From: Mike Gorse <mgorse@suse.com>
Date: Mon, 7 Dec 2015 17:53:49 +0000 (-0600)
Subject: Always accept connections as root if unable to find an owning user
X-Git-Tag: AT_SPI2_ATK_2_19_90~1
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=97f163edd95e46be9aa5d8315fbbed75fa5d8323;p=platform%2Fupstream%2Fat-spi2-atk.git

Always accept connections as root if unable to find an owning user

When running as root, we look through /proc to try to identify our
parent and check that it matches the user making a connection. However,
this check does not always yield useful information and also will
always fail on anything that isn't Linux. Unsure what security
implications this change has, but then it isn't ideal to run UI as
the super-user in the first place, yet users sometimes need to do so
for various reasons, and a11y needs to be enabled, so adding this
change unless a better solution is found.
---

diff --git a/atk-adaptor/bridge.c b/atk-adaptor/bridge.c
index 9c2117f..d0ca5da 100644
--- a/atk-adaptor/bridge.c
+++ b/atk-adaptor/bridge.c
@@ -661,7 +661,10 @@ user_check (DBusConnection *bus, unsigned long uid, void *data)
   if (uid == getuid () || uid == geteuid ())
     return TRUE;
   if (getuid () == 0)
-    return get_ancestral_uid (getpid ()) == uid;
+  {
+    guint ancestor = get_ancestral_uid (getpid ());
+    return (ancestor == uid || ancestor == 1 || ancestor == 0);
+  }
   return FALSE;
 }