Bug 489884 - dbus-glib: reply sent even for no_reply messages [rhel-5.3.z]
Summary: dbus-glib: reply sent even for no_reply messages [rhel-5.3.z]
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: dbus-glib
Version: 5.3
Hardware: All
OS: Linux
low
medium
Target Milestone: rc
: ---
Assignee: David Zeuthen
QA Contact: desktop-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks: CVE-2008-4311
TreeView+ depends on / blocked
 
Reported: 2009-03-12 13:37 UTC by Tomas Hoger
Modified: 2013-03-06 03:58 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 489886 (view as bug list)
Environment:
Last Closed: 2010-11-15 12:51:37 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Tomas Hoger 2009-03-12 13:37:07 UTC
With introduction of patch for CVE-2008-4311, dbus will log message denials by default.  Introduction of such functionality upstream uncovered a bug in dbus-glib bindings, that result in reply message being sent even if sender explicitly requested no reply.  Such not requested reply is rejected by the strict system dbus policy, resulting in denial being logged.

Related upstream bug reports:
https://bugs.freedesktop.org/show_bug.cgi?id=19441
http://bugzilla.gnome.org/show_bug.cgi?id=565008

Upstream patch:
http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=d92a44109e3fdc766e34b53f7ec5329e98e13909

We do want to avoid those unneeded rejects being logged, so this fix should be included in errata introducing a fix for CVE-2008-4311 in dbus packages.

Comment 2 Josh Bressers 2009-09-22 19:13:03 UTC
As CVE-2008-4311 has been deferred, this bug obviously follows suit. If
CVE-2008-4311 is fixed in a future update, this bug will be addressed there.

Comment 3 David Zeuthen 2010-10-18 17:19:39 UTC
Hi. As I've said here:

 https://bugs.freedesktop.org/show_bug.cgi?id=19441#c9

I think the upstream bug-fix is wrong.

In other words: this is definitely not a problem with the dbus-glib bindings - it's a problem with the bus daemon being too strict. So I think we should fix the bus to not be so strict... because otherwise we end up "fixing" lots of other bindings than just dbus-glib. Colin, what do you think?


Note You need to log in before you can comment on or make changes to this bug.