|
 |
b11b5f |
From 004130ae74688eb321aadc05192bab69fe5cbcbf Mon Sep 17 00:00:00 2001
|
|
|
b11b5f |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
b11b5f |
Date: Fri, 22 Jul 2022 11:45:12 +0200
|
|
|
b11b5f |
Subject: [PATCH] manager: limit access to private dbus socket
|
|
|
b11b5f |
|
|
|
b11b5f |
For the system manager, /run/systemd/private is publicly accessible, because
|
|
|
b11b5f |
/run/systemd is 0755, and /run/systemd/private is 0777. For the user manager,
|
|
|
b11b5f |
/run/user/<uid> is 0700, and /run/user/<uid>/systemd/private is 0777. This
|
|
|
b11b5f |
does not directly cause any security issue because we check the sender in
|
|
|
b11b5f |
bus_check_peercred (ucred.uid != 0 && ucred.uid != geteuid()).
|
|
|
b11b5f |
|
|
|
b11b5f |
But it makes sense to limit access to the socket to avoid wasting time in PID1.
|
|
|
b11b5f |
Somebody could send messages there that'd we'd reject anyway. It also makes
|
|
|
b11b5f |
things more explicit.
|
|
|
b11b5f |
|
|
|
b11b5f |
(cherry picked from commit df1cbd1adf26071aab41d96e054452a3d66103a4)
|
|
|
b11b5f |
|
|
|
b11b5f |
Resolves: #2119405
|
|
|
b11b5f |
---
|
|
|
b11b5f |
src/core/dbus.c | 4 +++-
|
|
|
b11b5f |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
b11b5f |
|
|
|
b11b5f |
diff --git a/src/core/dbus.c b/src/core/dbus.c
|
|
|
b11b5f |
index 66d838cdb4..ec6c52cb85 100644
|
|
|
b11b5f |
--- a/src/core/dbus.c
|
|
|
b11b5f |
+++ b/src/core/dbus.c
|
|
|
b11b5f |
@@ -42,6 +42,7 @@
|
|
|
b11b5f |
#include "string-util.h"
|
|
|
b11b5f |
#include "strv.h"
|
|
|
b11b5f |
#include "strxcpyx.h"
|
|
|
b11b5f |
+#include "umask-util.h"
|
|
|
b11b5f |
#include "user-util.h"
|
|
|
b11b5f |
|
|
|
b11b5f |
#define CONNECTIONS_MAX 4096
|
|
|
b11b5f |
@@ -1019,7 +1020,8 @@ int bus_init_private(Manager *m) {
|
|
|
b11b5f |
if (fd < 0)
|
|
|
b11b5f |
return log_error_errno(errno, "Failed to allocate private socket: %m");
|
|
|
b11b5f |
|
|
|
b11b5f |
- r = bind(fd, &sa.sa, salen);
|
|
|
b11b5f |
+ RUN_WITH_UMASK(0077)
|
|
|
b11b5f |
+ r = bind(fd, &sa.sa, salen);
|
|
|
b11b5f |
if (r < 0)
|
|
|
b11b5f |
return log_error_errno(errno, "Failed to bind private socket: %m");
|
|
|
b11b5f |
|