bus_driver_handle_message: reject ActivationFailure if unprivileged

Specifically, this will allow ActivationFailure messages from our
own uid or from root, but reject them otherwise, even if the bus
configuration for who can own org.freedesktop.systemd1 is entirely
wrong due to something like CVE-2014-8148.

Signed-off-by: Simon McVittie <smcv@debian.org>
Reviewed-by: Colin Walters <walters@verbum.org>
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=98157

diff --git a/bus/driver.c b/bus/driver.c
index 39157bd7b280e5fedaa1bab70841b778f096a680..24ac44f700da5f85683a102b376449ea44380cfe 100644 (file)
--- a/bus/driver.c
+++ b/bus/driver.c
@@ -2637,6 +2637,15 @@ bus_driver_handle_message (DBusConnection *connection,
       BusContext *context;
       DBusConnection *systemd;
 
+      /* This is a directed signal, not a method call, so the log message
+       * is a little weird (it talks about "calling" ActivationFailure),
+       * but it's close enough */
+      if (!bus_driver_check_caller_is_privileged (connection,
+                                                  transaction,
+                                                  message,
+                                                  error))
+        return FALSE;
+
       context = bus_connection_get_context (connection);
       systemd = bus_driver_get_owner_of_name (connection,
           "org.freedesktop.systemd1");