Attachment 85911 Details for Bug 68597 – spec: explicitly mention filtering messages with no INTERFACE

[patch] spec: explicitly mention filtering messages with no INTERFACE

0003-spec-explicitly-mention-filtering-messages-with-no-I.patch (text/plain), 1.59 KB, created by Simon McVittie on 2013-09-16 13:22:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2013-09-16 13:22:01 UTC

Size: 1.59 KB

patch

obsolete

>From cac4ea8b2381e4733f002f22061ff62035bee669 Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Mon, 16 Sep 2013 14:17:25 +0100
>Subject: [PATCH 3/3] spec: explicitly mention filtering messages with no
> INTERFACE
>
>This is an important security measure. Without it, the system bus
>would not deliver its intended security properties. The actual
>implementation has always behaved like this, I think.
>
>Bug: https://bugs.freedesktop.org/show_bug.cgi?id=68597
>---
> doc/dbus-specification.xml | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml
>index eb858bc..3903270 100644
>--- a/doc/dbus-specification.xml
>+++ b/doc/dbus-specification.xml
>@@ -1689,6 +1689,15 @@
>           message as though it had an arbitrary one of those interfaces.
>         </para>
>         <para>
>+          In some situations (such as the well-known system bus), messages
>+          are filtered through an access-control list external to the
>+          remote object implementation. If that filter rejects certain
>+          messages by matching their interface, or accepts only messages
>+          to specific interfaces, it must also reject messages that have no
>+          <literal>INTERFACE</literal>: otherwise, malicious
>+          applications could use this to bypass the filter.
>+        </para>
>+        <para>
>           Method call messages also include a <literal>PATH</literal> field
>           indicating the object to invoke the method on. If the call is passing
>           through a message bus, the message will also have a
>-- 
>1.8.4.rc3
>

Actions: View | Splinter Review

Attachments on bug 68597: 85910 | 85911

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.