luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2025-03-29 11:00:02 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '2316-dbus-session-hardening-again' into 'main'

Browse Source 
Revert "gdbus: Use DBUS_SESSION_BUS_ADDRESS if AT_SECURE but not setuid"

Closes #2316

See merge request GNOME/glib!2212
This commit is contained in:
Philip Withnall 2021-08-19 09:37:26 +00:00
commit e31aa76045
1 changed files with 2 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
gio/gdbusaddress.c
View File

@ -1343,31 +1343,9 @@ g_dbus_address_get_for_bus_sync (GBusType bus_type,
case G_BUS_TYPE_SESSION:
if (has_elevated_privileges)
{
#ifdef G_OS_UNIX
if (geteuid () == getuid ())
{
/* Ideally we shouldn't do this, because setgid and
* filesystem capabilities are also elevated privileges
* with which we should not be trusting environment variables
* from the caller. Unfortunately, there are programs with
* elevated privileges that rely on the session bus being
* available. We already prevent the really dangerous
* transports like autolaunch: and unixexec: when our
* privileges are elevated, so this can only make us connect
* to the wrong AF_UNIX or TCP socket. */
ret = g_strdup (g_getenv ("DBUS_SESSION_BUS_ADDRESS"));
}
else
#endif
{
ret = NULL;
}
}
ret = NULL;
else
{
ret = g_strdup (g_getenv ("DBUS_SESSION_BUS_ADDRESS"));
}
ret = g_strdup (g_getenv ("DBUS_SESSION_BUS_ADDRESS"));
if (ret == NULL)
{