Now that we are recommending Meson, let's de-emphasize Autotools.
Anyone who still needs Autotools will already know how it works, at
least generically.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Mon, 7 Aug 2023 19:19:17 +0000 (20:19 +0100)]
On 32-bit glibc, define _TIME_BITS to 64 if not already defined
On older 32-bit architectures such as i386, this redefines time_t to be
64-bit, and correspondingly increases the size of all system data
structures that contain a time_t, such as struct timeval and struct stat.
This is necessary to allow timestamps beyond January 2038 to be
represented; as well as things that obviously deal with timestamps,
this affects functions like stat() (and therefore our wrapper
_dbus_stat()), which will fail with EOVERFLOW if asked to inspect a
file whose correct timestamp does not fit in time_t.
In particular, if the modification or access timestamp on
/etc/machine-id has somehow been set to a post-2038 time, libdbus will
consider the inability to stat() that file to be an installation error,
and when using the deprecated dbus_get_local_machine_id(), that can
cause third-party i386 software such as the Steam client to crash.
Using 64-bit timestamps avoids that failure mode.
Using 64-bit timestamps in glibc is an opt-in and not the default,
because if done carelessly it can change libraries' ABIs. However,
libdbus is careful not to include system headers and system data
types in its own headers, with the only exceptions being extremely
basic ISO C headers like <stddef.h> and <stdarg.h>; so we can safely
do this without it breaking our ABI. This is similar to the reasoning
for why commit 96ffc2a0 "configure.ac: support large-file for stat64"
was a safe change.
This change only affects glibc. Some non-GNU operating system libraries
(such as musl) are less concerned with binary backwards compatibility
than glibc, and therefore have incompatibly changed their ABI on 32-bit
platforms to switch to 64-bit timestamps throughout; no action is needed
on those platforms. If other non-GNU OS libraries have taken a route
similar to GNU's, then maintainers of those operating systems are
welcome to send tested merge requests similar to this one.
An extra subtlety here is that _TIME_BITS=64 requires
_FILE_OFFSET_BITS=64. In the Meson build, Meson unconditionally enables
_FILE_OFFSET_BITS=64 where appropriate, and in the Autotools build,
we already had that via AC_SYS_LARGEFILE, but in the CMake build we
did not necessarily have this; so we also define _FILE_OFFSET_BITS=64
there if necessary, as a continuation of commit 96ffc2a0
"configure.ac: support large-file for stat64".
On newer 32-bit architectures like x32, time_t is always 64-bit and so
this has no practical effect.
On 64-bit, setting these would have no practical effect, but to minimize
risk I'm only doing this for 32-bit architectures.
Resolves: https://gitlab.freedesktop.org/dbus/dbus/-/issues/465 Signed-off-by: Simon McVittie <smcv@collabora.com>
Luca Boccassi [Mon, 20 Mar 2023 02:00:51 +0000 (02:00 +0000)]
DBusCredentials: add support for PID FDs via SO_PEERPIDFD
The new socket option SO_PEERPIDFD allows to pin the process on the
other side of the socket by file descriptor, which closes a race
condition where a PID can be reused before we can pin it manually.
Available since Linux v6.5.
When storing credentials, pin the process by FD from the PID.
When querying the PID, if the PID FD is available, resolve
it from there first if possible.
Ensure the DBusCredentials object only returns the PID FD if it was
obtained by this call, so that we know for sure we can rely on it
being safe against PID reuse attacks.
Ralf Habacker [Mon, 7 Aug 2023 09:36:21 +0000 (11:36 +0200)]
tools/ci-build.sh: cleanup setup and usage of ci_builddir
The order and arrangement of the initialization of the build directories
has been improved: the deletion of special directories have been moved to
the associated part, the rest have been merged and there is a default
value if not specified as an environment variable, making it easier to
execute on the command line.
Ralf Habacker [Fri, 4 Aug 2023 09:56:12 +0000 (11:56 +0200)]
CI: add prefix 'ci_' to env var 'builddir'
This customization simplifies their use, e.g. when outputting the command
line used. Because of FreeBSD, 'awk' is used instead of 'gawk' to make
sure that the tool is available.
Luca Boccassi [Mon, 20 Mar 2023 01:48:06 +0000 (01:48 +0000)]
systemd: start as the D-Bus user/group, rather than root
When starting as root files in /proc/self/fdinfo/ will be owned as root
and set to 400, so we cannot read them. Nowadays it is not necessary to
start as root when running under systemd, so just add User/Group with
the configured user to the system unit.
If libaudit support is enabled, add AmbientCapabilities=CAP_AUDIT_WRITE
so that we can still write to the audit log.
Luca Boccassi [Mon, 20 Mar 2023 01:50:53 +0000 (01:50 +0000)]
spec: add ProcessFD to GetConnectionCredentials()
Make D-Bus implementations return a file descriptor
pinning the process as part of the credentials on
platforms that implement such concept, like Linux.
Pinning the process allows to defend against PID
reuse attacks, making authentication by
service/cgroup possible.
Xin Shi [Fri, 28 Jul 2023 01:38:24 +0000 (09:38 +0800)]
dbus-daemon: Avoid known options being interpreted as optional arguments
The man page and --help imply that
dbus-daemon --print-address --print-pid
is a valid/useful thing to do, but because --print-address takes an
optional argument, it is ambiguous whether --print-pid is meant to
be the argument for --print-address (same as --print-address=--print-pid)
or a new option (same as --print-address=1 --print-pid). In fact,
before this commit, the dbus-daemon would interpret --print-pid as
the optional argument to --print-address, and then fail to parse it
because it isn't an integer.
Because none of our options are syntactically valid as arguments for
any option that takes an optional argument, we can avoid the ambiguity
by delaying parsing of optional arguments until all known options
have been tried.
dbus-sysdeps-unix: Handle empty supplementary group list
It is valid for getsockopt(SO_PEERGROUPS) to return len=0; that
indicates the process has no supplementary groups. Rather than failing,
simply use the returned empty list (and add the primary GID to it).
Without this change, calling GetConnectionCredentials on a bus name
owned by a process with no supplementary groups does not return the
UnixGroupIDs field, even though it is easy to determine that the process
only has one GID (the primary GID).
Barnabás Pőcze [Tue, 13 Jun 2023 16:12:26 +0000 (18:12 +0200)]
meson: Override "dbus-1" dependency name
Since meson 0.54.0, it is possible to override a dependency name,
so do that to make it easy to use dbus as a subproject. After this
change, simply
dependency('dbus-1')
will fall back to the subproject automatically and there is no need
for using `fallback` keyword argument. Of course this assumes that
the dbus source tree is at subprojects/dbus-1 and not subprojects/dbus
but it is easy to achieve that.
If the dbus source tree for some reason needs to be at subprojects/dbus,
dependency('dbus-1', fallback: 'dbus')
may be used, which still has the advantage of not needing to
depend on the variable names in the dbus build definitions.
Simon McVittie [Tue, 13 Jun 2023 12:59:21 +0000 (13:59 +0100)]
CI: Enable "debian mingw64 meson debug" by default
This gives us coverage for Meson mingw-w64 by default, but
cross-compiling from Debian with MSVCRT rather than a native compilation
on Windows with UCRT. When combined with "windows msys64 ucrt64 cmake",
this fills in most of the missing coverage caused by disabling
windows-meson-mingw-ucrt64 to work around dbus#462.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Ralf Habacker [Mon, 12 Jun 2023 17:55:05 +0000 (19:55 +0200)]
CI: Fix problem with configuration when cross building with cmake
Due to an adaptation of an rpm macro for cross-compiling with cmake, there
was a problem with the previous method of using the current directory as
the build directory. Instead, the command line options provided by cmake
are now used to define the source and build directories, which provide more
stable behavior.
Simon McVittie [Tue, 6 Jun 2023 12:07:04 +0000 (13:07 +0100)]
meson: Disable some warnings when asserts/checks are disabled
Some labels are only used when checks are enabled, and some variables
are only used when assertions and/or checks are enabled. Instead of
cluttering the code with extra #ifdefs, we silence those warnings:
they're harmless in this case. We already do this in Autotools.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Tue, 6 Jun 2023 12:05:41 +0000 (13:05 +0100)]
sysdeps: Correct fallback signature of Linux close_range()
Linux generally declares syscalls with flags as type int. It's the same
ABI, but a slightly different API, and it seems better for our fallback
definition to match it exactly.
Related to dbus/dbus#453.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Mon, 5 Jun 2023 17:51:22 +0000 (18:51 +0100)]
monitor test: Reproduce dbus/dbus#457
The exact failure mode reported in dbus/dbus#457 is quite difficult
to achieve in a reliable way in a unit test, because we'd have to send
enough messages to a client to fill up its queue, then stop that client
from draining its queue, while still triggering a message that gets a
reply from the bus driver. However, we can trigger the same crash in a
slightly different way by not allowing the client to receive a
particular message. I chose NameAcquired.
Signed-off-by: Simon McVittie <smcv@collabora.com>
hongjinghao [Mon, 5 Jun 2023 17:17:06 +0000 (18:17 +0100)]
bus: Assign a serial number for messages from the driver
Normally, it's enough to rely on a message being given a serial number
by the DBusConnection just before it is actually sent. However, in the
rare case where the policy blocks the driver from sending a message
(due to a deny rule or the outgoing message quota being full), we need
to get a valid serial number sooner, so that we can copy it into the
DBUS_HEADER_FIELD_REPLY_SERIAL field (which is mandatory) in the error
message sent to monitors. Otherwise, the dbus-daemon will crash with
an assertion failure if at least one Monitoring client is attached,
because zero is not a valid serial number to copy.
This fixes a denial-of-service vulnerability: if a privileged user is
monitoring the well-known system bus using a Monitoring client like
dbus-monitor or `busctl monitor`, then an unprivileged user can cause
denial-of-service by triggering this crash. A mitigation for this
vulnerability is to avoid attaching Monitoring clients to the system
bus when they are not needed. If there are no Monitoring clients, then
the vulnerable code is not reached.
Co-authored-by: Simon McVittie <smcv@collabora.com>
Resolves: dbus/dbus#457
Simon McVittie [Tue, 6 Jun 2023 09:41:35 +0000 (10:41 +0100)]
README: Mention not opening merge requests for security issues
The dbus maintainers can open confidential merge requests by using a
private git repository, but other contributors (including most security
researchers) cannot, so the safest simple recommendation is no merge
requests.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Luca Boccassi [Mon, 20 Mar 2023 01:40:20 +0000 (01:40 +0000)]
Support /proc in _dbus_file_get_content
procfs has special semantics: most files are 0 size,
only one read can be done on a file, and they are
not larger than 4MB. Enhance _dbus_file_get_content()
so that we can read files from /proc with it.
Barnabás Pőcze [Thu, 4 May 2023 14:37:57 +0000 (16:37 +0200)]
dbus-spawn-win: use `_DBUS_FUNCTION_NAME` instead of `__FUNCTION__`
dbus-internals.h already defines a macro which expands to the name
of the current function based on C standard version, etc. So use
that instead of hard-coding `__FUNCTION__`.
Barnabás Pőcze [Thu, 4 May 2023 14:26:31 +0000 (16:26 +0200)]
dbus-internals: use `_DBUS_FUNCTION_NAME` in `_dbus_verbose()`
dbus-internals.h already defines a macro which expands to the name
of the current function based on C standard version, etc. So use
that instead of hard-coding `__FUNCTION__`.
Simon McVittie [Fri, 12 May 2023 17:35:13 +0000 (18:35 +0100)]
CI: Disable native Windows builds for now
These are extremely slow (the image build is currently at 36 minutes
and still running) which is standing in the way of us having functional
CI at all. They can be re-enabled if someone will maintain them.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Fri, 12 May 2023 14:31:58 +0000 (15:31 +0100)]
CI: Disable OOM-testing code paths for Meson, matching Autotools and CMake
Repeatedly re-running each test with different malloc() calls failing
is really slow, and in particular this is making
dbus:dbus / marshal-recursive time out on freedesktop.org CI.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Fri, 12 May 2023 14:23:27 +0000 (15:23 +0100)]
CI: Only run for pushes to dbus
In practice the pipeline is going to fail for namespaces other than
dbus, so don't waste time on trying to run it there; only run the
detached pipeline for the MR.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Simon McVittie [Fri, 12 May 2023 14:00:34 +0000 (15:00 +0100)]
CI: Run a detached pipeline for merge requests
After abuses of fdo infrastructure were mitigated in
freedesktop/freedesktop#540, contributors cannot usually run pipelines
in their own forks of dbus.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Ralf Habacker [Thu, 19 Jan 2023 15:17:43 +0000 (16:17 +0100)]
_dbus_string_skip_blank(): Let the final assert follow the previous search
This appears to have been a copy/paste mistake. If only blanks (defined as
spaces or tabs) were removed, then it cannot be right to check for white
space (defined as spaces, tabs, carriage return or linefeed) afterwards.
If libdbus was compiled with assertions enabled, then this is a
denial-of-service issue for dbus-daemon or other users of DBusServer:
an unauthenticated user with access to the server's socket can send
whitespace that triggers this assertion failure. We recommend that
production versions of dbus, for example in OS distributions, should be
compiled with checks but without assertions.
Simon McVittie [Mon, 6 Feb 2023 13:24:11 +0000 (13:24 +0000)]
CI: Re-run some tests as root or as non-root, as appropriate
On Gitlab-CI we're always running the overall script as root (and
therefore we'll only enter the code path to re-run as non-root),
but when using these scripts for manual testing they might be run as
non-root to begin with.
Signed-off-by: Simon McVittie <smcv@collabora.com>
projects / thirdparty / dbus.git / log
