Simon McVittie [Wed, 5 Jul 2017 16:30:27 +0000 (17:30 +0100)]
Update NEWS for the various things that ended up in #101568
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Tue, 20 Jun 2017 10:56:07 +0000 (11:56 +0100)]
test-variant: Add a regression test for DBusVariant
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Fri, 2 Jun 2017 19:19:56 +0000 (20:19 +0100)]
message: Add DBusVariant, a way to copy a single message item
For #100344, we will need a way to store the metadata from the
original method call, and copy them back into arbitrarily many
messages later. This would be easy in GDBus, which has GVariant
as a first-class object. However, libdbus doesn't have an object for
message items, only messages.
We could copy the message's content, but it will carry file descriptors,
which we don't want to copy. Instead, introduce an internal object
representing a message item in a small buffer. It is stored as a variant
(D-Bus type 'v') so that it naturally carries its own type.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 15:43:48 +0000 (16:43 +0100)]
Test dbus_message_iter_abandon_container_if_open under OOM conditions
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 15:31:51 +0000 (16:31 +0100)]
DBusMessageIter: Add a function to abandon possibly-zero-filled iterators
See the doc-comment of the new
dbus_message_iter_abandon_container_if_open() function for details.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 15:04:07 +0000 (16:04 +0100)]
DBusMessageIter: Zero out the iterator on failure
This ensures that callers won't accidentally use it for something
in a way that is considered to be programmer error.
In _dbus_message_iter_check(), insert a specific check for this before
dereferencing iter->message, so that we get a nice assertion failure
(potentially non-fatal) instead of a segfault.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 14:58:50 +0000 (15:58 +0100)]
DBusMessageIter: Clarify the API
Having opened a container for appending, the container must be closed
exactly once.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 13:23:42 +0000 (14:23 +0100)]
test/message: Add a targeted test for recently-fixed leaks
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 17:05:53 +0000 (18:05 +0100)]
internals: Make a minimal _dbus_test_oom_handling() universally available
Previously, it was only available under DBUS_ENABLE_EMBEDDED_TESTS,
because the infrastructure to pretend malloc had failed is only
compiled then. However, I'd like to use it in more modular tests, to
avoid test-dbus continuing to grow. To facilitate that, inline a
trivial version of it when DBUS_ENABLE_EMBEDDED_TESTS is disabled:
it just calls the function, once, without doing any strange things to
the malloc interface.
Similarly, amend the stub implementation of
_dbus_get_malloc_blocks_outstanding() so that references to it are
syntactically valid, and move the DBusTestMemoryFunction typedef so
that it can be used with or without DBUS_ENABLE_EMBEDDED_TESTS.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 14:38:57 +0000 (15:38 +0100)]
dbus_message_iter_open_container: Don't leak signature on failure
If we run out of memory while calling _dbus_type_writer_recurse()
(which is impossible for most contained types, but can happen for
structs and dict-entries), then the memory we allocated in the call to
_dbus_message_iter_open_signature() will still be allocated, and we
have to free it in order to return to the state of the world prior to
calling open_container().
One might reasonably worry that this change can break callers that use
this (incorrect) pattern:
if (!dbus_message_iter_open_container (outer, ..., inner))
{
dbus_message_iter_abandon_container (outer, inner);
goto fail;
}
/* now we know inner is open, and we must close it later */
However, testing that pattern with _dbus_test_oom_handling()
demonstrates that it already dies with a DBusString assertion failure
even before this commit.
This is all concerningly fragile, and I think the next step should be
to zero out DBusMessageIter instances when they are invalidated, so
that a "double-free" is always detected.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 13:13:15 +0000 (14:13 +0100)]
dbus_message_iter_append_basic: Don't leak signature if appending fd fails
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 12:33:30 +0000 (13:33 +0100)]
_dbus_message_iter_open_signature: Clarify why this is not leaky
The same assertion appears closer to the top of the function, and there
is no opportunity for it to have become false here.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 12:31:38 +0000 (13:31 +0100)]
dbus_message_append_args_valist: Don't leak memory on inappropriate type
Found by source code inspection while trying to debug an unrelated
leak.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 16:04:16 +0000 (17:04 +0100)]
_dbus_marshal_validate_test: Uncomment commented-out test coverage
This was added around 12½ years ago, in a commented-out state, and has
remained commented out ever since. It turns out these test vectors
do pass, although perhaps they didn't at the time.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Tue, 4 Jul 2017 16:00:59 +0000 (17:00 +0100)]
_dbus_marshal_validate_test: Merge two sets of signature validity checks
The deleted lines used to be a test for _dbus_validate_signature(),
until I deleted that function. We also had a completely separate
test for _dbus_validate_signature_with_reason() which remains present.
Some of the test vectors were tested in both places.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Mon, 3 Jul 2017 17:58:42 +0000 (18:58 +0100)]
internals: Decouple logging an error from exiting unsuccessfully
This lets _dbus_warn() and _dbus_warn_check_failed() fall through
to flushing stderr and calling _dbus_abort(), meaning that failed
checks and warnings can result in a core dump as intended.
By renaming the FATAL severity to ERROR, we ensure that any code
contributions that assumed the old semantics will fail to compile.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Mon, 3 Jul 2017 18:29:31 +0000 (19:29 +0100)]
Remove now-unused _dbus_validate_signature()
All callers should use _dbus_validate_signature_with_reason() directly.
The only remaining callers were this function's own tests.
As a side benefit, this commit removes a TODO pointing out that this
function did not follow normal DBusString conventions, by considering
a length outside the bounds of the DBusString to be an ordinary
lack of validity rather than a fatal programming error.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Mon, 3 Jul 2017 18:28:08 +0000 (19:28 +0100)]
Remove now-unused _dbus_check_is_valid_signature()
As noted in the previous commit, it's a trap.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Mon, 3 Jul 2017 18:27:14 +0000 (19:27 +0100)]
DBusMessage: Stop using _dbus_check_is_valid_signature()
This function looks appealing, but it is a trap, particularly in
_dbus_return_val_if_fail() checks. It returns a boolean result, which
cannot distinguish between "failed because we ran out of memory" and
"failed because the string is actually invalid"; but
_dbus_validate_signature_with_reason() allocates memory. Use the
over-complicated version directly, so libdbus can continue to
bend over backwards to support the (possibly mythical) operating systems
that limit memory consumption and do not overcommit, such that malloc()
can genuinely return NULL.
Bug detected by running the DBusVariant unit test (fd.o #101568) under
dbus' failing-malloc() instrumentation.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Mon, 3 Jul 2017 18:09:45 +0000 (19:09 +0100)]
_dbus_message_set_signature: Delete unused function
If this is reinstated it will need some checks. In particular, it
was using _dbus_check_is_valid_signature() in an unsafe way:
_dbus_check_is_valid_signature() cannot be used in a
_dbus_return_val_if_fail() check because it does not distinguish
between error by the caller, and out-of-memory conditions.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101568
Simon McVittie [Fri, 30 Jun 2017 09:55:42 +0000 (10:55 +0100)]
NEWS: Reference #101569
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Tue, 20 Jun 2017 12:08:06 +0000 (13:08 +0100)]
build: Introduce ${runstatedir} and use it for the pid file
By default ${runstatedir} is the same as ${localstatedir}/run, but many
Linux distributions configure it to be /run and mount a tmpfs in that
location. All other factors being equal, it is preferable to use /run
where available because it is guaranteed to be local, whereas traversing
/var might involve automounting a networked filesystem (even though
/var/run itself is very likely to be a tmpfs).
/run or /var/run is currently only used in a few places in dbus, but
I plan to make more use of it during the development of
<https://bugs.freedesktop.org/show_bug.cgi?id=100344>.
The pid file is not part of the API between dbus and other software
(other than distribution init scripts for dbus itself), so we do not
need to keep it strictly compatible; so it is OK to move it.
We do not yet use /run for the system bus socket, because that is
part of the API between D-Bus clients and servers, and has always been
"officially" /var/run/dbus/system_bus_socket.
<https://bugs.freedesktop.org/show_bug.cgi?id=101628> tracks the
possibility of changing that.
Similarly, we do not replace /var/run/console with /run/console, because
that path is part of the API between dbus-daemon and the obsolete PAM
modules pam_console and pam_foreground that used /var/run/console.
<https://bugs.freedesktop.org/show_bug.cgi?id=101629> tracks the possible
future removal of that code path.
In the CMake build system, the equivalent of ${runstatedir} remains
hard-coded to the equivalent of ${localstatedir}/run for simplicity. For
the sort of system-wide installations that would consider redefining
${runstatedir} to /run, the Autotools build system is strongly
recommended: in particular this is what Linux distributions are expected
to use.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101569
Simon McVittie [Thu, 29 Jun 2017 21:37:12 +0000 (22:37 +0100)]
spec: Update my email address
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 29 Jun 2017 21:37:04 +0000 (22:37 +0100)]
Start 1.11.16 development
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 29 Jun 2017 17:20:01 +0000 (18:20 +0100)]
1.11.14
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 29 Jun 2017 16:48:06 +0000 (17:48 +0100)]
NEWS for spec changes from #101567
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 29 Jun 2017 15:34:42 +0000 (16:34 +0100)]
spec: Document versioning of eavesdrop='true'
The wording and formatting used here is consistent with other
semi-recently-added match keys.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Thu, 29 Jun 2017 15:32:25 +0000 (16:32 +0100)]
spec: Formally deprecate eavesdropping
Reviewed-by: Philip Withnall <withnall@endlessm.com>
[smcv: Wrap BecomeMonitor in <literal> as per Philip's review]
Signed-off-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Thu, 29 Jun 2017 15:31:46 +0000 (16:31 +0100)]
spec: Do not promise match rules with eavesdrop='true' can be added
This is no longer true, and it seems less misleading to raise an
error than to obey the letter of the spec by quietly ignoring calls
from an inappropriate caller.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Thu, 29 Jun 2017 15:00:41 +0000 (16:00 +0100)]
NEWS: Mention the user-visible part of #101567
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 21 Jun 2017 15:25:01 +0000 (16:25 +0100)]
bus_driver_send_ack_reply: Make available to other modules
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Fri, 2 Jun 2017 13:50:08 +0000 (14:50 +0100)]
driver: Use a data-driven approach to marking methods as privileged
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Fri, 9 Jun 2017 15:24:13 +0000 (16:24 +0100)]
driver: Share bus_driver_get_conn_helper with other modules
Now that we're starting to implement methods in more places, it makes
sense to share this code. The Stats interface can already benefit.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Thu, 8 Jun 2017 17:21:50 +0000 (18:21 +0100)]
driver: Make eavesdropping a privileged action
Eavesdropping on unicast messages to other processes is not something
that should be done by processes in containers, or on the system bus
by users other than root or the bus owner. bus/system.conf.in
does not enable eavesdropping, but adding inadvisable configuration
could. This brings it into line with Monitoring.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Thu, 29 Jun 2017 14:06:45 +0000 (15:06 +0100)]
NEWS: Document #101567
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 28 Jun 2017 17:52:29 +0000 (18:52 +0100)]
test/loopback: Exercise unix:dir addresses
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Wed, 28 Jun 2017 17:52:12 +0000 (18:52 +0100)]
test/loopback: Assert that the connectable address makes sense
When we listen on a tcp: address we should get a connectable tcp:
address, and so on.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Wed, 28 Jun 2017 17:49:18 +0000 (18:49 +0100)]
test/loopback: Don't leak address strings
dbus_server_get_address() returns a copy. It isn't clear why.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Tue, 20 Jun 2017 13:37:04 +0000 (14:37 +0100)]
Add unix:dir=/something addresses
These are like unix:tmpdir=/something, except that the resulting
socket is always path-based, never abstract.
This is desirable for two reasons:
* If a Linux container manager wants to expose a path-based socket
into the container, it can do so by bind-mounting it in the
container's filesystem namespace. That cannot work for abstract
sockets because they are not files.
* Conversely, if a Linux container manager does not want to expose
a path-based socket in the container, it can avoid bind-mounting it,
or bind-mount some harmless object like /dev/null over it.
That cannot work for abstract sockets because access to abstract
sockets is part of the network namespace, which is all-or-nothing.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101567
Simon McVittie [Wed, 28 Jun 2017 18:19:47 +0000 (19:19 +0100)]
Update NEWS for fd.o #101570
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Tue, 20 Jun 2017 14:03:37 +0000 (15:03 +0100)]
Install a systemd tmpfiles.d snippet to create /var/lib/dbus/machine-id
On systemd systems, /etc/machine-id is guaranteed to exist and has
the same format as the D-Bus machine ID. The major D-Bus implementations
read /etc/machine-id if it exists, but some less up-to-date
implementations still only read /var/lib/dbus/machine-id. We can be
nice to those implementations by ensuring /var/lib/dbus/machine-id
is a symlink; this way, the two files can never get out of sync.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101570
Simon McVittie [Wed, 28 Jun 2017 16:28:16 +0000 (17:28 +0100)]
NEWS: Re-word
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Tue, 27 Jun 2017 18:28:15 +0000 (19:28 +0100)]
Merge branch 'dbus-1.10'
Simon McVittie [Tue, 27 Jun 2017 18:26:59 +0000 (19:26 +0100)]
Update NEWS for 1.10.x branch
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Mon, 5 Jun 2017 17:16:42 +0000 (18:16 +0100)]
transport: Don't pile up errors for semicolon-separated components
If we somehow get an autolaunch address with multiple
semicolon-separated components, and one of them fails, then we will
hit an assertion failure when we try the next one.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
(cherry picked from commit
ecdcb86bff42d2bb9cac617bf79f0aa3d47676d9)
Simon McVittie [Wed, 6 May 2015 08:17:06 +0000 (09:17 +0100)]
Doxyfile.in: do not put timestamps in HTML
The build timestamp is not particularly useful (the version number of
the package is already present in the HTML), and it prevents the build
from being reproducible. See <https://reproducible-builds.org/> for more
information.
Signed-off-by: Simon McVittie <smcv@debian.org>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100692
(cherry picked from commit
0310ead0022b3537392869cc2ed3296ba1a7c17d)
Shin-ichi MORITA [Sat, 17 Jun 2017 11:35:30 +0000 (20:35 +0900)]
Fix missing dbus_message_unref() in error reply path
The error message was leaked when blocking on a pending call after
the connection was disconnected.
Reviewed-by: Philip Withnall <withnall@endlessm.com>
[smcv: re-word commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101481
Shin-ichi MORITA [Sat, 17 Jun 2017 11:35:30 +0000 (20:35 +0900)]
Fix missing dbus_message_unref() in error reply path
The error message was leaked when blocking on a pending call after
the connection was disconnected.
Reviewed-by: Philip Withnall <withnall@endlessm.com>
[smcv: re-word commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101481
Simon McVittie [Tue, 20 Jun 2017 08:58:27 +0000 (09:58 +0100)]
test-pending-call-dispatch: Add copyright and license grant
According to git history, this test was written in 2006 by Red Hat
employee John Palmieri and has received only trivial changes since
then. Red Hat gave permission in 2007 for their contributions to
be relicensed under the MIT/X11 license. We cannot take advantage
of that permission to relicense the core library or the dbus-daemon
from GPL-2+|AFL-2.0 to MIT/X11, because one early copyright holder
(CodeFactory AB) could not be traced, but we might as well use a
permissive license for simple test code that has not had
CodeFactory AB contributions.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101481
Simon McVittie [Mon, 12 Jun 2017 10:58:19 +0000 (11:58 +0100)]
Update NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Laurent Bigonville [Tue, 6 Jun 2017 14:06:11 +0000 (16:06 +0200)]
Return the dbus-daemon SELinux context when asking about org.freedesktop.DBus
Currently when asked the SELinux context of the owner of
org.freedesktop.DBus, the dbus-daemon is returning an error.
In the same situation when asked about the Unix user or the PID, the
daemon would return its own user or pid. Do the same for the SELinux
context by returning the daemon one.
In particular this avoids an issue seen with systemd --user, where
dbus-daemon responds to UpdateActivationEnvironment() by passing on the
new environment to systemd with o.fd.systemd1.Manager.SetEnvironment(),
but systemd cannot get the caller's SELinux context and so rejects the
SetEnvironment() call.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101315
[smcv: Extend commit message to describe the symptom this fixes]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Mon, 12 Jun 2017 10:45:26 +0000 (11:45 +0100)]
NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Fri, 9 Jun 2017 13:56:16 +0000 (14:56 +0100)]
Opt-in to deprecation warnings for GLib 2.38 and 2.40
Now that g_test_trap_fork() has gone, we no longer have any calls to
GLib functions deprecated in or before 2.40.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101362
Simon McVittie [Fri, 9 Jun 2017 13:47:39 +0000 (14:47 +0100)]
test/internals/syslog: Switch to g_test_trap_subprocess()
This re-executes the same binary with special command-line options
instead of forking. As a result, it can work on Windows, and is less
dependent on Unix libraries continuing to work across a fork().
(This has been confirmed to work in Windows binaries running under Wine.)
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101362
Simon McVittie [Fri, 9 Jun 2017 13:46:32 +0000 (14:46 +0100)]
Bump GLib dependency for tests to 2.40
This is quite old (it's the version in Ubuntu 14.04 LTS, and older
than the version in Debian 8) but gives us g_test_skip(),
g_test_trap_subprocess() and GVariantDict, all of which will be
useful in the regression tests.
Remove workarounds for old versions.
After this commit we are still using the deprecated g_test_trap_fork(),
which will be removed in a subsequent commit. Don't opt-in to the new
deprecation warnings from 2.38 and 2.40 yet, because under our recommended
settings for dbus developers (-Werror) they would break the build.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101362
Simon McVittie [Thu, 8 Jun 2017 17:41:47 +0000 (18:41 +0100)]
dbus-launch: Use dbus_try_get_local_machine_id()
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=13194
Simon McVittie [Thu, 8 Jun 2017 17:43:38 +0000 (18:43 +0100)]
test-autolaunch: Make recently-added message similar to the others
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 8 Jun 2017 17:37:08 +0000 (18:37 +0100)]
NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Thu, 8 Jun 2017 17:34:33 +0000 (18:34 +0100)]
Refer to dbus_try_get_local_machine_id() in doc-comments
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 7 Jun 2017 16:26:03 +0000 (17:26 +0100)]
Add dbus_try_get_local_machine_id()
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=13194
Simon McVittie [Wed, 7 Jun 2017 16:14:00 +0000 (17:14 +0100)]
Make _dbus_get_local_machine_uuid_encoded() properly failable
This function already raised an error, and all callers handled that
error as gracefully as they could (because _dbus_generate_uuid() is
failable, since 2015). Given that, it seems unnecessarily hostile
to do a _dbus_warn_check_failed() unless we have no better alternative:
yes, it indicates that dbus has not been installed correctly, but
during build-time tests it's entirely reasonable that dbus has not
yet been installed.
Callers are:
* DBusConnection, to implement Peer.GetMachineId()
* The bus driver, to implement Peer.GetMachineId()
* X11 autolaunching
* dbus_get_local_machine_id()
Of those, only the last one is not in a position to return an error
gracefully, so move the _dbus_warn_check_failed() to there.
Migrate the text about the D-Bus library being incorrectly set up
into the error emitted by the Unix implementation, and to make it
less misleading, include separate error messages for both the
files we try to read:
$ bwrap --ro-bind / / --dev /dev --tmpfs /etc --tmpfs /var \
./tools/dbus-uuidgen --get
D-Bus library appears to be incorrectly set up: see the manual
page for dbus-uuidgen to correct this issue. (Failed to open
"/var/lib/dbus/machine-id": No such file or directory; Failed to open
"/etc/machine-id": No such file or directory)
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=13194
Simon McVittie [Thu, 8 Jun 2017 16:04:24 +0000 (17:04 +0100)]
tests: Don't exercise GetMachineId() or autolaunch if no machine ID
At the moment there is a hack in the implementation of GetMachineId()
to stop tests from failing during "make check" on a system where
dbus has never been installed, by silently generating a new unique
fake "machine ID" for each process. I'm about to change that
behaviour to report errors properly; skip affected test-cases if we
can't read the real machine ID.
The shell scripts to test dbus-launch are run both as "make check"
tests (for which it is valid for dbus to be not correctly installed)
and as installed-tests (for which that is not valid), so make them
pass during "make check" but fail during installed testing.
The tests in bus/ and test/name-test/ are only run during "make check"
so they only have the code path where they are skipped.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=13194
Simon McVittie [Wed, 7 Jun 2017 15:13:25 +0000 (16:13 +0100)]
uuidgen: Remove unimplemented declaration
As far as I can tell from git history, this function never existed.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=13194
Simon McVittie [Thu, 8 Jun 2017 16:13:41 +0000 (17:13 +0100)]
NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Fri, 2 Jun 2017 12:32:13 +0000 (13:32 +0100)]
test/dbus-daemon: Exercise Properties, Features and Interfaces
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 11:22:59 +0000 (12:22 +0100)]
test/dbus-daemon: Exercise the Peer interface
We have to skip the GetMachineId() part during build-time testing
if it wouldn't work - there is no guarantee that dbus has ever been
installed on the build system. However, we can insist on it during
installed-tests, if we make sure to complete the installation for the
Travis-CI build by running dbus-uuidgen.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Wed, 7 Jun 2017 13:47:12 +0000 (14:47 +0100)]
Unix sysdeps: Only copy /etc/machine-id to ${sysconfdir} in "ensure" mode
System integration scripts use dbus-uuidgen --ensure, so they are
unaffected by this, and in particular the solution to Bug #77941
is still valid.
The shared library is typically loaded by unprivileged users, so
trying to write out the machine-id file is not going to work anyway.
However, if we *can* write to our ${sysconfdir} - notably during
`make distcheck` - then it is unexpected that merely reading the
machine ID has the side-effect of writing to ${sysconfdir},
and in particular it will make the check for a complete uninstall
fail. We definitely must not delete the machine ID during
`make uninstall`.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 11:04:00 +0000 (12:04 +0100)]
spec: Document the Features and Interfaces properties on o.fd.DBus
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 11:02:48 +0000 (12:02 +0100)]
spec: Document the Peer and Properties interfaces for the message bus
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 10:59:08 +0000 (11:59 +0100)]
driver: Implement the Peer interface, for completeness
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Wed, 31 May 2017 19:34:25 +0000 (20:34 +0100)]
driver: Implement Properties, with Features and Interfaces properties
We recommend using Properties for this sort of thing when designing
D-Bus APIs, so it's a bit hypocritical that the reference message bus
didn't. The Features and Interfaces properties can be used for
feature-discovery as we add new larger features, while the Properties
support can be used for finer-grained properties, for example in the
interface planned for #100344.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Wed, 31 May 2017 19:33:14 +0000 (20:33 +0100)]
driver: Generate child node elements in introspection
This makes the /org/freedesktop/DBus path discoverable.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Wed, 31 May 2017 19:32:38 +0000 (20:32 +0100)]
asv-util: Expose functions to open an arbitrary entry
We'll need this to implement o.fd.DBus.Properties.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Mon, 5 Jun 2017 17:16:42 +0000 (18:16 +0100)]
transport: Don't pile up errors for semicolon-separated components
If we somehow get an autolaunch address with multiple
semicolon-separated components, and one of them fails, then we will
hit an assertion failure when we try the next one.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 11:19:18 +0000 (12:19 +0100)]
test/dbus-daemon: Fix some memory leaks
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101257
Simon McVittie [Fri, 2 Jun 2017 09:53:49 +0000 (10:53 +0100)]
NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 31 May 2017 17:32:05 +0000 (18:32 +0100)]
spec: Document the canonical object path for the bus driver
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101256
Simon McVittie [Wed, 31 May 2017 17:27:11 +0000 (18:27 +0100)]
bus/driver: Only allow specific methods to be called at wrong paths
The default for the future should be that new functionality should
only be available at /org/freedesktop/DBus, which is the canonical
path of the "bus driver" object that represents the message bus.
The disallowed methods are still in Introspect() output, and
raise AccessDenied instead of UnknownMethod, to preserve the invariant
that the o.fd.DBus interface has constant contents.
test/dbus-daemon.c already asserts that UpdateActivationEnvironment()
still raises AccessDenied when invoked on a non-canonical path;
this has been in place since 1.8.14.
Reviewed-by: Philip Withnall <withnall@endlessm.com>
[smcv: Adjust comments, enum order, variable naming as per Philip's review]
Signed-off-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101256
Simon McVittie [Wed, 31 May 2017 17:20:25 +0000 (18:20 +0100)]
bus/driver: Make non-core interfaces unavailable on most object paths
The o.fd.DBus interface needs to remain available on arbitrary object
paths for backwards compatibility, and the Introspectable interface
is genuinely useful, but everything else can be skipped.
This is arguably an incompatible change for the undocumented Verbose
interface, and for the GetAllMatchRules method on the undocumented
Stats interface: previously those were available at all object paths.
Reviewed-by: Philip Withnall <withnall@endlessm.com>
[smcv: Adjust comments, enum order, variable naming as per Philip's review]
Signed-off-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101256
Simon McVittie [Wed, 31 May 2017 17:00:40 +0000 (18:00 +0100)]
test/monitor: Assert that BecomeMonitor() on wrong object path fails
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101256
Simon McVittie [Wed, 31 May 2017 17:45:42 +0000 (18:45 +0100)]
NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Tom Gundersen [Wed, 31 May 2017 15:23:20 +0000 (16:23 +0100)]
spec: Fix indentation
[smcv: separated out from a larger commit, added commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Tom Gundersen [Wed, 31 May 2017 15:22:21 +0000 (16:22 +0100)]
spec: Re-word documentation of ListQueuedOwners
This was previously written in an unusual message-passing-oriented
style, which obscured the meaning. Use a more method-call-oriented
style instead.
[smcv: separated out from a larger commit, added commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Tom Gundersen [Wed, 31 May 2017 15:21:44 +0000 (16:21 +0100)]
spec: Re-word documentation of ReleaseName
This was previously written in an unusual message-passing-oriented
style, which obscured the meaning. Use a more method-call-oriented
style instead.
[smcv: separated out from a larger commit, added commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Tom Gundersen [Wed, 31 May 2017 15:21:00 +0000 (16:21 +0100)]
Spec: Re-word documentation of RequestName
This was previously written in an unusual message-passing-oriented
style, which obscured the meaning. Use a more method-call-oriented
style instead.
[smcv: separated out from a larger commit, added commit message]
Reviewed-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 31 May 2017 15:17:22 +0000 (16:17 +0100)]
spec: Move ListQueuedOwners API description to list of methods
Tom Gundersen pointed out that RequestName, ReleaseName and
ListQueuedOwners were documented in their own section instead of being
put together with the other method calls, which makes it more difficult
to apply changes consistently across all methods.
I'm moving them one at a time to make the changes reviewable, since
the diff resulting from moving all three as a unit is too large to
review sensibly.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 31 May 2017 15:17:02 +0000 (16:17 +0100)]
spec: Move ReleaseName API description to list of methods
Tom Gundersen pointed out that RequestName, ReleaseName and
ListQueuedOwners were documented in their own section instead of being
put together with the other method calls, which makes it more difficult
to apply changes consistently across all methods.
I'm moving them one at a time to make the changes reviewable, since
the diff resulting from moving all three as a unit is too large to
review sensibly.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 31 May 2017 15:16:20 +0000 (16:16 +0100)]
spec: Move RequestName API description to list of methods
Tom Gundersen pointed out that RequestName, ReleaseName and
ListQueuedOwners were documented in their own section instead of being
put together with the other method calls, which makes it more difficult
to apply changes consistently across all methods.
I'm moving them one at a time to make the changes reviewable, since
the diff resulting from moving all three as a unit is too large to
review sensibly.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 31 May 2017 12:44:08 +0000 (13:44 +0100)]
Update NEWS
Signed-off-by: Simon McVittie <smcv@collabora.com>
Laurent Bigonville [Thu, 4 May 2017 12:06:14 +0000 (14:06 +0200)]
configure.ac: Drop check for selinux/av_permissions.h
selinux/av_permissions.h is deprecated and is not even used in the code
since commit
ba088208bc0c35ca418a097a8482c4a7705f4a43, in 2013.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100912
Reviewed-by: Simon McVittie <smcv@collabora.com>
Laurent Bigonville [Mon, 3 Oct 2016 18:12:32 +0000 (20:12 +0200)]
Remove unnecessary cast, bus_sid is already of type security_id_t
Reviewed-by: Simon McVittie <smcv@collabora.com>
Laurent Bigonville [Mon, 3 Oct 2016 18:08:20 +0000 (20:08 +0200)]
Remove calls to sidget/sidput
sidget and sidput functions are noop and deprecated since libselinux 2.0.86.
Also use pkg-config to detect libselinux and force version >= 2.0.86
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100912
Reviewed-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Wed, 19 Apr 2017 10:45:42 +0000 (11:45 +0100)]
Merge branch 'dbus-1.10'
Simon McVittie [Wed, 19 Apr 2017 10:44:52 +0000 (11:44 +0100)]
HACKING: Update git URIs to sync up with cgit.freedesktop.org
git.freedesktop.org no longer offers anonymous checkouts; that facility
moved to anongit.freedesktop.org.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100715
Simon McVittie [Tue, 18 Apr 2017 16:21:35 +0000 (17:21 +0100)]
Update NEWS
Simon McVittie [Sat, 15 Apr 2017 20:06:23 +0000 (21:06 +0100)]
Pass in DBUS_TEST_EXEC via environment, not hard-coded into binaries
This avoids "capturing" the build directory in the built binaries
when built with embedded tests, which is good for reproducible builds.
See <https://reproducible-builds.org/> for more information.
Signed-off-by: Simon McVittie <smcv@debian.org>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100692
Simon McVittie [Tue, 18 Apr 2017 11:52:35 +0000 (12:52 +0100)]
Update NEWS
Signed-off-by: Simon McVittie <smcv@debian.org>
Simon McVittie [Wed, 6 May 2015 08:17:06 +0000 (09:17 +0100)]
Doxyfile.in: do not put timestamps in HTML
The build timestamp is not particularly useful (the version number of
the package is already present in the HTML), and it prevents the build
from being reproducible. See <https://reproducible-builds.org/> for more
information.
Signed-off-by: Simon McVittie <smcv@debian.org>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100692
Simon McVittie [Fri, 14 Apr 2017 12:04:13 +0000 (13:04 +0100)]
Ensure hyphen/minus is treated as literal in regexes
Each U+002D HYPHEN-MINUS in [0-9A-Za-z_-/.\] is treated as a member of a
range. The third one, which appears to have been intended to be a
literal, is part of an empty range because the starting point
U+005F LOW LINE is greater than the endpoint U+002F SOLIDUS, resulting
in at least some grep implementations not considering U+002D, U+002F
or U+005F to match the pattern. This resulted in one of the
dbus-launch tests being unintentionally skipped when it used a
regex based on the one in the spec.
regex(7) suggests "To include a literal '-' [in a bracketed character
set], make it the first or last character".
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100686
Simon McVittie [Fri, 14 Apr 2017 11:35:06 +0000 (12:35 +0100)]
transient-services integration test: Create the right directory
Signed-off-by: Simon McVittie <smcv@collabora.com>
Reviewed-by: Philip Withnall <withnall@endlessm.com>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=100686