From: Jussi Kukkonen <jussi.kukkonen@intel.com>
To: openembedded-core@lists.openembedded.org,
joshua.lock@collabora.co.uk, akuster808@gmail.com
Subject: [PATCH 0/3][fido][dizzy] D-Bus policy fixes
Date: Wed, 30 Sep 2015 18:33:54 +0300 [thread overview]
Message-ID: <cover.1443624731.git.jussi.kukkonen@intel.com> (raw)
The major patch in the series is the bluez one: Bluez
D-Bus policy was incorrectly written so it actually allowed
access to system services _other than bluetoothd_ overriding
the default deny policy on the system bus. Fixing this may
naturally affect other system services too.
The patches I'm sending are for master but I believe both fido and
dizzy behave similarly. I can send a patch for those as well but
am not sure what to include there: I'm guessing people now have
services running that are expecting an open-by-default system bus --
closing it now will require good release notes at the very least.
So RFC on fido and dizzy: The best I can think of is taking the bluez
patch, patching in an xuser allow policy for bluez, and making the
(practical) policy change very clear in the release notes.
- Jussi
The following changes since commit 4bc3f0994e68b3302a0523a3156dd0dca0cac7a0:
bitbake: toaster: move clones into subdirectory (2015-09-29 14:11:39 +0100)
are available in the git repository at:
git://git.yoctoproject.org/poky-contrib jku/dbus-policy
http://git.yoctoproject.org/cgit.cgi/poky-contrib/log/?h=jku/dbus-policy
Jussi Kukkonen (3):
bluez5: Use upstream D-Bus policy
dbus: Use the xuser policy file
xuser-account: Take over xuser specific D-Bus policy
meta/recipes-connectivity/bluez5/bluez5.inc | 5 +--
.../bluez5/bluez5/bluetooth.conf | 17 ---------
meta/recipes-connectivity/connman/connman.inc | 1 -
.../connman/add_xuser_dbus_permission.patch | 43 ----------------------
meta/recipes-connectivity/connman/connman_1.30.bb | 1 -
meta/recipes-core/dbus/dbus.inc | 1 +
...-Apply-xuser-specific-policies-if-present.patch | 33 +++++++++++++++++
.../user-creation/files/system-xuser.conf | 15 ++++++++
.../user-creation/xuser-account_0.1.bb | 6 ++-
9 files changed, 55 insertions(+), 67 deletions(-)
delete mode 100644 meta/recipes-connectivity/bluez5/bluez5/bluetooth.conf
delete mode 100644 meta/recipes-connectivity/connman/connman/add_xuser_dbus_permission.patch
create mode 100644 meta/recipes-core/dbus/dbus/0001-Apply-xuser-specific-policies-if-present.patch
create mode 100644 meta/recipes-support/user-creation/files/system-xuser.conf
--
2.1.4
next reply other threads:[~2015-09-30 15:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-30 15:33 Jussi Kukkonen [this message]
2015-09-30 15:37 ` [PATCH 1/3] bluez5: Use upstream D-Bus policy Jussi Kukkonen
2015-09-30 15:37 ` [PATCH 2/3] dbus: Use the xuser policy file Jussi Kukkonen
2015-09-30 15:37 ` [PATCH 3/3] xuser-account: Take over xuser specific D-Bus policy Jussi Kukkonen
2015-10-01 7:15 ` [PATCH 0/3][fido][dizzy] D-Bus policy fixes Jussi Kukkonen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1443624731.git.jussi.kukkonen@intel.com \
--to=jussi.kukkonen@intel.com \
--cc=akuster808@gmail.com \
--cc=joshua.lock@collabora.co.uk \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox