-3/+79
When processes connect the bus, the AppArmor confinement context should be stored for later use when checks are to be done during message sending/receiving, acquire a name, and eavesdropping. Code outside of apparmor.c will need to initialize and unreference the confinement context, so bus_apparmor_confinement_unref() can no longer be a static function. [Move bus_apparmor_confinement_unref back to its old location for a more reasonable diff -smcv] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Store AppArmor label of bus during initializationTyler Hicks1-1/+86
During dbus-daemon initialization, the AppArmor confinement context should be stored for later use when checks are to be done on messages to/from the bus itself. AppArmor confinement contexts are documented in aa_getcon(2). They contain a confinement string and a mode string. The confinement string is typically the name of the AppArmor profile confining a given process. The mode string gives the current enforcement mode of the process confinement. For example, it may indicate that the confinement should be enforced or it may indicate that the confinement should allow all actions with the caveat that actions which would be denied should be audited. It is important to note that libapparmor mallocs a single buffer to store the con and mode strings and separates them with a NUL terminator. Because of this, only con should be freed. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> [smcv: use BUS_SET_OOM] [smcv: dbus_set_error doesn't need extra newlines] Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18Initialize AppArmor mediationJohn Johansen4-0/+208
When starting dbus-daemon, autodetect AppArmor kernel support and use the results from parsing the busconfig to determine if mediation should be enabled. In the busconfig, "enabled" means that kernel support is autodetected and, if available, AppArmor mediation occurs in dbus-daemon. In "enabled" mode, if kernel support is not detected, mediation is disabled. "disabled" means that mediation does not occur. "required" means that kernel support must be detected for dbus-daemon to start. Additionally, when libaudit support is built into dbus-daemon, the AppArmor initialization routines set up the audit connection. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: John Johansen <john.johansen@canonical.com> [tyhicks: Honor enforcement modes and detect AppArmor dbus rule support] [tyhicks: fix unreachable return when AppArmor support is built] [tyhicks: make bus_apparmor_full_init() able to raise a DBusError] Signed-off-by: Tyler Hicks <tyhicks@canonical.com> [smcv: _bus_apparmor_aa_supports_dbus: document necessary kernel API guarantee] [smcv: bus_apparmor_pre_init: distinguish between OOM and AppArmor not enabled] [smcv: document why we open() and not just stat()] Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18Add apparmor element support to bus config parsingTyler Hicks9-1/+156
The <apparmor> element can contain a single mode attribute that has one of three values: "enabled" "disabled" "required" "enabled" means that kernel support is autodetected and, if available, AppArmor mediation occurs in dbus-daemon. If kernel support is not detected, mediation is disabled. "disabled" means that mediation does not occur. "required" means that kernel support must be detected for dbus-daemon to start. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Update autoconf file to build against libapparmorTyler Hicks2-0/+22
AppArmor support can be configured at build time with --enable-apparmor and --disable-apparmor. By default, the build time decision is automatically decided by checking if a sufficient libapparmor is available. A minimum required libapparmor is version 2.8.95. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> [smcv: avoid potential non-portability from "test EXPR -a EXPR"] Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18Add apparmor element and attributes to the bus config dtdTyler Hicks1-1/+6
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Document AppArmor enforcement in the dbus-daemon man pageTyler Hicks1-0/+56
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-18Add LinuxSecurityLabel to specificationSimon McVittie1-0/+51
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89041 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-18Add regression test for LinuxSecurityLabel credentialSimon McVittie1-1/+25
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89041 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-18Add LSM-agnostic support for LinuxSecurityLabel credentialSimon McVittie9-11/+268
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89041 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> (for SELinux) Acked-by: John Johansen <john.johansen@canonical.com> (for AppArmor) Acked-by: Casey Schaufler <casey@schaufler-ca.com> (for Smack) Tested-by: Tyler Hicks <tyhicks@canonical.com>
2015-02-18New a{sv} helper for using byte arrays as the variantTyler Hicks2-0/+58
Create a new helper for using a byte array as the value in the mapping from string to variant. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75113 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89041 Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-16dbus-monitor: Remove empty column in --profile mode.Ralf Habacker1-3/+1
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89165 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-16dbus-monitor: Combine sec and usec columns into one timestamp column and ↵Ralf Habacker1-12/+4
unify platform related format string. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89165 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-16dbus-send: Keep cmake build system in sync with autotools.Ralf Habacker1-0/+2
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89109 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-16doc: Add a guide to designing D-Bus APIsPhilip Withnall4-4/+970
This guide gives some pointers on how to write D-Bus APIs which are nice to use. It adds an optional dependency on Ducktype and yelp-build from yelp-tools. These are used when available, but are not required unless --enable-ducktype-docs is passed to configure. They are required for uploading the docs, however. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88994 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-16dbus-monitor: whitespaceSimon McVittie1-1/+1
2015-02-16dbus-monitor: clarify column headersSimon McVittie1-2/+2
- change "ref serial" to "in_reply_to" (avoiding whitespace for easy visual parsing) - prefix with # to clarify that these are not part of the data Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89165 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
2015-02-16dbus-monitor.c: unify columns format in --profile mode and display column ↵Ralf Habacker1-3/+24
header. [rebase onto correctly indented version -smcv] Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89165 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
2015-02-16dbus-monitor: convert remaining hard tabs to 8 spacesSimon McVittie1-38/+38
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89165 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
2015-02-16dbus-send: pretty-print GVariant-style bytestringsSimon McVittie2-30/+35
dbus-send could already pretty-print bytestrings that do not have \0 termination, but those are awkward to work with (they need copying), so they are now discouraged. Teach it to print bytestrings that do have \0 termination as well. In the process, rewrite this part of the message parser to use dbus_message_iter_get_fixed_array(), which is the Right way to get arrays of numbers out of a message. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89109 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-16Add manual-paths test to the Autotools (mingw) build tooSimon McVittie1-0/+8
As in CMake, it is restricted to Windows builds, since the functionality that it tests is not present in Unix builds.
2015-02-13Add org.freedesktop.DBus.Verbose interface to dbus-daemon when compiled with ↵Ralf Habacker4-0/+91
DBUS_ENABLE_VERBOSE_MODE. This interface contains methods 'EnableVerbose' and 'DisableVerbose' to control verbose mode on daemon runtime. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88896 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-12Add manual-paths test executable with cmake build support.Ralf Habacker4-0/+83
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83539 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-12Add dbus-test-tool and its man page to the CMake build systemSimon McVittie2-0/+16
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89086 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-12Document dbus-test-toolSimon McVittie3-0/+327
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89086 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-11bus_driver_handle_get_connection_credentials: do not assert on OOMSimon McVittie1-0/+4
dbus_connection_get_windows_user is documented to return TRUE but put NULL in its argument if OOM is reached. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89041 Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
2015-02-11Reduce the number of fds the fdpass test usesSimon McVittie1-2/+23
It was relying on a higher-than-default fd limit; cut it down to more than 256 but rather less than 1024, since the default Linux limit is 1024 fds per user. Also automatically skip this test if our rlimit is too small. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88998 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-11Minor optimization in _dbus_getsid().Ralf Habacker1-2/+8
MSDN recommands to use GetCurrentProcess() for current process. Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=54445
2015-02-11Add test for windows sid.Ralf Habacker3-3/+24
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=54445 Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
2015-02-11Windows implementation of GetConnectionCredentials.Ralf Habacker2-0/+28
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk> Bug: https://bugs.freedesktop.org/show_bug.cgi?id=54445
2015-02-091.9.11Simon McVittie2-1/+6
2015-02-09Imported Upstream version 1.9.10upstream/1.9.10Simon McVittie41-138/+3688
2015-02-091.9.10Simon McVittie2-4/+4
2015-02-09Add a regression test for making systemd activation appear to failSimon McVittie1-0/+31
2015-02-09Merge branch '1.8-cve-2015-0245' into cve-2015-0245Simon McVittie3-12/+62
Conflicts: NEWS bus/system.conf.in configure.ac
2015-02-05Add test-fdpass to the build, and make it compile againSimon McVittie2-1/+13
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88998 Reviewed-by: Philip Withnall <philip.withnall@collabora.co.uk>
2015-02-05CVE-2015-0245: discard forged ActivationFailure messagesSimon McVittie1-0/+18
Without this code change, non-systemd processes can make dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester. In practice we can address this in system.conf by only allowing root to forge these messages, but this check is the real solution, particularly on systems where root is not all-powerful. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Reviewed-by: Alban Crequy Reviewed-by: David King Reviewed-by: Philip Withnall
2015-02-05bus_driver_get_owner_of_name: factor out from bus_driver_get_conn_helperSimon McVittie1-11/+21
We need this, or something equivalent, to address CVE-2015-0245 via code changes. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Reviewed-by: Alban Crequy Reviewed-by: David King Reviewed-by: Philip Withnall
2015-02-051.8.17Simon McVittie2-1/+6
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-24 19:15:23 +0000