http://bugzilla.novell.com/show_bug.cgi?id=590981 http://bugzilla.novell.com/show_bug.cgi?id=590981#c0 Summary: Security review request for DBus system services in Moblin:UI Classification: openSUSE Product: openSUSE 11.3 Version: Factory Platform: All OS/Version: All Status: NEW Severity: Normal Priority: P5 - None Component: Moblin AssignedTo: awafaa@opensuse.org ReportedBy: pascal.bleser@opensuse.org QAContact: qa@suse.de Found By: --- Blocker: --- Created an attachment (id=350418) --> (http://bugzilla.novell.com/attachment.cgi?id=350418) /etc/dbus-1/system.d/org.moblin.ClockApplet.Mechanism.conf User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; de-DE; rv:1.9.2.0) Gecko/20100115 SUSE/3.6.0-1.2 Firefox/3.6 Moblin:UI/mutter-moblin (in OBS) contains two DBus configuration files that are getting installed as /etc/dbus-1/system.d/org.moblin.ClockApplet.Mechanism.conf and /usr/share/dbus-1/system-services/org.moblin.ClockApplet.Mechanism.service respectively. (both files are attached as of version 0.43.5_20091104) Note that this request has already been sent by email to security@suse.de and answered by Ludwig Nussel, and is merely entered here to be further tracked and commented. Ludwig has well-founded concerns about those services, as they would enable any user to invoke them (through DBus) to set the system time on the host the services are running on. Reproducible: Always Steps to Reproduce: n/a -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.