Your message dated Thu, 02 Feb 2017 15:06:11 +0000
with message-id <[email protected]>
and subject line Bug#853951: fixed in iio-sensor-proxy 2.0-4
has caused the Debian Bug report #853951,
regarding iio-sensor-proxy: configures dbus-daemon to be insecure
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
853951: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=853951
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: iio-sensor-proxy
Version: 2.0-3
Severity: critical
Tags: security
Justification: potential root security hole
Sorry for the 0-day public report, but this is already known to the public
via #debian-devel and
<https://lintian.debian.org/tags/dbus-policy-excessively-broad.html>.
iio-sensor-proxy has this:
<!-- Anyone can talk to the main interface -->
<policy context="default">
<allow send_interface="net.hadess.SensorProxy"/>
<allow send_interface="org.freedesktop.DBus.Introspectable"/>
<allow send_interface="org.freedesktop.DBus.Properties"/>
<allow send_interface="org.freedesktop.DBus.Peer"/>
This does not do what it says in the comment. It allows every connection
to the system bus to send any message to the Properties interface on
any system bus service. If any system bus service has a property
that should only be set by root, everyone can now set it. This is Very Bad,
and I could easily imagine it causing a root security hole.
I'm assuming the intended policy was to put a
send_destination="net.hadess.SensorProxy" on everythng:
<!-- Only root can own the service -->
<policy user="root">
<allow own="net.hadess.SensorProxy"/>
</policy>
<!-- Only Geoclue can access the compass -->
<policy user="geoclue">
<allow send_destination="net.hadess.SensorProxy"
send_interface="net.hadess.SensorProxy.Compass"
send_path="/net/hadess/SensorProxy/Compass"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Introspectable"
send_path="/net/hadess/SensorProxy/Compass"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Properties"
send_path="/net/hadess/SensorProxy/Compass"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Peer"
send_path="/net/hadess/SensorProxy/Compass"/>
</policy>
<!-- Anyone can talk to the main interfaces -->
<policy context="default">
<allow send_destination="net.hadess.SensorProxy"
send_interface="net.hadess.SensorProxy"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Introspectable"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Properties"/>
<allow send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Peer"/>
<deny send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Introspectable"
send_path="/net/hadess/SensorProxy/Compass"/>
<deny send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Properties"
send_path="/net/hadess/SensorProxy/Compass"/>
<deny send_destination="net.hadess.SensorProxy"
send_interface="org.freedesktop.DBus.Peer"
send_path="/net/hadess/SensorProxy/Compass"/>
</policy>
Regards,
S
--- End Message ---
--- Begin Message ---
Source: iio-sensor-proxy
Source-Version: 2.0-4
We believe that the bug you reported is fixed in the latest version of
iio-sensor-proxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Ritesh Raj Sarraf <[email protected]> (supplier of updated iio-sensor-proxy
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 02 Feb 2017 19:08:47 +0530
Source: iio-sensor-proxy
Binary: iio-sensor-proxy
Architecture: source amd64
Version: 2.0-4
Distribution: unstable
Urgency: medium
Maintainer: Ritesh Raj Sarraf <[email protected]>
Changed-By: Ritesh Raj Sarraf <[email protected]>
Description:
iio-sensor-proxy - IIO sensors to D-Bus proxy
Closes: 853951
Changes:
iio-sensor-proxy (2.0-4) unstable; urgency=medium
.
* [ea2615f] Restrict D-Bus policy rules only to affect SensorProxy.
Thanks to Simon McVittie (Closes: #853951)
Checksums-Sha1:
df3eec9c8a4f5adb65047cbf4ff0c1ae27dd5209 2036 iio-sensor-proxy_2.0-4.dsc
74f326b5f4407859c71b8231e45e974fa76cf26f 4808
iio-sensor-proxy_2.0-4.debian.tar.xz
293876e45a40a0dc4e683dde84059dbf4ba3ae94 75164
iio-sensor-proxy-dbgsym_2.0-4_amd64.deb
a1bd1c16cfedfc910c22036ee66a1099c564dcda 12582
iio-sensor-proxy_2.0-4_amd64.buildinfo
2bd45dbaf6362a25d03c1638e525ba12804cfafe 25342 iio-sensor-proxy_2.0-4_amd64.deb
Checksums-Sha256:
4a36484ef4e019d767775efc700de078b1eea997ae75910fc27ab6511a6aaeec 2036
iio-sensor-proxy_2.0-4.dsc
ad1cf0326db056087d198305ce37759a0ad2d334473e3ba868e158ca09777763 4808
iio-sensor-proxy_2.0-4.debian.tar.xz
9a02929d41bbee1e55f17e96e6c0490d22988bcdd910658ae831355a0b039773 75164
iio-sensor-proxy-dbgsym_2.0-4_amd64.deb
a1fc62372d2f734844bafc7d512e1e836f29698cbacd868e0f0343a6e3654705 12582
iio-sensor-proxy_2.0-4_amd64.buildinfo
7d19411a24ff9a2bb3f2e0166a5952afac1747ea77bb7fb0575628c55d09e4e9 25342
iio-sensor-proxy_2.0-4_amd64.deb
Files:
4c552f24147e3bf767bf105d0541b07f 2036 utils optional iio-sensor-proxy_2.0-4.dsc
621dd0e58873a83169442d92cf49b07b 4808 utils optional
iio-sensor-proxy_2.0-4.debian.tar.xz
5bfc07eb0a9515cab3215eabc260fd46 75164 debug extra
iio-sensor-proxy-dbgsym_2.0-4_amd64.deb
7ae1b8c8ee45a4891a82320212ae4677 12582 utils optional
iio-sensor-proxy_2.0-4_amd64.buildinfo
1ed2e1cd3a30f9aa25da515682b23e9b 25342 utils optional
iio-sensor-proxy_2.0-4_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEQCVDstmIVAB/Yn02pjpYo/LhdWkFAliTOXUACgkQpjpYo/Lh
dWn5oA/+PRXYCbYROySg5pbUBoTlPW4z1pbi4ujhwyf/fCJqiMnbLWdy1nmuunwv
Q+6ZKjbugaDJ8KEQIDNu/DqNwuEZZR06yEc9f0Mz6w9N0eCuY9QtCe8Cx2nEqeMp
7OHJoerBbeA/nTpZ7yfwCXZHj4ZT5Mr0JrcgFoY8lWh3A3jBsUHgFMPvyc0PR/U+
YW+pR0+CFUrUzficwg5mw/zqEq5nb8QxR2rM5tuwL1zGSJy8Li43+Q2k5SEK6H77
LIUbHh7CYVpL0tn6nB5sV0R3B4qyIQr59KFXEwSJrJzFlgTY1loL+chTgsajGJGt
e7QWSgYWHFpG8vyVsppg+0NJQDFNUHNBrZuNGiGY461sN5neViQsvXOZ5dXor5oS
uz+T/ccIGZto3tR5aHi6VZSvSnugVkGlbBGTSNxq8KHm2JD+MVurW9A1PzD2YOO/
iOSm/Em8IcRz7NMNouDMp82RoMNG5i1UcJCDgsckO4pI5MgFfMzhMjK1QfnOG0Ht
x0YotA3PDWWV1cbWZlNDSLJ2pwACeJe6cptFZtcKYf6ZiQB93/PcrshmId53uSz8
BLhJmJx+SqxPx1LtuiMp4sCwWKHpRWEYZFiSWkjFTY+xBshdFf3sxMavp2lZZvzL
4f1C7clO1zS+KOsGDDEyt61D0cDc/ODG1sVcJCLHCDwsstog01o=
=pNkB
-----END PGP SIGNATURE-----
--- End Message ---
