From 605d34ce87817e25461a45a8b4885ed049ef0b65 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 8 Jun 2017 14:43:18 +0100 Subject: [PATCH] bus/driver: Treat connections from inside containers as unprivileged Even if the uid matches, a contained app shouldn't count as the owner of the bus. Signed-off-by: Simon McVittie https://bugs.freedesktop.org/show_bug.cgi?id=101354 --- bus/driver.c | 34 +++++++++++++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/bus/driver.c b/bus/driver.c index feac80ad..104a0b6f 100644 --- a/bus/driver.c +++ b/bus/driver.c @@ -110,6 +110,28 @@ bus_driver_get_conn_helper (DBusConnection *connection, return BUS_DRIVER_FOUND_PEER; } +static dbus_bool_t +bus_driver_check_caller_is_not_container (DBusConnection *connection, + BusTransaction *transaction, + DBusMessage *message, + DBusError *error) +{ + if (bus_containers_connection_is_contained (connection, NULL, NULL, NULL)) + { + const char *method = dbus_message_get_member (message); + + bus_context_log_and_set_error (bus_transaction_get_context (transaction), + DBUS_SYSTEM_LOG_SECURITY, error, DBUS_ERROR_ACCESS_DENIED, + "rejected attempt to call %s by connection %s (%s) in " + "container", method, + nonnull (bus_connection_get_name (connection), "(inactive)"), + bus_connection_get_loginfo (connection)); + return FALSE; + } + + return TRUE; +} + /* * Log a security warning and set error unless the uid of the connection * is either the uid of this process, or on Unix, uid 0 (root). @@ -129,7 +151,16 @@ bus_driver_check_caller_is_privileged (DBusConnection *connection, { #ifdef DBUS_UNIX unsigned long uid; +#elif defined(DBUS_WIN) + char *windows_sid = NULL; + dbus_bool_t ret = FALSE; +#endif + if (!bus_driver_check_caller_is_not_container (connection, transaction, + message, error)) + return FALSE; + +#ifdef DBUS_UNIX if (!dbus_connection_get_unix_user (connection, &uid)) { const char *method = dbus_message_get_member (message); @@ -169,9 +200,6 @@ bus_driver_check_caller_is_privileged (DBusConnection *connection, return TRUE; #elif defined(DBUS_WIN) - char *windows_sid = NULL; - dbus_bool_t ret = FALSE; - if (!dbus_connection_get_windows_user (connection, &windows_sid)) { const char *method = dbus_message_get_member (message); -- 2.13.3