Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 5 product line. The current stable release is 5.10. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 489884

Summary:	dbus-glib: reply sent even for no_reply messages [rhel-5.3.z]
Product:	Red Hat Enterprise Linux 5	Reporter:	Tomas Hoger <thoger>
Component:	dbus-glib	Assignee:	David Zeuthen <davidz>
Status:	CLOSED WONTFIX	QA Contact:	desktop-bugs <desktop-bugs>
Severity:	medium	Docs Contact:
Priority:	low
Version:	5.3	CC:	bressers, mclasen, plyons, walters
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	489886 (view as bug list)		Environment:
Last Closed:	2010-11-15 12:51:37 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	469151

Description Tomas Hoger 2009-03-12 13:37:07 UTC

With introduction of patch for CVE-2008-4311, dbus will log message denials by default.  Introduction of such functionality upstream uncovered a bug in dbus-glib bindings, that result in reply message being sent even if sender explicitly requested no reply.  Such not requested reply is rejected by the strict system dbus policy, resulting in denial being logged.

Related upstream bug reports:
https://bugs.freedesktop.org/show_bug.cgi?id=19441
http://bugzilla.gnome.org/show_bug.cgi?id=565008

Upstream patch:
http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=d92a44109e3fdc766e34b53f7ec5329e98e13909

We do want to avoid those unneeded rejects being logged, so this fix should be included in errata introducing a fix for CVE-2008-4311 in dbus packages.

Comment 2 Josh Bressers 2009-09-22 19:13:03 UTC

As CVE-2008-4311 has been deferred, this bug obviously follows suit. If
CVE-2008-4311 is fixed in a future update, this bug will be addressed there.

Comment 3 David Zeuthen 2010-10-18 17:19:39 UTC

Hi. As I've said here:

 https://bugs.freedesktop.org/show_bug.cgi?id=19441#c9

I think the upstream bug-fix is wrong.

In other words: this is definitely not a problem with the dbus-glib bindings - it's a problem with the bus daemon being too strict. So I think we should fix the bus to not be so strict... because otherwise we end up "fixing" lots of other bindings than just dbus-glib. Colin, what do you think?