Bugzilla – Bug 1215873
AUDIT-WHITELIST: thermald: review of D-Bus file /usr/share/dbus-1/system.d/org.freedesktop.thermald.conf
Last modified: 2024-02-19 14:57:20 UTC
Latest thermald package seem to have dbus API modifications which need review by the security team. The package is intended to be submitted to SLE 15 SP6/ALP afterwards. You may want to keep this in mind when looking at this: [SUSE-JIRA] (PED-5716) Impl: Enable support for Thermal Controls on platform https://jira.suse.com/browse/PED-5716 The submit request for factory showing the dbus security review need is here: https://build.opensuse.org/request/show/1113687#comment-1827588 Thanks in advance.
Thanks for the review bug. We will schedule the review and report back.
The reason for the badness is that the D-Bus service file has been moved from /etc/dbus-1 to /usr/share/dbus-1. Generally it would be a formal change to the whitelisting only. The last review has been quite a while ago, though, so we should at least look a bit closer at the current D-Bus implementation if anything problematic is around these days.
The thermald D-Bus interface is only accessible to root and to members of the "power" group. By default there are no members of the power group. In the original audit bug is has been pointed out that it is important that this stays this way, because some of the API endpoints are not suitable for access by everybody. The new whitelisting will be coupled to the D-Bus configuration content, so if it changes we will notice, thus the danger that something worseness here without us noticing is reduced.
The whitelisting process has been started.
Factory: https://build.opensuse.org/request/show/1116656 ALP: https://build.suse.de/request/show/309945
This is an autogenerated message for OBS integration: This bug (1215873) was mentioned in https://build.opensuse.org/request/show/1117522 Factory / thermald
The whitelisting is now in Factory and should be effective. Closing as FIXED.
Can this change/whitelist also be applied for SLE 15 SP6, please: https://jira.suse.com/browse/PED-5716 Be aware that thermald does not exist there as a package yet. The submitrequest to get this in is here: https://build.suse.de/request/show/312532 Thanks!
(In reply to trenn@suse.com from comment #8) > Can this change/whitelist also be applied for SLE 15 SP6, please: > https://jira.suse.com/browse/PED-5716 Actually, since the basename of the D-Bus configuration files didn't change, there shouldn't be a new whitelisting necessary for SLE-15. The rpmlint in SLE-15 does not check full paths. I couldn't find any rpmlint badness in your SLE-15-SP6 package build, can you confirm, please?
Can you please give an update regarding comment 9? Thanks!
No reply received to my question. As I see it no whitelisting backport is necessary for this. Closing again as fixed.