Commits · b1c54b5a75824e765ecc27b5820c8e9fa0cbaaed · dbus / dbus

03 Feb, 2015 14 commits

NEWS · b1c54b5a
Simon McVittie authored Feb 03, 2015

b1c54b5a

Add a regression test for systemd activation · cf35dad2

Simon McVittie authored Jan 26, 2015

4.5 years after it was implemented, here is the regression test.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=57952
Reviewed-by: Philip Withnall

cf35dad2

bus_context_log_and_set_error: add and use · 652a324f
Simon McVittie authored Feb 02, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall
```
652a324f

_dbus_set_error_valist: add · c6e02483

Simon McVittie authored Feb 02, 2015

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

c6e02483

bus_context_log_literal: add simplified version of bus_context_log · 3861a426
Simon McVittie authored Feb 02, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall
```
3861a426

bus: put the printf attribute in the header where it will do more good · 5b89e2a8

Simon McVittie authored Feb 02, 2015

Now we can actually notice incorrect format strings in other
translation units.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

5b89e2a8

bus driver: factor out bus_driver_check_caller_is_privileged, and allow root · 1f716452

Simon McVittie authored Jan 26, 2015

Unlike the initial mitigation for CVE-2014-8148, we now allow
uid 0 to call UpdateActivationEnvironment. There's no point in root
doing that, but there's also no reason why it's particularly bad -
if an attacker is uid 0 we've already lost - and it simplifies
use of this function for future things that do want to be callable
by root, like BecomeMonitor for #46787.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

1f716452

Add a test for uid-controlled permissions · 98ae1149

Simon McVittie authored Jan 26, 2015

This is technical debt from mitigating CVE-2014-8148, which should
really have had a regression test at the time.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

98ae1149

Add infrastructure to run bits of tests under an alternative uid · 6a49ced2
Simon McVittie authored Jan 26, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall
```
6a49ced2

test: implement GLib-style "installed tests" · 1e21cc86

Simon McVittie authored Jan 26, 2015

We run each test twice:

* once with the system's session.conf, as an integration test
  (test-cases that need a special configuration are automatically
  skipped)
* once with our special test configuration files, which provide better
  coverage

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

1e21cc86

Generate test configuration files via build-time sed, not configure · ee032f5a

Simon McVittie authored Jan 26, 2015

This means we can generate a version that works when installed,
from the same source files.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

ee032f5a

Factor out some utility functions from test/dbus-daemon* · 8b238f3f

Simon McVittie authored Jan 26, 2015

In the process, make test_kill_pid() safer: do not try to terminate
more than one pid, or the NULL handle.

Also stop leaking the address_fd in spawn_dbus_daemon, a pre-existing
bug that was spotted by Philip Withnall during review.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

8b238f3f

Bump required GLib version to 2.36 · 6976a7f1

Simon McVittie authored Feb 02, 2015

This is for g_close(), which the next commit will use. It also lets us
rely on g_type_init() being a no-op (since 2.32 the type system is
always initialized by a global constructor).

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88810
Reviewed-by: Philip Withnall

6976a7f1

Update .gitignore files · 9668c617

Lukasz Skalski authored Feb 03, 2015

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88943Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

9668c617

02 Feb, 2015 4 commits

NEWS · 9e0f5ae7
Simon McVittie authored Feb 02, 2015

9e0f5ae7

lcov: use builddir, not srcdir · 1acc7b09

Simon McVittie authored Jan 23, 2015

It seems lcov (or gcc?) has changed its paths since last time this
worked.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88808
Reviewed-by: Philip Withnall

1acc7b09

Enable subdir-objects Automake option · 7cf5d2fa

Simon McVittie authored Jan 26, 2015

It has been supported since at least 1.10, and its absence is
deprecated since 1.14.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88808
Reviewed-by: Philip Withnall

7cf5d2fa

bus: exit on fatal errors even if not syslogging · ef06f2a2
Simon McVittie authored Jan 22, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88808
Reviewed-by: Philip Withnall
```
ef06f2a2

30 Jan, 2015 3 commits

Fix 'dbus-daemon on Windows: Failed to bind socket "localhost:xxxx": Address already in use'. · 795ea300
Ralf Habacker authored Jan 30, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=87999Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
```
795ea300

In _dbus_listen_tcp_socket() set socket family to ipv4 in unspecified case for now. · 91dbd2ef

Ralf Habacker authored Jan 27, 2015

This fix is required to support at least ipv4 tcp support calling
_dbus_listen_tcp_socket() without family.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=87999Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

91dbd2ef

Add manual tcp test case. · fa1ada44

Ralf Habacker authored Jan 28, 2015

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=87999Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

fa1ada44

29 Jan, 2015 1 commit

_dbus_string_append_printf_valist: avoid leaking copy of varargs · b5bf3389

Simon McVittie authored Jan 06, 2015

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88087Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

b5bf3389

27 Jan, 2015 2 commits

Use pygi instead of pygobject 2 · 04056bba

Simon McVittie authored Nov 06, 2014

pygobject 2 is obsolete and unmaintained, and anyway this is for
optional functionality (full regression test coverage) rather than
anything that will be needed in production builds.
Signed-off-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=85969

04056bba

Fix build with --enable-maintainer-mode --disable-embedded-tests · 180f3a80

Thiago Macieira authored Dec 29, 2014

Otherwise, we get:
dbus/dbus-object-tree.c:323:1: error: 'find_subtree' defined but not used [-Werror=unused-function]

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=87837Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>

180f3a80

06 Jan, 2015 4 commits
- When generating random messages, exercise empty signature as intended · 254b47aa
  Simon McVittie authored Jan 06, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88089
```
  254b47aa
- _dbus_marshal_validate_test: test both /foo/ and foo/ · 778c4ee2
  Simon McVittie authored Jan 06, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88089
```
  778c4ee2
- selinux: avoid leaking on systems where va_start allocates memory · c89cbed9
  Simon McVittie authored Jan 06, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88087
```
  c89cbed9
- Fix assertion in regression test to be equality test, not assignment · 1650d77b
  Simon McVittie authored Jan 06, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88088
```
  1650d77b
05 Jan, 2015 8 commits
- Merge branch 'dbus-1.8' · 4a7cb0cb
  Simon McVittie authored Jan 05, 2015
```
Conflicts:
	NEWS
	configure.ac
```
  4a7cb0cb
- Merge tag 'dbus-1.9.6' · d97e8f95
  Simon McVittie authored Jan 05, 2015
```
dbus-1.9.6

Conflicts:
	NEWS
	configure.ac
```
  d97e8f95
- 1.8.15 · a559ed35
  Simon McVittie authored Jan 05, 2015
  
  a559ed35
- Merge tag 'dbus-1.8.14' into dbus-1.8 · 9a8bf9d8
  Simon McVittie authored Jan 05, 2015
```
dbus-1.8.14
```
  9a8bf9d8
- Fix usage of undefined variable DBUS_WIN32 on cmake build system · fd4f3ca3
  Ralf Habacker authored Jan 04, 2015
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88010Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
```
  fd4f3ca3
- Merge branch 'dbus-1.8' · ea54a97f
  Ralf Habacker authored Jan 05, 2015
```
Conflicts:
	NEWS
	configure.ac
```
  ea54a97f
- Windows cmake cross compile fix · 01af167b
  Ralf Habacker authored Jan 03, 2015
```
We need to include 'test' subdir in any case not only when using glib.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88009Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
```
  01af167b
- Fix of 'dbus-daemon can only handle 64 simultaneous connections on Windows'. · 2abe9ffe
  Ralf Habacker authored Jan 27, 2014
```
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=71297Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
```
  2abe9ffe
01 Jan, 2015 4 commits

Merge branch 'dbus-1.8' and prepare 1.9.6 · ae9d7149
Simon McVittie authored Jan 01, 2015
```
Conflicts:
	NEWS
	configure.ac
	test/dbus-daemon.c
```
ae9d7149
Prepare release for Monday · abbbf449
Simon McVittie authored Jan 01, 2015

abbbf449

Hardening: only accept Stats function calls at the canonical object path · eec885de

Simon McVittie authored Dec 19, 2014

These function calls are not a privilege escalation risk like
UpdateActivationEnvironment, but they might provide sensitive
information or be enhanced to provide sensitive information
in future, so the default system.conf locks them down to root-only.
Apply the same canonical-object-path hardening as for
UpdateActivationEnvironment.

We do not apply the uid check here because they are less dangerous
than UpdateActivationEnvironment, and because the ability to unlock
these function calls for specific uids is a documented configuration
for developers.
Reviewed-by: Thiago Macieira <thiago@kde.org>
[added missing #include; extended commit message -smcv]

eec885de

Add a regression test for path-based UpdateActivationEnvironment hardening · 4daf4bdc
Simon McVittie authored Dec 19, 2014
```
Reviewed-by: Thiago Macieira <thiago@kde.org>
```
4daf4bdc