dbus: Fix CVE-2015-0245

Fix CVE-2015-0245 by preventing non-root and non-systemd processes from fooling the dbus daemon into thinking systemd service activation failed.

Signed-off-by Jussi Kukkonen <[email protected]>

---
 meta/recipes-core/dbus/dbus.inc                    |  1 +
 ...015-0245-prevent-forged-ActivationFailure.patch | 48 
++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent

(quoted diff) +0 -1

-forged-ActivationFailure.patch

meta/recipes renamed from meta/recipes-core/dbus/dbus.inc +0 -1

-core/dbus/dbus.inc

index fb5d017..f1744c8 100644

meta/recipes-core/dbus/dbus.inc +1 -2

@@ -17,6 +17,7 @@ SRC_URI = "
 http://dbus.freedesktop.org/releases/dbus/dbus-${PV}.tar.gz \
            file://dbus-1.init \
            file://os-test.patch \
            file://clear-guid_from_server-if
-send_negotiate_unix_f.patch \
+           file://CVE-2015-0245-prevent-forged
-ActivationFailure.patch \
 "
 
 inherit useradd autotools pkgconfig gettext update-rc.d

(quoted diff) +0 -2

-ActivationFailure.patch b/meta/recipes-core/dbus/dbus/CVE-2015-0245
-prevent-forged-ActivationFailure.patch

new file mode 100644
index 0000000..59363b3

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +1 -1

-ActivationFailure.patch

@@ -0,0 +1,48 @@
+CVE-2015-0245: prevent forged ActivationFailure from non-root 

processes

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +10 -0

+
+Upstream has fixed this in code but suggests using this as a easily
+backportable fix: https://bugs.freedesktop.org/show_bug.cgi?id=88811
+
+Upstream-Status: Inappropriate
+Signed-off-by: Jussi Kukkonen <[email protected]>
+
+
+
+From 91eb2ea3362630190e08c1c777c47bae065ac828 Mon Sep 17 00:00:00 

2001

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +3 -0

+From: Simon McVittie <[email protected]>
+Date: Mon, 26 Jan 2015 20:09:56 +0000
+Subject: [PATCH 1/3] CVE-2015-0245: prevent forged ActivationFailure 

from
+ non-root processes

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +3 -1

+
+Without either this rule or better checking in dbus-daemon, non
-systemd
+processes can make dbus-daemon think systemd failed to activate a 

system

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +21 -0

+service, resulting in an error reply back to the requester.
+
+This is redundant with the fix in the C code (which I consider to be
+the real solution), but is likely to be easier to backport.
+---
+ bus/system.conf.in | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/bus/system.conf.in b/bus/system.conf.in
+index 92f4cc4..851b9e6 100644
+--- a/bus/system.conf.in
++++ b/bus/system.conf.in
+@@ -68,6 +68,14 @@
+     <deny send_destination="org.freedesktop.DBus"
+           send_interface="org.freedesktop.DBus"
+           send_member="UpdateActivationEnvironment"/>
++    <deny send_destination="org.freedesktop.DBus"
++          send_interface="org.freedesktop.systemd1.Activator"/>
++  </policy>
++
++  <!-- Only systemd, which runs as root, may report activation 

failures. -->
++ <policy user="root">
++ <allow send_destination="org.freedesktop.DBus"
++ send_interface="org.freedesktop.systemd1.Activator"/>

meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged new file +6 -0

+   </policy>
+ 
+   <!-- Config files are placed here that among other things, punch 
+-- 
+2.1.4
+

This is for fido and possibly dizzy, not master.

D-Bus 1.8.16 fixes CVE-2015-0245 "prevent forged ActivationFailure from non-root processes". This patch does not contain the same fix but a configuration change that upstream suggests as a easily backportable fix.

The issue is only a local denial of service so not terribly dangerous, but should be worth fixing since the patch is not intrusive.

I've only tested this on fido, so the [dizzy] is just a suggestion.

Cheers, Jussi

The following changes since commit eb4a134a60e3ac26a48379675ad6346a44010339:

scripts/combo-layer: Fix exit codes and tty handling (2015-06-11 15:00:20 +0100)

are available in the git repository at:

git://git.yoctoproject.org/poky-contrib jku/dbus-fix-for-fido
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=jku/dbus-fix-for-fido

Jussi Kukkonen (1):
dbus: CVE-2015-0245: prevent forged ActivationFailure

  meta/recipes-core/dbus/dbus.inc                    |  1 +
  ...015-0245-prevent-forged-ActivationFailure.patch | 48 ++++++++++++++++++++++
  2 files changed, 49 insertions(+)

create mode 100644 meta/recipes-core/dbus/dbus/CVE-2015-0245-prevent-forged-ActivationFailure.patch