https://bugzilla.novell.com/show_bug.cgi?id=428963
User mmeeks@novell.com added comment
https://bugzilla.novell.com/show_bug.cgi?id=428963#c64
--- Comment #64 from Michael Meeks
Re. dangerous: I don't see how exactly this would happen.
nor me.
So wouldn't that mean that you can already hijack anyone's session bus? That doesn't stand to reason in my mind. I'm fairly certain a user's session bus is supposed to be secure from other users on the host :)
No. Because knowing DBUS_SESSION_BUS_ADDRESS isn't enough. The session policy forbids another user to connect to it -- and that is, what has been loosen with your patch.
Well - unless I'm mistaken we didn't commit the (frankly silly) <allow user="*" /> but we added the <allow user="root"/> - at least I hope we did. The latter allows *only* something that could easily happen anyway, and is inside the privilege envelope of the root account anyway. ie. if Root -really- wants to connect to a user's session bus, our advisory security can only stop him so far: he can just gdb to the session bus, tweak the setting & try again if necessary. ie. AFAICS <allow user="root"/> adds -no- new security hole - beyond this: that applications running as root -might- get a malformed D-BUS message from the session-bus (ie. the user), and -might- then do something bad. Since the user clearly knows the root password anyway - this is something we have to just live with. So - again; where is the security problem ? I really, really don't see it. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.