Attachment 139948 Details for Bug 105656 – 36/39] containers: Limit the messages sent by connections with an Allow policy

[patch] 36/39] containers: Limit the messages sent by connections with an Allow policy

0036-containers-Limit-the-messages-sent-by-connections-wi.patch (text/plain), 2.97 KB, created by Simon McVittie on 2018-06-01 19:15:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2018-06-01 19:15:54 UTC

Size: 2.97 KB

patch

obsolete

>From 085aa3e6083a0aa63f043dd116fc07c568ee6398 Mon Sep 17 00:00:00 2001
>From: Simon McVittie <smcv@collabora.com>
>Date: Thu, 31 May 2018 17:25:45 +0100
>Subject: [PATCH 36/39] containers: Limit the messages sent by connections with
> an Allow policy
>
>The baseline rules for connections in containers with a policy are
>as follows:
>
>* Can send legitimate replies that don't contain Unix fds
>* Can't send Unix fds (as an easy way to mitigate the complexity
>  and low arbitrary limits of Unix fd passing, which carries a risk
>  of exploitable bugs)
>* Can send messages to the dbus-daemon that don't contain Unix fds
>* Can send messages to connections in the same container (including,
>  as a trivial case, themselves)
>* Can't send anything not explicitly allowed
>
>Signed-off-by: Simon McVittie <smcv@collabora.com>
>---
> bus/containers.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 48 insertions(+)
>
>diff --git a/bus/containers.c b/bus/containers.c
>index d0bfe510..1d9f3011 100644
>--- a/bus/containers.c
>+++ b/bus/containers.c
>@@ -1672,6 +1672,54 @@ bus_containers_check_can_send (DBusConnection *sender,
>                           bus_connection_get_loginfo (sender));
>           return FALSE;
>         }
>+
>+      /* Requested replies that contain Unix fds are covered by policy
>+       * (fall through). Requested replies that don't contain Unix fds
>+       * are unconditionally allowed. */
>+      if (!dbus_message_contains_unix_fds (message))
>+        return TRUE;
>+    }
>+
>+  if (instance->has_policy)
>+    {
>+      BusContainerInstance *recipient_instance;
>+
>+      if (dbus_message_contains_unix_fds (message))
>+        {
>+          dbus_set_error (error, DBUS_ERROR_ACCESS_DENIED,
>+                          "Connection \"%s\" (%s) is in a container that is "
>+                          "not allowed to send file descriptors",
>+                          bus_connection_get_name (sender),
>+                          bus_connection_get_loginfo (sender));
>+          return FALSE;
>+        }
>+
>+      if (proposed_recipient == NULL)
>+        {
>+          const char *dest = dbus_message_get_destination (message);
>+
>+          /* Containers can always talk to the dbus-daemon itself */
>+          if (dest != NULL && strcmp (dest, DBUS_SERVICE_DBUS) == 0)
>+            return TRUE;
>+        }
>+
>+      recipient_instance = connection_get_instance (proposed_recipient);
>+
>+      if (recipient_instance == instance)
>+        {
>+          /* Messages pass freely within a container */
>+          return TRUE;
>+        }
>+
>+      /* TODO: Have a policy by which containers can optionally send
>+       * messages to the outside */
>+
>+      dbus_set_error (error, DBUS_ERROR_ACCESS_DENIED,
>+                      "Connection \"%s\" (%s) is in a container that is "
>+                      "not allowed to send most messages",
>+                      bus_connection_get_name (sender),
>+                      bus_connection_get_loginfo (sender));
>+      return FALSE;
>     }
> #endif /* DBUS_ENABLE_CONTAINERS */
> 
>-- 
>2.17.0
>

Actions: View | Splinter Review

Attachments on bug 105656: 139908 | 139909 | 139911 | 139912 | 139914 | 139915 | 139916 | 139917 | 139919 | 139920 | 139921 | 139923 | 139925 | 139926 | 139927 | 139928 | 139929 | 139930 | 139931 | 139932 | 139933 | 139934 | 139935 | 139936 | 139937 | 139938 | 139939 | 139940 | 139941 | 139942 | 139943 | 139944 | 139945 | 139946 | 139947 | 139948 | 139949 | 139950 | 139951 | 140008 | 140009 | 140269 | 140270 | 140271 | 140272 | 140452 | 140453 | 140454 | 141363 | 141364 | 141378 | 141379 | 141380 | 141382

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.