Remove the uid param to fix the BT security issue

Transferring uid will be a hole.
Someone will use the hole to use the paired/connected BT devices.
Therefore, uid is get from dbus.

Change-Id: I633772df0317284d60fe4635f5bd219c2f2bac56
Signed-off-by: Wu Zheng <wu.zheng@intel.com>

diff --git a/capi/bluetooth-obex.c b/capi/bluetooth-obex.c
index 5031e96..8121275 100644 (file)
--- a/capi/bluetooth-obex.c
+++ b/capi/bluetooth-obex.c
@@ -25,6 +25,7 @@
 #include <dirent.h>
 #include <dbus/dbus.h>
 #include <gio/gunixfdlist.h>
+#include <string.h>
 
 #include "bluetooth.h"
 #include "obex.h"
@@ -939,13 +940,11 @@ static void session_state_changed(const char *session_id,
 static int bt_device_get_privileges(const char *remote_address)
 {
        int user_privilieges;
-       int uid;
 
-       uid = getuid();
-       DBG("uid = %d, address = %s", uid, remote_address);
+       DBG("address = %s", remote_address);
 
        user_privilieges = comms_bluetooth_get_user_privileges_sync(
-                                               uid, remote_address);
+                                               remote_address);
 
        return user_privilieges;
 }

diff --git a/capi/bluetooth.c b/capi/bluetooth.c
index f946589..3acd29e 100644 (file)
--- a/capi/bluetooth.c
+++ b/capi/bluetooth.c
@@ -276,13 +276,11 @@ static GList *char_changed_node_list;
 static int bt_device_get_privileges(const char *remote_address)
 {
        int user_privilieges;
-       int uid;
 
-       uid = getuid();
-       DBG("uid = %d, address = %s", uid, remote_address);
+       DBG("address = %s", remote_address);
 
        user_privilieges = comms_bluetooth_get_user_privileges_sync(
-                                               uid, remote_address);
+                                               remote_address);
 
        return user_privilieges;
 }
@@ -466,7 +464,6 @@ static void bluez_unpaired_device_removed(bluez_device_t *device,
 static void handle_generic_device_removed(bluez_device_t *device, void *user_data)
 {
        adapter_device_discovery_info_t *device_info;
-       int userid;
 
        DBG("");
 
@@ -479,8 +476,7 @@ static void handle_generic_device_removed(bluez_device_t *device, void *user_dat
                bluez_unpaired_device_removed(device, unpaired_device_removed_node);
        else {
                if (device_info->remote_address) {
-                       userid = getuid();
-                       comms_bluetooth_remove_user_privileges_sync(userid,
+                       comms_bluetooth_remove_user_privileges_sync(
                                                device_info->remote_address);
                }
                bluez_paired_device_removed(device, paired_device_removed_node);
@@ -2021,10 +2017,7 @@ int bt_device_create_bond(const char *remote_address)
                memset(pairing_address, 0, ADDRESS_LEN);
                return BT_SUCCESS;
        } else if (user_privilieges == 2) {
-               int uid;
-               uid = getuid();
-               DBG("pairing uid = %d", uid);
-               comms_bluetooth_device_pair(remote_address, uid,
+               comms_bluetooth_device_pair(remote_address,
                        bt_device_paired_cb, strdup(remote_address));
 
                return BT_SUCCESS;

diff --git a/doc/bluetooth-service.txt b/doc/bluetooth-service.txt
index 06f1f28..2dc2c92 100644 (file)
--- a/doc/bluetooth-service.txt
+++ b/doc/bluetooth-service.txt
@@ -107,14 +107,14 @@ Methods           void RegisterParingAgent(object agent)
                        Possible errors: org.bluez.Error.DoesNotExist
                                         org.bluez.Error.Failed
 
-               int GetUserPrivileges(int userid, string address)
+               int GetUserPrivileges(string address)
 
                        This method can be used to get user privileges
                        operation by the GetUserPrivileges method.
 
                        Possible errors: org.bluez.Error.DoesNotExist
 
-               void RemoveUserPrivileges(int userid, string address)
+               void RemoveUserPrivileges(string address)
 
                        This method can be used to remove user privileges
                        operation by the RemoveUserPrivileges method.

diff --git a/include/bluetooth-service.h b/include/bluetooth-service.h
index 5260950..07e20d2 100644 (file)
--- a/include/bluetooth-service.h
+++ b/include/bluetooth-service.h
@@ -49,7 +49,6 @@ int comms_manager_get_property_bt_in_service(
 
 void comms_bluetooth_device_pair(
                        const char *address,
-                       const unsigned int uid,
                        bluetooth_simple_callback cb,
                        void *user_data);
 
@@ -124,11 +123,9 @@ void comms_bluetooth_unregister_media_agent(
                        void *user_data);
 
 int comms_bluetooth_get_user_privileges_sync(
-                       const unsigned int uid,
                        const char *address);
 
 int comms_bluetooth_remove_user_privileges_sync(
-                       const unsigned int uid,
                        const char *address);
 
 #endif

diff --git a/lib/bluetooth-service.c b/lib/bluetooth-service.c
index 1c2316d..7dbdabf 100644 (file)
--- a/lib/bluetooth-service.c
+++ b/lib/bluetooth-service.c
@@ -723,7 +723,6 @@ int comms_manager_get_property_bt_in_service(gboolean *in_service)
 }
 
 void comms_bluetooth_device_pair(const char *address,
-                               const unsigned int uid,
                                bluetooth_simple_callback cb,
                                void *user_data)
 {
@@ -746,7 +745,7 @@ void comms_bluetooth_device_pair(const char *address,
        async_result_node->user_data = user_data;
 
        g_dbus_proxy_call(this_bluetooth->pairing.proxy, "Pair",
-                                       g_variant_new("(is)", uid, address),
+                                       g_variant_new("(s)", address),
                                        0, -1, NULL,
                                        bluetooth_simple_async_cb,
                                        async_result_node);
@@ -834,8 +833,7 @@ int comms_bluetooth_register_pairing_agent_sync(const char *agent_path,
        return BT_SUCCESS;
 }
 
-int comms_bluetooth_get_user_privileges_sync(const unsigned int uid,
-                                                       const char *address)
+int comms_bluetooth_get_user_privileges_sync(const char *address)
 {
        GError *error = NULL;
        GVariant *result;
@@ -850,7 +848,7 @@ int comms_bluetooth_get_user_privileges_sync(const unsigned int uid,
 
        result = g_dbus_proxy_call_sync(this_bluetooth->pairing.proxy,
                                "GetUserPrivileges",
-                               g_variant_new("(is)", uid, address),
+                               g_variant_new("(s)", address),
                                0, -1, NULL, &error);
 
        if (error) {
@@ -865,8 +863,7 @@ int comms_bluetooth_get_user_privileges_sync(const unsigned int uid,
        return privileges;
 }
 
-int comms_bluetooth_remove_user_privileges_sync(const unsigned int uid,
-                                                       const char *address)
+int comms_bluetooth_remove_user_privileges_sync(const char *address)
 {
        GError *error = NULL;
        GVariant *result;
@@ -880,7 +877,7 @@ int comms_bluetooth_remove_user_privileges_sync(const unsigned int uid,
 
        result = g_dbus_proxy_call_sync(this_bluetooth->pairing.proxy,
                                "RemoveUserPrivileges",
-                               g_variant_new("(is)", uid, address),
+                               g_variant_new("(s)", address),
                                0, -1, NULL, &error);
 
        if (error) {

diff --git a/src/pairing.c b/src/pairing.c
index 983050f..c09be70 100644 (file)
--- a/src/pairing.c
+++ b/src/pairing.c
@@ -53,16 +53,13 @@ static const GDBusMethodInfo *_pairing_method_info_pointers[] =
                                GDBUS_ARGS(_ARG("agent", "o")), NULL),
        GDBUS_METHOD("UnregisterPairingAgent",
                                GDBUS_ARGS(_ARG("agent", "o")), NULL),
-       GDBUS_METHOD("Pair", GDBUS_ARGS(_ARG("userid", "i"),
-                               _ARG("address", "s")), NULL),
+       GDBUS_METHOD("Pair", GDBUS_ARGS(_ARG("address", "s")), NULL),
        GDBUS_METHOD("CancelPairing", NULL, NULL),
        GDBUS_METHOD("GetUserPrivileges",
-                               GDBUS_ARGS(_ARG("userid", "i"),
-                               _ARG("address", "s")),
+                               GDBUS_ARGS(_ARG("address", "s")),
                                GDBUS_ARGS(_ARG("privilege_id", "i"))),
        GDBUS_METHOD("RemoveUserPrivileges",
-                               GDBUS_ARGS(_ARG("userid", "i"),
-                               _ARG("address", "s")), NULL),
+                               GDBUS_ARGS(_ARG("address", "s")), NULL),
        NULL
 };
 
@@ -736,6 +733,39 @@ static const GDBusInterfaceVTable pairing_agent_vtable =
        NULL
 };
 
+static guint32 get_connection_user_id(GDBusConnection *connection,
+                                       GDBusMethodInvocation *invocation)
+{
+       GError *error = NULL;
+       GVariant *uidvalue;
+       const gchar *sender;
+       guint32 uid;
+
+       DBG("");
+
+       sender = g_dbus_method_invocation_get_sender(invocation);
+       uidvalue = g_dbus_connection_call_sync(connection,
+                               "org.freedesktop.DBus",
+                               "/org/freedesktop/DBus",
+                               "org.freedesktop.DBus",
+                               "GetConnectionUnixUser",
+                               g_variant_new("(s)", sender),
+                               NULL, 0, -1, NULL, &error);
+
+       if (uidvalue == NULL) {
+               DBG("GetConnectionUnixUser: %s", error->message);
+               g_error_free(error);
+               return -1;
+       }
+
+       g_variant_get(uidvalue, "(u)", &uid);
+       g_variant_unref(uidvalue);
+
+       DBG("uid = %d", uid);
+
+       return uid;
+}
+
 static gboolean create_pairing_agent(GDBusConnection *connection)
 {
        DBG("");
@@ -991,7 +1021,7 @@ static void pairing_handler(GDBusConnection *connection,
 {
        bluez_device_t *device;
        gchar *address;
-       guint uid;
+       guint32 uid;
 
        DBG("");
 
@@ -1003,7 +1033,14 @@ static void pairing_handler(GDBusConnection *connection,
 
        isbonding = TRUE;
 
-       g_variant_get(parameters, "(is)", &uid, &address);
+       uid = get_connection_user_id(connection, invocation);
+       if (uid == -1) {
+               comms_error_does_not_exist(invocation);
+               isbonding = FALSE;
+               return;
+       }
+
+       g_variant_get(parameters, "(s)", &address);
 
        if (pairing_device_address)
                g_free(pairing_device_address);
@@ -1213,7 +1250,7 @@ static void get_userprivileges_handler(GDBusConnection *connection,
                                        gpointer user_data)
 {
        gchar *address;
-       guint uid;
+       guint32 uid;
        GVariant *value;
        guint retvalue;
        bluez_device_t *device;
@@ -1222,7 +1259,13 @@ static void get_userprivileges_handler(GDBusConnection *connection,
 
        DBG("+");
 
-       g_variant_get(parameters, "(is)", &uid, &address);
+       uid = get_connection_user_id(connection, invocation);
+       if (uid == -1) {
+               comms_error_does_not_exist(invocation);
+               return;
+       }
+
+       g_variant_get(parameters, "(s)", &address);
 
        device = bluez_adapter_get_device_by_address(default_adapter,
                                                                address);
@@ -1256,11 +1299,17 @@ static void remove_userprivileges_handler(GDBusConnection *connection,
                                        gpointer user_data)
 {
        gchar *address;
-       guint uid;
+       guint32 uid;
 
        DBG("");
 
-       g_variant_get(parameters, "(is)", &uid, &address);
+       uid = get_connection_user_id(connection, invocation);
+       if (uid == -1) {
+               comms_error_does_not_exist(invocation);
+               return;
+       }
+
+       g_variant_get(parameters, "(s)", &address);
 
        remove_userprivileges(uid, address);
 

diff --git a/test/bt-service-lib-test.c b/test/bt-service-lib-test.c
index 925f41b..6c81843 100644 (file)
--- a/test/bt-service-lib-test.c
+++ b/test/bt-service-lib-test.c
@@ -111,13 +111,9 @@ static void bt_simple_result_cb(enum bluez_error_type error_type,
 
 static int bt_pair(void *p1, void *p2)
 {
-       int uid;
-
-       uid = getuid();
-
-       DBG("uid = %d", uid);
+       DBG("");
 
-       comms_bluetooth_device_pair(p1, uid, bt_simple_result_cb, NULL);
+       comms_bluetooth_device_pair(p1, bt_simple_result_cb, NULL);
 
        return 0;
 }