From: Laurent Bigonville Date: Mon, 15 Jun 2015 13:30:16 +0000 (+0200) Subject: Initialize audit subsystem even for the session bus X-Git-Tag: dbus-1.9.20~3 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=517c4685;p=thirdparty%2Fdbus.git Initialize audit subsystem even for the session bus If SELinux is enabled on the system, dbus will check the permissions but no audit trails will be generated in case of denial as the audit subsystem is not initialized. Same should apply for apparmor. [smcv: without audit, the equivalent of the audit trail goes to stderr where it can be picked up by systemd-journald] A unprivileged user should be able to open the audit socket (audit_open()) but should not have the permissions to log an audit trail. The CAP_AUDIT_WRITE file capability could be set on the dbus-daemon executable in order to allow the session bus to log an AVC denial. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=83856 [smcv: s/should/could/ in commit message to reflect lack of consensus that "setcap cap_audit_write+ep dbus-daemon" is desirable in general] Reviewed-by: Simon McVittie --- diff --git a/bus/bus.c b/bus/bus.c index 056f677f2..128ae3c28 100644 --- a/bus/bus.c +++ b/bus/bus.c @@ -972,10 +972,10 @@ bus_context_new (const DBusString *config_file, _DBUS_ASSERT_ERROR_IS_SET (error); goto failed; } - - bus_audit_init (context); } + bus_audit_init (context); + dbus_server_free_data_slot (&server_data_slot); return context;