Attachment 117814 Details for Bug 91214 – 0001-Restrict-who-can-send-messages-from-the-Agent-path.patch

[patch] 0001-Restrict-who-can-send-messages-from-the-Agent-path.patch

0001-Restrict-who-can-send-messages-from-the-Agent-path.patch (text/plain), 2.89 KB, created by Laurent Bigonville on 2015-08-20 15:38:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Laurent Bigonville

Created: 2015-08-20 15:38:44 UTC

Size: 2.89 KB

patch

obsolete

>From 477d255ae5f20a4e07b88610acd72b267a979128 Mon Sep 17 00:00:00 2001
>From: Laurent Bigonville <bigon@bigon.be>
>Date: Sat, 11 Jul 2015 11:00:04 +0200
>Subject: [PATCH] Restrict who can send messages from the Agent path
>
>Explanation by smvc from the bugreport:
>
>  [...]
>  The issue here is that every file in /etc/dbus-1/system.d applies to
>  everything on the system bus - there is no way to limit policies to
>  particular packages. So Geoclue2's policy allows any uid to call any
>  method on the Properties interface at the path
>  /org/freedesktop/GeoClue2/Agent, in *any* destination.
>
>  You might think "why would any other service have an object at
>  /org/freedesktop/GeoClue2/Agent?", but not all services distinguish
>  between object paths: those that are implemented in terms of simplistic
>  libdbus filters[1] typically do not.
>  [...]
>
>https://bugs.freedesktop.org/show_bug.cgi?id=91214
>---
> configure.ac                                |  1 +
> data/org.freedesktop.GeoClue2.Agent.conf    | 11 -----------
> data/org.freedesktop.GeoClue2.Agent.conf.in | 11 +++++++++++
> 3 files changed, 12 insertions(+), 11 deletions(-)
> delete mode 100644 data/org.freedesktop.GeoClue2.Agent.conf
> create mode 100644 data/org.freedesktop.GeoClue2.Agent.conf.in
>
>diff --git a/configure.ac b/configure.ac
>index 4d42bf3..53a6aad 100644
>--- a/configure.ac
>+++ b/configure.ac
>@@ -187,6 +187,7 @@ AC_CONFIG_FILES([
>   src/public-api/Makefile
>   po/Makefile.in
>   data/org.freedesktop.GeoClue2.conf
>+  data/org.freedesktop.GeoClue2.Agent.conf
>   data/Makefile
>   demo/Makefile
>   docs/Makefile
>diff --git a/data/org.freedesktop.GeoClue2.Agent.conf b/data/org.freedesktop.GeoClue2.Agent.conf
>deleted file mode 100644
>index b9824dc..0000000
>--- a/data/org.freedesktop.GeoClue2.Agent.conf
>+++ /dev/null
>@@ -1,11 +0,0 @@
>-<!DOCTYPE busconfig PUBLIC
>- "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
>- "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
>-<busconfig>
>-  <policy context="default">
>-    <allow send_interface="org.freedesktop.GeoClue2.Agent"
>-           send_path="/org/freedesktop/GeoClue2/Agent"/>
>-    <allow send_interface="org.freedesktop.DBus.Properties"
>-           send_path="/org/freedesktop/GeoClue2/Agent"/>
>-  </policy>
>-</busconfig>
>diff --git a/data/org.freedesktop.GeoClue2.Agent.conf.in b/data/org.freedesktop.GeoClue2.Agent.conf.in
>new file mode 100644
>index 0000000..5a4ec77
>--- /dev/null
>+++ b/data/org.freedesktop.GeoClue2.Agent.conf.in
>@@ -0,0 +1,11 @@
>+<!DOCTYPE busconfig PUBLIC
>+ "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
>+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
>+<busconfig>
>+  <policy user="@dbus_srv_user@">
>+    <allow send_interface="org.freedesktop.GeoClue2.Agent"
>+           send_path="/org/freedesktop/GeoClue2/Agent"/>
>+    <allow send_interface="org.freedesktop.DBus.Properties"
>+           send_path="/org/freedesktop/GeoClue2/Agent"/>
>+  </policy>
>+</busconfig>
>-- 
>2.5.0
>

Actions: View | Splinter Review

Attachments on bug 91214: 117058 | 117059 | 117814 | 117898 | 117899 | 117922

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.