From: Simon McVittie Date: Thu, 12 Apr 2018 13:09:19 +0000 (+0100) Subject: dbus-daemon(1): Recommend requiring EXTERNAL on non-Windows OSs X-Git-Tag: dbus-1.12.8~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3a37f8bc2ab731b1771d8bab0b78dd37c8fd05e;p=thirdparty%2Fdbus.git dbus-daemon(1): Recommend requiring EXTERNAL on non-Windows OSs This is the default, and blocks TCP-based attacks by making the attacker fail to authenticate (while also preventing inadvisable TCP-based configurations from working). Bug: https://bugs.freedesktop.org/show_bug.cgi?id=106004 Signed-off-by: Simon McVittie Reviewed-by: Ralf Habacker Reviewed-by: Philip Withnall (cherry picked from commit aef4475939a773e1a205a71d641ea2bb6793ab92) --- diff --git a/doc/dbus-daemon.1.xml.in b/doc/dbus-daemon.1.xml.in index 899cec26a..42e3f86f9 100644 --- a/doc/dbus-daemon.1.xml.in +++ b/doc/dbus-daemon.1.xml.in @@ -491,6 +491,10 @@ exist, then all known mechanisms are allowed. If there are multiple <auth> elements, all the listed mechanisms are allowed. The order in which mechanisms are listed is not meaningful. +On non-Windows operating systems, allowing only the + EXTERNAL authentication + mechanism is strongly recommended. This is the default for the + well-known system bus and for the well-known session bus. Example: <auth>EXTERNAL</auth>