Bug 1217185 - AUDIT-WHITELIST: plasma6-disks: new revision of D-Bus interface org.kde.kded.smart.service
Summary: AUDIT-WHITELIST: plasma6-disks: new revision of D-Bus interface org.kde.kded....
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Matthias Gerstner
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 1217076
  Show dependency tree / graph
 
Reported: 2023-11-15 13:06 UTC by Matthias Gerstner
Modified: 2024-02-21 14:46 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2023-11-15 13:06:41 UTC 
+++ This bug was initially created as a clone of Bug #1217076

Sub bug for a bunch of new D-Bus interfaces in KDE6.

Package is found in KDE:Unstable:Frameworks/plasma6-disks.

plasma6-disks.x86_64: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system.d/org.kde.kded.smart.conf
plasma6-disks.x86_64: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system-services/org.kde.kded.smart.service
Comment 1 Matthias Gerstner 2023-11-22 12:34:43 UTC 
I will also look into this KDE6 component since it is rather small and I need
something that integrates kauth to look into to complete bug 1217178 for the
kauth framework review.
Comment 2 Matthias Gerstner 2023-11-23 15:28:32 UTC 
This kauth helper only implements a single action for invoking smartctl on
block devices. We managed to get this code into shape already during the
initial review in bug 1176742.

Not too much has changed since, mostly a bit of FreeBSD compatibility. The
degrees of freedom of the interfaces are very limited now, only the basename
of the block device in /dev is specified. The code blocks any slashes / found
in the input string, then performs an lstat() on the device in /dev and checks
that it is actually a block device that is owned by root.

There's not much else one can do to tighten this.

The upstream Git commit I looked into was
3ecee8bbc47ad1446f1f851a6f4929c67c0a7a3d.

I'm turning this into a WHITELISTING tracker and we will revisit once the KDE6
release is becoming more tangible to look into additional changes upstream may
do until then.
Comment 3 Matthias Gerstner 2024-02-13 14:50:26 UTC 
The package to be submitted is now found in KDE:Frameworks/plasma6-disks and
uses version v5.93.0.

The changes since the review are only noise so the whitelisting can now
happen.
Comment 5 Matthias Gerstner 2024-02-21 14:46:41 UTC 
The whitelisting is in Factory now. Closing as fixed.