|
Bugzilla – Full Text Bug Listing |
| Summary: | AUDIT-WHITELIST: thermald: review of D-Bus file /usr/share/dbus-1/system.d/org.freedesktop.thermald.conf | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Tumbleweed | Reporter: | Thomas Renninger <trenn> |
| Component: | Security | Assignee: | Matthias Gerstner <matthias.gerstner> |
| Status: | RESOLVED FIXED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P5 - None | CC: | aschnell, jcheung, matthias.gerstner, trenn, wolfgang.frisch |
| Version: | Current | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
|
Description
Thomas Renninger
2023-10-02 12:49:43 UTC
Thanks for the review bug. We will schedule the review and report back. The reason for the badness is that the D-Bus service file has been moved from /etc/dbus-1 to /usr/share/dbus-1. Generally it would be a formal change to the whitelisting only. The last review has been quite a while ago, though, so we should at least look a bit closer at the current D-Bus implementation if anything problematic is around these days. The thermald D-Bus interface is only accessible to root and to members of the "power" group. By default there are no members of the power group. In the original audit bug is has been pointed out that it is important that this stays this way, because some of the API endpoints are not suitable for access by everybody. The new whitelisting will be coupled to the D-Bus configuration content, so if it changes we will notice, thus the danger that something worseness here without us noticing is reduced. The whitelisting process has been started. Factory: https://build.opensuse.org/request/show/1116656 ALP: https://build.suse.de/request/show/309945 This is an autogenerated message for OBS integration: This bug (1215873) was mentioned in https://build.opensuse.org/request/show/1117522 Factory / thermald The whitelisting is now in Factory and should be effective. Closing as FIXED. Can this change/whitelist also be applied for SLE 15 SP6, please: https://jira.suse.com/browse/PED-5716 Be aware that thermald does not exist there as a package yet. The submitrequest to get this in is here: https://build.suse.de/request/show/312532 Thanks! (In reply to trenn@suse.com from comment #8) > Can this change/whitelist also be applied for SLE 15 SP6, please: > https://jira.suse.com/browse/PED-5716 Actually, since the basename of the D-Bus configuration files didn't change, there shouldn't be a new whitelisting necessary for SLE-15. The rpmlint in SLE-15 does not check full paths. I couldn't find any rpmlint badness in your SLE-15-SP6 package build, can you confirm, please? Can you please give an update regarding comment 9? Thanks! No reply received to my question. As I see it no whitelisting backport is necessary for this. Closing again as fixed. |