From cac4ea8b2381e4733f002f22061ff62035bee669 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Mon, 16 Sep 2013 14:17:25 +0100 Subject: [PATCH 3/3] spec: explicitly mention filtering messages with no INTERFACE This is an important security measure. Without it, the system bus would not deliver its intended security properties. The actual implementation has always behaved like this, I think. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=68597 --- doc/dbus-specification.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml index eb858bc..3903270 100644 --- a/doc/dbus-specification.xml +++ b/doc/dbus-specification.xml @@ -1689,6 +1689,15 @@ message as though it had an arbitrary one of those interfaces. + In some situations (such as the well-known system bus), messages + are filtered through an access-control list external to the + remote object implementation. If that filter rejects certain + messages by matching their interface, or accepts only messages + to specific interfaces, it must also reject messages that have no + INTERFACE: otherwise, malicious + applications could use this to bypass the filter. + + Method call messages also include a PATH field indicating the object to invoke the method on. If the call is passing through a message bus, the message will also have a -- 1.8.4.rc3