From: Simon McVittie <simon.mcvittie@collabora.co.uk>
Date: Mon, 16 Sep 2013 13:17:25 +0000 (+0100)
Subject: spec: explicitly mention filtering messages with no INTERFACE
X-Git-Tag: dbus-1.7.10~23
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c388a5d213aa28f5d92a19150a697c5eba5554f;p=thirdparty%2Fdbus.git

spec: explicitly mention filtering messages with no INTERFACE

This is an important security measure. Without it, the system bus
would not deliver its intended security properties. The actual
implementation has always behaved like this, I think.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=68597
Reviewed-by: Chengwei Yang <chengwei.yang@intel.com>
---

diff --git a/doc/dbus-specification.xml b/doc/dbus-specification.xml
index 865a8bff5..629ab10cd 100644
--- a/doc/dbus-specification.xml
+++ b/doc/dbus-specification.xml
@@ -1699,6 +1699,15 @@
           Implementations may choose to either return an error, or deliver the
           message as though it had an arbitrary one of those interfaces.
         </para>
+        <para>
+          In some situations (such as the well-known system bus), messages
+          are filtered through an access-control list external to the
+          remote object implementation. If that filter rejects certain
+          messages by matching their interface, or accepts only messages
+          to specific interfaces, it must also reject messages that have no
+          <literal>INTERFACE</literal>: otherwise, malicious
+          applications could use this to bypass the filter.
+        </para>
         <para>
           Method call messages also include a <literal>PATH</literal> field
           indicating the object to invoke the method on. If the call is passing