Simon McVittie [Wed, 24 Sep 2014 16:44:03 +0000 (17:44 +0100)]
spec: in the table of types, classify them
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=84188
Reviewed-by: Lennart Poettering
Simon McVittie [Mon, 6 Oct 2014 11:17:07 +0000 (12:17 +0100)]
Start 1.9.2, update NEWS
Alban Crequy [Thu, 2 Oct 2014 13:21:24 +0000 (14:21 +0100)]
GetAllMatchRules: provide an example how it could be used
[use dist_examples_SCRIPTS instead of EXTRA_DIST -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=84598
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Wed, 1 Oct 2014 18:35:08 +0000 (19:35 +0100)]
1.9.0
Alban Crequy [Fri, 26 Sep 2014 10:26:32 +0000 (11:26 +0100)]
config: add examples to show how to enable/disable the Stats interface
[install examples to ${docdir}/examples -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80759
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Fri, 5 Sep 2014 14:15:14 +0000 (15:15 +0100)]
Enable Stats interface by default; disallow non-root use on system bus
[fix typo in interface name -alban]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80759
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Sebastian Rasmussen [Thu, 25 Sep 2014 07:29:00 +0000 (09:29 +0200)]
dbus-launch: Fix typo in manpage
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=84313
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Thu, 25 Sep 2014 10:46:39 +0000 (11:46 +0100)]
Use ISO C strchr() instead of BSD index()
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Alban Crequy [Wed, 24 Sep 2014 15:29:21 +0000 (16:29 +0100)]
match_rule_to_string: add test
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Wed, 24 Sep 2014 15:28:56 +0000 (16:28 +0100)]
match_rule_to_string: fix escaping
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Wed, 24 Sep 2014 13:15:44 +0000 (14:15 +0100)]
match_rule_to_string: returns NULL if no memory instead of looping
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Tue, 23 Sep 2014 17:51:47 +0000 (18:51 +0100)]
Stats: GetAllMatchRules: add tests
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Mon, 30 Jun 2014 12:44:58 +0000 (13:44 +0100)]
Implement GetAllMatchRules on the Stats interface
Usage:
$ dbus-send --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus \
org.freedesktop.DBus.Debug.Stats.GetAllMatchRules
method return sender=org.freedesktop.DBus -> dest=:1.13 reply_serial=2
array [
dict entry(
string ":1.4"
array [
]
)
dict entry(
string ":1.9"
array [
string "type='signal',interface='org.freedesktop.DBus',member='NameOwnerChanged'"
]
)
dict entry(
string ":1.11"
array [
string "eavesdrop='true'"
]
)
]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Wed, 24 Sep 2014 16:43:35 +0000 (17:43 +0100)]
Describe quoting for match rules
I wish I could say "I can't believe this was never documented", but
it wouldn't be true.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=24307
Reviewed-by: Alban Crequy
Ralf Habacker [Wed, 24 Sep 2014 21:23:31 +0000 (23:23 +0200)]
Fix test suite fails on test-dbus with --enable-tests (but no assertions).
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83968
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Tue, 23 Sep 2014 16:43:30 +0000 (17:43 +0100)]
Expand documentation of NO_REPLY_EXPECTED
The message type is more important than whether NO_REPLY_EXPECTED is
set, when deciding whether a reply is expected. This documents
existing practice in at least libdbus, GDBus and dbus-daemon.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75749
Reviewed-by: Thiago Macieira
Simon McVittie [Tue, 23 Sep 2014 18:25:31 +0000 (19:25 +0100)]
inotify: make sure we set the close-on-exec flag
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=73689
Reviewed-by: Ralf Habacker
[add <dbus/dbus-sysdeps-unix.h> which is now required for
_dbus_fd_set_close_on_exec -smcv]
Ralf Habacker [Wed, 17 Sep 2014 08:09:33 +0000 (10:09 +0200)]
Build test-bus-system with cmake on non win32 platforms.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83583
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Wed, 17 Sep 2014 16:19:53 +0000 (17:19 +0100)]
New test for fd-passing
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83622
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
[add dbus-sysdeps-unix.h as required for close-on-exec in master -smcv]
Simon McVittie [Tue, 16 Sep 2014 16:50:14 +0000 (17:50 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
configure.ac
Simon McVittie [Tue, 16 Sep 2014 16:47:46 +0000 (17:47 +0100)]
1.8.9
Simon McVittie [Mon, 15 Sep 2014 16:44:55 +0000 (17:44 +0100)]
NEWS for 1.9
Alban Crequy [Fri, 27 Jun 2014 15:25:23 +0000 (16:25 +0100)]
dbus-monitor: more details on file descriptors
Print more details when receiving a file descriptor.
Before:
unix fd 5
After:
file descriptor
inode: 1030
type: char
file descriptor
inode: 295664
type: socket
address family: unknown (16)
file descriptor
inode: 295665
type: socket
address family: inet
name 127.0.0.1 port 47723
peer 127.0.0.1 port 22
file descriptor
inode: 295666
type: socket
address family: unix
name @/tmp/d67s774Sws0pEra
file descriptor
inode: 295667
type: socket
address family: unix
name @
peer @
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80603
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Fri, 27 Jun 2014 15:33:39 +0000 (16:33 +0100)]
dbus-monitor: do not leak file descriptors from fd-passing
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80603
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Mon, 15 Sep 2014 11:43:04 +0000 (12:43 +0100)]
Prepare 1.8.8 (embargoed until tomorrow)
Ralf Habacker [Fri, 8 Aug 2014 20:02:08 +0000 (22:02 +0200)]
Fix installation of empty directories for cmake build system.
The differences has been found out by comparing with the cross compiled
mingw..-dbus packages.
[exclude system bus support bits on Windows -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83583
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Thu, 11 Sep 2014 16:37:49 +0000 (17:37 +0100)]
Make various system-bus-related things Unix-only
There is no system bus on Windows, and there won't be until/unless
it can be secure.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83583
Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
Simon McVittie [Thu, 11 Sep 2014 11:04:04 +0000 (12:04 +0100)]
Split _dbus_fd_set_close_on_exec into Unix and Windows versions
On Unix, the thing that can be made close-on-exec is a file descriptor,
which is an int.
On Windows, the thing that can be made close-on-exec is a HANDLE,
which is pointer-sized (but not necessarily a pointer!). In practice,
on Windows we only called _dbus_fd_set_close_on_exec() on socket
pseudo-file-descriptors (SOCKET, which is an unsigned int);
every SOCKET can validly be cast to HANDLE, but not every HANDLE
is a SOCKET.
Before this commit we used an intptr_t as a sort of fake
union { int; HANDLE; }, which just obscures what's going on.
In practice, everything that called _dbus_fd_set_close_on_exec()
is really platform-specific anyway, so let's just have two separate
functions and call this solved.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=39610
Simon McVittie [Tue, 9 Sep 2014 11:44:22 +0000 (12:44 +0100)]
_dbus_read_socket_with_unix_fds: do not accept extra fds in cmsg padding
This addresses CVE-2014-3635.
If (*n_fds * sizeof (int) % sizeof (size_t)) is nonzero,
then CMSG_SPACE (*n_fds * sizeof (int)) > CMSG_LEN (*n_fds * sizeof (int)
because the SPACE includes padding to a size_t boundary, whereas the LEN
does not. We have to allocate the SPACE. Previously, we told the kernel
that the buffer size we wanted was the SPACE, not the LEN, which meant
it was free to fill the padding with additional fds: on a 64-bit
platform with 32-bit int, that's one extra fd, if *n_fds happens
to be odd.
This meant that a malicious sender could send exactly 1 fd too many,
which would make us fail an assertion if enabled, or overrun a buffer
by 1 fd otherwise.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83622
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Simon McVittie [Tue, 9 Sep 2014 11:49:44 +0000 (12:49 +0100)]
Add _DBUS_GNUC_UNUSED, and use it in _DBUS_STATIC_ASSERT
This means we can use _DBUS_STATIC_ASSERT at non-global scope without
tripping -Wunused-local-typedefs.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83767
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
(cherry picked from commit
0e3d08d45cb9a9ceb2c077875eeb38306dad37b8)
Alban Crequy [Mon, 21 Jul 2014 16:17:11 +0000 (17:17 +0100)]
bus: enforce pending_fd_timeout
This is one of four commits needed to address CVE-2014-3637.
The bus uses _dbus_connection_set_pending_fds_function and
_dbus_connection_get_pending_fds_count to be notified when there are pending
file descriptors. A timeout per connection is armed and disarmed when the file
descriptor list is used and emptied.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80559
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Fri, 18 Jul 2014 16:28:32 +0000 (17:28 +0100)]
DBusConnection: implements _dbus_connection_set_pending_fds_function
This is one of four commits needed to address CVE-2014-3637.
This will allow the bus to be notified whenever a file descriptor is added or
removed from a DBusConnection's DBusMessageLoader.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80559
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Fri, 18 Jul 2014 15:45:07 +0000 (16:45 +0100)]
DBusConnection: implements _dbus_connection_get_pending_fds_count
This is one of four commits needed to address CVE-2014-3637.
This will allow the bus to know whether there are pending file descriptors in a
DBusConnection's DBusMessageLoader.
https://bugs.freedesktop.org/show_bug.cgi?id=80559
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
[fix compilation on platforms that do not HAVE_UNIX_FD_PASSING -smcv]
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Mon, 21 Jul 2014 16:34:08 +0000 (17:34 +0100)]
config: add new limit: pending_fd_timeout
This is one of four commits needed to address CVE-2014-3637.
When a file descriptor is passed to dbus-daemon, the associated D-Bus message
might not be fully sent to dbus-daemon yet. Dbus-daemon keeps the file
descriptor in the DBusMessageLoader of the connection, waiting for the rest of
the message. If the client stops sending the remaining bytes, dbus-daemon will
wait forever and keep that file descriptor.
This patch adds pending_fd_timeout (milliseconds) in the configuration to
disconnect a connection after a timeout when a file descriptor was sent but not
the remaining message.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80559
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Fri, 4 Jul 2014 14:05:51 +0000 (15:05 +0100)]
Stop listening on DBusServer sockets when reaching max_incomplete_connections
This addresses the parts of CVE-2014-3639 not already addressed by
reducing the default authentication timeout.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80851
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80919
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Alban Crequy [Tue, 8 Jul 2014 11:00:58 +0000 (12:00 +0100)]
config: change default auth_timeout to 5 seconds
This partially addresses CVE-2014-3639.
This will change the default on the system bus where the limit
<limit name="auth_timeout">...</limit>
is not specified.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80919
Reviewed-by: Thiago Macieira <thiago@kde.org>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Fri, 12 Sep 2014 14:51:39 +0000 (15:51 +0100)]
config: change DEFAULT_MESSAGE_UNIX_FDS to 16
This addresses CVE-2014-3636.
Based on a patch by Alban Crequy. Now that it's the same on all
platforms, there's little point in it being set by configure/cmake.
This change fixes two distinct denials of service:
fd.o#82820, part A
------------------
Before this patch, the system bus had the following default configuration:
- max_connections_per_user: 256
- DBUS_DEFAULT_MESSAGE_UNIX_FDS: usually 1024 (or 256 on QNX, see fd.o#61176)
as defined by configure.ac
- max_incoming_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS*4 = usually 4096
- max_outgoing_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS*4 = usually 4096
- max_message_unix_fds: DBUS_DEFAULT_MESSAGE_UNIX_FDS = usually 1024
This means that a single user could create 256 connections and transmit
256*4096 = 1048576 file descriptors.
The file descriptors stay attached to the dbus-daemon process while they are
in the message loader, in the outgoing queue or waiting to be dispatched before
D-Bus activation.
dbus-daemon is usually limited to 65536 file descriptors (ulimit -n). If the
limit is reached and dbus-daemon needs to receive a message with a file
descriptor attached, this is signalled by recvfrom with the flag MSG_CTRUNC.
Dbus-daemon cannot recover from that error because the kernel does not have any
API to retrieve a file descriptor which has been discarded with MSG_CTRUNC.
Therefore, it closes the connection of the sender. This is not necessarily the
connection which generated the most file descriptors so it can lead to
denial-of-service attacks.
In order to prevent DoS issues, this patch reduces DEFAULT_MESSAGE_UNIX_FDS to
16:
max_connections_per_user * max_incoming_unix_fds = 256 * 64 = 16384
This is less than the usual "ulimit -n" (65536) with a good margin to
accomodate the other sources of file descriptors (stdin/stdout/stderr,
listening sockets, message loader, etc.).
Distributors on non-Linux may need to configure a smaller limit in
system.conf, if their limit on the number of fds is smaller than
Linux's.
fd.o#82820, part B
------------------
On Linux, it's not possible to send more than 253 fds in a single sendmsg()
call: sendmsg() would return -EINVAL.
#define SCM_MAX_FD 253
SCM_MAX_FD changed value during Linux history:
- it used to be (OPEN_MAX-1)
- commit
c09edd6eb (Jul 2007) changed it to 255
- commit
bba14de98 (Nov 2010) changed it to 253
Libdbus always sends all of a message's fds, and the beginning
of the message itself, in a single sendmsg() call. Combining these
two, a malicious sender could split a message across two or more
sendmsg() calls to construct a composite message with 254 or more
fds. When dbus-daemon attempted to relay that message to its
recipient in a single sendmsg() call, it would receive EINVAL,
interpret that as a fatal socket error and disconnect the recipient,
resulting in denial of service.
This is fixed by keeping max_message_unix_fds <= SCM_MAX_FD.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=82820
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Alban Crequy [Thu, 10 Jul 2014 14:08:06 +0000 (15:08 +0100)]
system bus limit: use max_replies_per_connection=128 by default
This addresses CVE-2014-3638.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=81053
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Thu, 11 Sep 2014 11:55:52 +0000 (12:55 +0100)]
Replace some runtime assertions with compile-time assertions
This requires a little bit of code re-ordering, because
_DBUS_STATIC_ASSERT can appear anywhere that a variable declaration
would be valid, i.e. not after executable code.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83767
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Simon McVittie [Tue, 9 Sep 2014 11:49:44 +0000 (12:49 +0100)]
Add _DBUS_GNUC_UNUSED, and use it in _DBUS_STATIC_ASSERT
This means we can use _DBUS_STATIC_ASSERT at non-global scope without
tripping -Wunused-local-typedefs.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83767
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Simon McVittie [Mon, 15 Sep 2014 10:51:26 +0000 (11:51 +0100)]
Merge branch 'dbus-1.8'
Simon McVittie [Mon, 15 Sep 2014 10:50:57 +0000 (11:50 +0100)]
NEWS for 1.8
Simon McVittie [Mon, 15 Sep 2014 10:50:48 +0000 (11:50 +0100)]
On Linux, call prctl to disable core dumps
Whenever I forget to turn off corekeeper, the regression tests
take ages to record all test-segfault's crashes.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83772
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Simon McVittie [Fri, 12 Sep 2014 11:36:20 +0000 (12:36 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
Simon McVittie [Fri, 12 Sep 2014 11:35:31 +0000 (12:35 +0100)]
NEWS for 1.8.x
Umut Tezduyar Lindskog [Tue, 2 Sep 2014 07:02:31 +0000 (09:02 +0200)]
enable build support without systemd compatibility libraries
systemd 209 merged all the libraries to libsystemd. Old
libraries can still be enabled with --enable-compat-libs
switch in systemd but this increases the binary size.
Implement a fallback library check in case compat libraries
dont exist.
[Fixed underquoting; switched priority so we try libsystemd first -smcv]
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Chengwei Yang [Tue, 3 Dec 2013 07:52:15 +0000 (15:52 +0800)]
free_pending_restore_data --> free_restore_pending_data
This patch doesn't do any function change, but only the function name,
to align its name with the struct RestorePendingData.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=72254
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Ralf Habacker [Fri, 5 Sep 2014 12:36:52 +0000 (14:36 +0200)]
Port dbus_directory_...() function to use win32 native api instead of opendir()/readdir() and closedir() emulation.
This fixes a license issue introduced by the initial win32 port.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Ralf Habacker [Mon, 8 Sep 2014 13:15:55 +0000 (13:15 +0000)]
Add directory test application 'manual-dir-iter' to cmake and autotools build system.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Ralf Habacker [Fri, 5 Sep 2014 16:02:44 +0000 (18:02 +0200)]
Add dbus string convenience function _dbus_string_init_from_string().
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Ralf Habacker [Fri, 5 Sep 2014 05:40:29 +0000 (07:40 +0200)]
Improve debug message to be able to see empty files.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57272
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Ralf Habacker [Sun, 7 Sep 2014 09:37:32 +0000 (11:37 +0200)]
Merge branch 'dbus-1.8'
Ralf Habacker [Tue, 14 Jan 2014 23:45:41 +0000 (00:45 +0100)]
Fix windows doc for running tests.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=41252
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Fri, 5 Sep 2014 15:51:02 +0000 (16:51 +0100)]
NEWS for 1.9
Simon McVittie [Fri, 5 Sep 2014 15:48:00 +0000 (16:48 +0100)]
NEWS for 1.8
Simon McVittie [Fri, 5 Sep 2014 12:41:12 +0000 (13:41 +0100)]
Merge branch 'dbus-1.8'
Alban Crequy [Thu, 24 Jul 2014 07:04:48 +0000 (08:04 +0100)]
Stats: fix compilation issue
Bug-Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=507232
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=81043
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Thomas Haller [Wed, 2 Jul 2014 09:12:26 +0000 (11:12 +0200)]
doc/dbus-tutorial: fix tutorial to reference the proper GType for 'ay'
DBUS_TYPE_G_BYTE_ARRAY does not exist. It should be DBUS_TYPE_G_UCHAR_ARRAY
Signed-off-by: Thomas Haller <thaller@redhat.com>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80795
Ralf Habacker [Fri, 8 Aug 2014 16:57:10 +0000 (18:57 +0200)]
Win32 cmake msvc16 64 bit native and mingw32/64 4.8.3 cross compile fix.
This patch fixes a "missing include directory" compile error on test-print build target.
Bug: http://lists.freedesktop.org/archives/dbus/2014-August/016260.html
Reviewed-by: rony@wu.ac.at
Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
Simon McVittie [Wed, 2 Jul 2014 17:33:51 +0000 (18:33 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
configure.ac
Simon McVittie [Wed, 2 Jul 2014 17:24:44 +0000 (18:24 +0100)]
start 1.8.7
Simon McVittie [Mon, 30 Jun 2014 13:18:03 +0000 (14:18 +0100)]
Prepare 1.8.6 in advance
Alban Crequy [Tue, 24 Jun 2014 16:57:14 +0000 (17:57 +0100)]
Handle ETOOMANYREFS when sending recursive fds (SCM_RIGHTS)
Since Linux commit 25888e (from 2.6.37-rc4, Nov 2010), sendmsg() on Unix
sockets returns -1 errno=ETOOMANYREFS ("Too many references: cannot splice")
when the passfd mechanism (SCM_RIGHTS) is "abusively" used recursively by
applications. A malicious client could use this to force a victim system
service to be disconnected from the system bus; the victim would likely
respond by exiting. This is a denial of service (fd.o #80163,
CVE-2014-3532).
This patch silently drops the D-Bus message on ETOOMANYREFS and does not close
the connection.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80163
Reviewed-by: Thiago Macieira <thiago@kde.org>
[altered commit message to explain DoS significance -smcv]
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Wed, 11 Jun 2014 11:24:20 +0000 (12:24 +0100)]
If loader contains two messages with fds, don't corrupt the second
There were two bugs here: we would previously overwrite the unused
fds with the already-used fds instead of the other way round, and
we would copy n bytes where we should have copied n ints.
Additionally, sending crafted messages in a chosen sequence to a victim
system service could cause an invalid file descriptor to be present
when dbus-daemon tries to forward one of those crafted messages to the
victim, causing sendmsg() to fail with EBADF, which resulted in
disconnecting the victim service, which would likely respond to that
by exiting. This is a denial of service (fd.o #80469, CVE-2014-3533).
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=79694
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80469
Reviewed-by: Alban Crequy <alban.crequy@collabora.co.uk>
Simon McVittie [Wed, 11 Jun 2014 10:56:00 +0000 (11:56 +0100)]
NEWS
Patrick Welche [Fri, 6 Jun 2014 13:03:39 +0000 (14:03 +0100)]
bus_set_watched_dirs: portability patch for systems which lack O_CLOEXEC
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77032
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Wed, 11 Jun 2014 10:46:27 +0000 (11:46 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
configure.ac
Simon McVittie [Wed, 11 Jun 2014 10:45:42 +0000 (11:45 +0100)]
NEWS
Simon McVittie [Wed, 11 Jun 2014 10:45:28 +0000 (11:45 +0100)]
NEWS
Patrick Welche [Wed, 4 Jun 2014 15:44:19 +0000 (16:44 +0100)]
configure.ac: backtrace() may be in libexecinfo
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=69702
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Роман Донченко [Wed, 11 Jun 2014 10:38:24 +0000 (11:38 +0100)]
dbus-launch: kill bus if we can't attach to a session when requested
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=74698
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Jaap Boender [Wed, 11 Jun 2014 10:14:10 +0000 (11:14 +0100)]
Don't call poll(2) with timeout < -1
On Linux, poll accepts any negative value as infinity.
On at least FreeBSD and NetBSD, only -1 is acceptable.
[adjusted whitespace for correct coding style -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78480
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Lukasz Skalski [Tue, 20 May 2014 15:27:51 +0000 (17:27 +0200)]
.gitignore: ignore incoming-limit.conf file
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78977
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Tue, 10 Jun 2014 17:43:40 +0000 (18:43 +0100)]
reset version
Simon McVittie [Tue, 10 Jun 2014 17:36:00 +0000 (18:36 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
configure.ac
Simon McVittie [Thu, 5 Jun 2014 13:54:36 +0000 (14:54 +0100)]
Prepare embargoed security release
Alban Crequy [Tue, 20 May 2014 13:37:37 +0000 (14:37 +0100)]
CVE-2014-3477: deliver activation errors correctly, fixing Denial of Service
How it should work:
When a D-Bus message activates a service, LSMs (SELinux or AppArmor) check
whether the message can be delivered after the service has been activated. The
service is considered activated when its well-known name is requested with
org.freedesktop.DBus.RequestName. When the message delivery is denied, the
service stays activated but should not receive the activating message (the
message which triggered the activation). dbus-daemon is supposed to drop the
activating message and reply to the sender with a D-Bus error message.
However, it does not work as expected:
1. The error message is delivered to the service instead of being delivered to
the sender. As an example, the error message could be something like:
An SELinux policy prevents this sender from sending this
message to this recipient, [...] member="MaliciousMethod"
If the sender and the service are malicious confederates and agree on a
protocol to insert information in the member name, the sender can leak
information to the service, even though the LSM attempted to block the
communication between the sender and the service.
2. The error message is delivered as a reply to the RequestName call from
service. It means the activated service will believe it cannot request the
name and might exit. The sender could activate the service frequently and
systemd will give up activating it. Thus the denial of service.
The following changes fix the bug:
- bus_activation_send_pending_auto_activation_messages() only returns an error
in case of OOM. The prototype is changed to return TRUE, or FALSE on OOM
(and its only caller sets the OOM error).
- When a client is not allowed to talk to the service, a D-Bus error message
is pre-allocated to be delivered to the client as part of the transaction.
The error is not propagated to the caller so RequestName will not fail
(except on OOM).
[fixed a misleading comment -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=78979
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: Colin Walters <walters@verbum.org>
Simon McVittie [Wed, 30 Apr 2014 20:05:46 +0000 (21:05 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
configure.ac
Simon McVittie [Wed, 30 Apr 2014 19:58:39 +0000 (20:58 +0100)]
development version
Simon McVittie [Wed, 30 Apr 2014 19:14:51 +0000 (20:14 +0100)]
1.8.2
Руслан Ижбулатов [Sat, 8 Mar 2014 04:18:43 +0000 (04:18 +0000)]
Handle 0x0d0a EOLs in spawn_dbus_daemon()
On W32 dbus daemon will print output in text mode, with 0x0d0a EOLs instead
of just 0x0a. Be able to handle that.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75863
Reviewed-by: Simon McVittie
Simon McVittie [Wed, 30 Apr 2014 18:21:47 +0000 (19:21 +0100)]
NEWS
Роман Донченко [Wed, 30 Apr 2014 18:11:56 +0000 (19:11 +0100)]
Avoid killing all available processes if an X error arrives early on
The timeline of events in dbus-launch's main process goes something like this:
* do initial X calls
[1]
* do some other stuff
* fork
(child process starts doing some other stuff)
* return "intermediate parent" pid from fork()
* obtain bus daemon pid from bus_pid_to_launcher_pipe
[2]
* do things that might include X11 calls or killing the dbus-daemon
Meanwhile, the "babysitter" child goes like this:
* return 0 from fork()
[3]
* obtain bus daemon pid from parent process via bus_pid_to_babysitter_pipe
[4]
* do things that might include X11 calls or killing the bus daemon
Before [1] or [3], the right thing to do about an X error is to just
exit. The current implementation called kill(-1) first, which is
undesirable: it kills unrelated processes. With this change, we
just exit.
After [2] or [4], the right thing to do is to kill the dbus-daemon,
and that's what the existing code did.
Between [1] and [2], or between [3] and [4], there is no correct thing
that we can do immediately: we would have to wait for the end of the
"critical section", *then* kill the dbus-daemon. This has not yet been
implemented, so this patch relies for its correctness on the fact that
there are no libX11 calls between those points, so we cannot receive
an X error between them.
dbus-launch deserves more comments, or a reimplementation that is easier to
understand, but this change is certainly better than nothing.
[Commit message added, summarizing reviewers' comments -smcv]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=74698
Reviewed-by: Simon McVittie
Reviewed-by: Thiago Macieira
Simon McVittie [Mon, 28 Apr 2014 15:01:24 +0000 (16:01 +0100)]
NEWS
Chengwei Yang [Sat, 18 Jan 2014 04:17:43 +0000 (12:17 +0800)]
Set argv[0] to dbus-launch to avoid misleading info from /proc
At previous, argv[0] is the full-qualified path of program, however, if
start dbus-launch failed, it will fall back to find one from $PATH,
while keep the argv[0] as the full-qualified path. So we'll get
misleading info from /proc or ps(1) about dbus-launch process.
One simple solution is just hard-code argv[0] to dbus-launch.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=69716
Reviewed-by: Simon McVittie
Simon McVittie [Mon, 28 Apr 2014 14:48:40 +0000 (15:48 +0100)]
more NEWS for 1.9
Simon McVittie [Mon, 28 Apr 2014 14:46:53 +0000 (15:46 +0100)]
Merge branch 'dbus-1.8'
Conflicts:
NEWS
Simon McVittie [Mon, 28 Apr 2014 14:45:22 +0000 (15:45 +0100)]
NEWS for 1.8
Cameron Norman [Mon, 28 Apr 2014 14:42:11 +0000 (15:42 +0100)]
Add "Documentation=man:dbus-daemon(1)" line to systemd service
Enhances usability under systemd by making the documentation available
with systemctl status or systemctl help.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77447
Reviewed-by: Simon McVittie
Simon McVittie [Fri, 25 Apr 2014 17:51:26 +0000 (18:51 +0100)]
Try to read /etc/machine-id before inventing a new /var/lib/dbus/machine-id
It's least confusing if the two files have the same contents. systemd
already knows how to pick up our /var/lib/dbus/machine-id if it exists
and /etc/machine-id doesn't, but the converse is not currently true.
We should make it true, so that it doesn't matter what order
systemd-machine-id-setup and "dbus-uuidgen --ensure" were
invoked in.
In Debian, systemd currently Recommends dbus, so "dbus-uuidgen --ensure"
will *usually* - but not always! - run first, and the two files will
match. However, if you install systemd without dbus, and then install
dbus later, there will be a mismatch. With this change, it doesn't
matter which one is installed first: whichever one happens to come
first, it will generate the machine ID, and then the other one will
copy it.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77941
Reviewed-by: Lennart Poettering
Simon McVittie [Fri, 25 Apr 2014 17:30:19 +0000 (18:30 +0100)]
_dbus_write_uuid_file: factor out function to write a known UUID
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=77941
Reviewed-by: Lennart Poettering
Руслан Ижбулатов [Thu, 6 Mar 2014 23:17:13 +0000 (23:17 +0000)]
Make documentation generating MSYS/MSYS2-compatible
xmlto is a shell script, it needs to be fed MSYSsy filenames.
This patch adds a cygpath invocation for filename conversion (autotools do
that automatically, for CMake you have to spell it out). Cygwpath is available
in MSYS2 (and Cygwin, obviously).
When cygpath is not available, use MSYS-specific pwd extension to get W32 path.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75860
Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
Simon McVittie [Thu, 13 Mar 2014 12:15:26 +0000 (12:15 +0000)]
Merge branch 'dbus-1.8'
David Zeuthen [Thu, 20 Feb 2014 23:42:13 +0000 (15:42 -0800)]
Update email-address for David Zeuthen.
I no longer have the email address davidz@redhat.com so update it to
my current address.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75288
Simon McVittie [Thu, 6 Mar 2014 13:11:09 +0000 (13:11 +0000)]
Merge branch 'dbus-1.8'
Lukasz Skalski [Thu, 6 Mar 2014 11:39:20 +0000 (12:39 +0100)]
Update .gitignore files
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=75833
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Simon McVittie [Mon, 3 Mar 2014 15:59:10 +0000 (15:59 +0000)]
.gitignore: ignore /test-driver, generated by recent Automake
Simon McVittie [Mon, 3 Mar 2014 15:58:42 +0000 (15:58 +0000)]
NEWS for 1.9
Simon McVittie [Mon, 3 Mar 2014 15:44:51 +0000 (15:44 +0000)]
Merge branch 'dbus-1.8'
Simon McVittie [Mon, 3 Mar 2014 15:44:44 +0000 (15:44 +0000)]
NEWS for dbus-1.8