From 8c388a5d213aa28f5d92a19150a697c5eba5554f Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Mon, 16 Sep 2013 14:17:25 +0100 Subject: spec: explicitly mention filtering messages with no INTERFACE This is an important security measure. Without it, the system bus would not deliver its intended security properties. The actual implementation has always behaved like this, I think. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=68597 Reviewed-by: Chengwei Yang --- doc/dbus-specification.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml index 865a8bff..629ab10c 100644 --- a/doc/dbus-specification.xml +++ b/doc/dbus-specification.xml @@ -1699,6 +1699,15 @@ Implementations may choose to either return an error, or deliver the message as though it had an arbitrary one of those interfaces. + + In some situations (such as the well-known system bus), messages + are filtered through an access-control list external to the + remote object implementation. If that filter rejects certain + messages by matching their interface, or accepts only messages + to specific interfaces, it must also reject messages that have no + INTERFACE: otherwise, malicious + applications could use this to bypass the filter. + Method call messages also include a PATH field indicating the object to invoke the method on. If the call is passing -- cgit v1.2.3