diff options
| author | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2015-05-12 11:10:58 +0100 |
|---|---|---|
| committer | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2015-05-14 14:30:30 +0100 |
| commit | 084977cfe2cc232bc8b25fd7088a5a4f1a6a65d5 (patch) | |
| tree | 840e7903e754172ac8f2cdc2b4162a2cadd2817f /bus/session.conf.in | |
| parent | 954371eea2340d83ae28e4cc8a629e43811dc771 (diff) | |
Security hardening: force EXTERNAL auth in session.conf on Unix
DBUS_COOKIE_SHA1 is dependent on unguessable strings, i.e.
indirectly dependent on high-quality pseudo-random numbers
whereas EXTERNAL authentication (credentials-passing)
is mediated by the kernel and cannot be faked.
On Windows, EXTERNAL authentication is not available,
so we continue to use the hard-coded default (all
authentication mechanisms are tried).
Users of tcp: or nonce-tcp: on Unix will have to comment
this out, but they would have had to use a special
configuration anyway (to set the listening address),
and the tcp: and nonce-tcp: transports are inherently
insecure unless special steps are taken to have them
restricted to a VPN or SSH tunnelling.
Users of obscure Unix platforms (those that trigger
the warning "Socket credentials not supported on this Unix OS"
when compiling dbus-sysdeps-unix.c) might also have to
comment this out, or preferably provide a tested patch
to enable credentials-passing on that OS.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=90414
Reviewed-by: Ralf Habacker <ralf.habacker@freenet.de>
Diffstat (limited to 'bus/session.conf.in')
| -rw-r--r-- | bus/session.conf.in | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/bus/session.conf.in b/bus/session.conf.in index cfe9544fb..e78c1d33c 100644 --- a/bus/session.conf.in +++ b/bus/session.conf.in @@ -14,6 +14,16 @@ <listen>@DBUS_SESSION_BUS_LISTEN_ADDRESS@</listen> + <!-- On Unix systems, the most secure authentication mechanism is + EXTERNAL, which uses credential-passing over Unix sockets. + + This authentication mechanism is not available on Windows, + is not suitable for use with the tcp: or nonce-tcp: transports, + and will not work on obscure flavours of Unix that do not have + a supported credentials-passing mechanism. On those platforms/transports, + comment out the <auth> element to allow fallback to DBUS_COOKIE_SHA1. --> + @DBUS_SESSION_CONF_MAYBE_AUTH_EXTERNAL@ + <standard_session_servicedirs /> <policy context="default"> |