Bug 489884 - dbus-glib: reply sent even for no_reply messages [rhel-5.3.z]
dbus-glib: reply sent even for no_reply messages [rhel-5.3.z]
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: dbus-glib (Show other bugs)
5.3
All Linux
low Severity medium
: rc
: ---
Assigned To: David Zeuthen
desktop-bugs@redhat.com
:
Depends On:
Blocks: CVE-2008-4311
  Show dependency treegraph
 
Reported: 2009-03-12 09:37 EDT by Tomas Hoger
Modified: 2013-03-05 22:58 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 489886 (view as bug list)
Environment:
Last Closed: 2010-11-15 07:51:37 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2009-03-12 09:37:07 EDT
With introduction of patch for CVE-2008-4311, dbus will log message denials by default.  Introduction of such functionality upstream uncovered a bug in dbus-glib bindings, that result in reply message being sent even if sender explicitly requested no reply.  Such not requested reply is rejected by the strict system dbus policy, resulting in denial being logged.

Related upstream bug reports:
https://bugs.freedesktop.org/show_bug.cgi?id=19441
http://bugzilla.gnome.org/show_bug.cgi?id=565008

Upstream patch:
http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=d92a44109e3fdc766e34b53f7ec5329e98e13909

We do want to avoid those unneeded rejects being logged, so this fix should be included in errata introducing a fix for CVE-2008-4311 in dbus packages.
Comment 2 Josh Bressers 2009-09-22 15:13:03 EDT
As CVE-2008-4311 has been deferred, this bug obviously follows suit. If
CVE-2008-4311 is fixed in a future update, this bug will be addressed there.
Comment 3 David Zeuthen 2010-10-18 13:19:39 EDT
Hi. As I've said here:

 https://bugs.freedesktop.org/show_bug.cgi?id=19441#c9

I think the upstream bug-fix is wrong.

In other words: this is definitely not a problem with the dbus-glib bindings - it's a problem with the bus daemon being too strict. So I think we should fix the bus to not be so strict... because otherwise we end up "fixing" lots of other bindings than just dbus-glib. Colin, what do you think?

Note You need to log in before you can comment on or make changes to this bug.