[Bug 1229280] [NEW] Eavesdroppers confined with AppArmor can see all method_return and error messages

[Launchpad Bug Tracker]

You have been subscribed to a public bug by Ubuntu Foundations Team Bug Bot (crichton):

The AppArmor mediation code in dbus-daemon contains short circuits that
allow method_return and error messages to pass through without being
mediated. The thought is that the original message was allowed, so the
reply should be allowed. However, D-Bus allows eavesdropping and the
short circuits allow the eavesdropper to receive any method_return and
error messages, even if the eavesdropper was not allowed to receive the
original message.

$ echo "profile eve { file, dbus interface=org.freedesktop.DBus member={Hello,AddMatch}, }" | sudo apparmor_parser -qr
$ aa-exec -p eve -- dbus-monitor --session
...
method return sender=:1.15 -> dest=:1.51 reply_serial=27845
   string "/org/ayatana/bamf/window/83886084"
method return sender=:1.15 -> dest=:1.51 reply_serial=27846
   string "/org/ayatana/bamf/window/83886084"

** Affects: dbus (Ubuntu)
     Importance: High
     Assignee: Tyler Hicks (tyhicks)
         Status: In Progress


** Tags: application-confinement patch
-- 
Eavesdroppers confined with AppArmor can see all method_return and error messages
https://bugs.launchpad.net/bugs/1229280
You received this bug notification because you are a member of Ubuntu Sponsors Team, which is subscribed to the bug report.