If I login as root and create a session bus, then login as another user, I am able to use dbus-send to connect to root's session bus. To reproduce: Login as root, open a terminal, echo $DBUS_SESSION_BUS_ADDRESS, write down the address. Run dbus-monitor --session Login as another user on a console, run: env DBUS_SESSION_BUS_ADDRESS=(address written down above) dbus-send --dest=org.freedesktop.DBus --type=method_call --print-reply /org/freedesktop/DBus org.freedesktop.DBus.ListServices The dbus-send gives a message about not being able to print the return value, and the dbus-monitor on root's session bus shows the ListServices request coming through.
Created attachment 1802 [details] [review] possible fix
s/=/==/ in that patch...
Created attachment 1803 [details] [review] better fix s/=/==/ After discussion we decided allowing root was bad, you can always put <allow user="root"/> in the conf file if you want.
I've assigned CAN-2005-0201 to this issue.
This was fixed some time ago
Um. This patch only ever got applied to the 0.2x branch, which means that 0.3x is still vulnerable. Recommend applying this to HEAD and releasing 0.36.2 with no further changes immediately.
restricting to newly-formed dbus security group
j5 -- can we do 0.36.2?
Fix is in CVS on the DBUS_0_36_2 and HEAD branches and released at http://
http://dbus.freedesktop.org/releases/dbus-0.36.2.tar.gz Opening up bug since it is public
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.