endpoint: don't leak hints on whether a name exists on a custom endpoint

The whole point of installing policy on custom endpoint is not not let
users of that endpoint know that a name exists. Returning -EPERM in
response to such attempts leaks the information that the name in fact
exists, but is firewalled.

To fix this, return -ENOENT when policy returns -EPERM on custom
endpoints.

Signed-off-by: Daniel Mack <daniel@zonque.org>

diff --git a/endpoint.c b/endpoint.c
index f9c78c67ca4e267cdd3b87631f98881c0c37ef84..57e233993f76886e5ebd9bc9e74720cfb6ab4a04 100644 (file)
--- a/endpoint.c
+++ b/endpoint.c
@@ -282,6 +282,8 @@ int kdbus_ep_policy_check_see_access_unlocked(struct kdbus_ep *ep,
                                              struct kdbus_conn *conn,
                                              const char *name)
 {
+       int ret;
+
        /*
         * Check policy, if the endpoint of the connection has a db.
         * Note that policy DBs instanciated along with connections
@@ -297,8 +299,14 @@ int kdbus_ep_policy_check_see_access_unlocked(struct kdbus_ep *ep,
        if (!ep->has_policy)
                return 0;
 
-       return kdbus_policy_check_see_access_unlocked(&ep->policy_db,
-                                                     conn, name);
+       ret = kdbus_policy_check_see_access_unlocked(&ep->policy_db,
+                                                    conn, name);
+
+       /* don't leak hints whether a name exists on a custom endpoint. */
+       if (ret == -EPERM)
+               return -ENOENT;
+
+       return ret;
 }
 
 /**
@@ -322,6 +330,14 @@ int kdbus_ep_policy_check_talk_access(struct kdbus_ep *ep,
        if (ep->has_policy) {
                ret = kdbus_policy_check_talk_access(&ep->policy_db,
                                                     conn_src, conn_dst);
+
+               /*
+                * Don't leak hints whether a name exists on a custom
+                * endpoint.
+                */
+               if (ret == -EPERM)
+                       return -ENOENT;
+
                if (ret < 0)
                        return ret;
        }