Attachment 112911 Details for Bug 88811 – [1.8] CVE-2015-0245: prevent forged ActivationFailure from non-root processes

[patch] [1.8] CVE-2015-0245: prevent forged ActivationFailure from non-root processes

0001-CVE-2015-0245-prevent-forged-ActivationFailure-from-.patch (text/plain), 1.38 KB, created by Simon McVittie on 2015-01-28 14:47:08 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simon McVittie

Created: 2015-01-28 14:47:08 UTC

Size: 1.38 KB

patch

obsolete

>From 91eb2ea3362630190e08c1c777c47bae065ac828 Mon Sep 17 00:00:00 2001
>From: Simon McVittie <simon.mcvittie@collabora.co.uk>
>Date: Mon, 26 Jan 2015 20:09:56 +0000
>Subject: [PATCH 1/3] CVE-2015-0245: prevent forged ActivationFailure from
> non-root processes
>
>Without either this rule or better checking in dbus-daemon, non-systemd
>processes can make dbus-daemon think systemd failed to activate a system
>service, resulting in an error reply back to the requester.
>
>This is redundant with the fix in the C code (which I consider to be
>the real solution), but is likely to be easier to backport.
>---
> bus/system.conf.in | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/bus/system.conf.in b/bus/system.conf.in
>index 92f4cc4..851b9e6 100644
>--- a/bus/system.conf.in
>+++ b/bus/system.conf.in
>@@ -68,6 +68,14 @@
>     <deny send_destination="org.freedesktop.DBus"
>           send_interface="org.freedesktop.DBus"
>           send_member="UpdateActivationEnvironment"/>
>+    <deny send_destination="org.freedesktop.DBus"
>+          send_interface="org.freedesktop.systemd1.Activator"/>
>+  </policy>
>+
>+  
>+  <policy user="root">
>+    <allow send_destination="org.freedesktop.DBus"
>+           send_interface="org.freedesktop.systemd1.Activator"/>
>   </policy>
> 
>   <!-- Config files are placed here that among other things, punch 
>-- 
>2.1.4
>

Actions: View | Splinter Review

Attachments on bug 88811: 112849 | 112850 | 112851 | 112852 | 112911 | 112912 | 112913

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.