Bug 1217190 - AUDIT-WHITELIST: kwalletmanager: changes to D-Bus service?
Summary: AUDIT-WHITELIST: kwalletmanager: changes to D-Bus service?
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Audits (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 1217076
  Show dependency treegraph
 
Reported: 2023-11-15 13:16 UTC by Matthias Gerstner
Modified: 2024-02-16 11:40 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Gerstner 2023-11-15 13:16:33 UTC
+++ This bug was initially created as a clone of Bug #1217076

Sub bug for a bunch of new D-Bus services in KDE6.

Package is found in KDE:Unstable:Applications/kwalletmanager.

kwalletmanager.x86_64: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system-services/org.kde.kcontrol.kcmkwallet5.service
kwalletmanager.x86_64: E: dbus-file-unauthorized (Badness: 10) /usr/share/dbus-1/system.d/org.kde.kcontrol.kcmkwallet5.conf

It's unclear why these errors occur, these services have basically already
been whitelisted, but maybe I'm missing something.
Comment 1 Paolo Perego 2023-11-22 13:33:22 UTC
I will pickup this one.
Comment 2 Paolo Perego 2023-12-04 16:21:52 UTC
kdewalletmanager: the code is almost here to design and manage 
UI. Not too much business logic or interesting code so far. No issues at the 
moment
Comment 3 Paolo Perego 2023-12-04 16:32:07 UTC
Closing the AUDIT
Comment 4 Matthias Gerstner 2023-12-05 10:18:05 UTC
Reopening since we need this bug for tracking the whitelisting.

This package throws rpmlint badness, because the RPM has been renamed from
kwalletmanager5 to kwalletmanager. Otherwise nothing changed in the
whitelisted D-Bus files or Polkit actions.

The actual Kauth privileged component is the "savehelper.cpp" which actually
does nothing:

```
ActionReply SaveHelper::save(const QVariantMap &args)
{
    Q_UNUSED(args);
    const qint64 uid = QCoreApplication::applicationPid();
    qDebug() << "executing uid=" << uid;

    return ActionReply::SuccessReply();
}
```

@christophe: can you please reach out to upstream and ask them to simply drop
unused D-Bus / Kauth helpers and Polkit actions? This would make all our lives
easier. Thanks.
Comment 5 Christophe Marin 2023-12-05 15:32:11 UTC
(In reply to Matthias Gerstner from comment #4)
>
> @christophe: can you please reach out to upstream and ask them to simply drop
> unused D-Bus / Kauth helpers and Polkit actions? This would make all our
> lives
> easier. Thanks.

Done: https://invent.kde.org/utilities/kwalletmanager/-/issues/4
Comment 6 Matthias Gerstner 2024-02-14 11:16:23 UTC
The explanation for the existence of this helper in the upstream issue
mentioned in comment 5 is not very convincing.

I really don't want to whitelist such code. If upstream doesn't want to drop
this then You can patch out the helper and the client code invoking it. This
is not adding to security, it is only increasing complexity.
Comment 7 Christophe Marin 2024-02-15 23:07:52 UTC
(In reply to Matthias Gerstner from comment #6)

> I really don't want to whitelist such code. If upstream doesn't want to drop
> this then You can patch out the helper and the client code invoking it. This
> is not adding to security, it is only increasing complexity.

I'm working on it. https://build.opensuse.org/request/show/1146930 drops the kauth usage.
Comment 8 Christophe Marin 2024-02-16 10:03:49 UTC
done, should we close the bug with RESOLVED/WONTFIX?
Comment 9 Matthias Gerstner 2024-02-16 10:37:29 UTC
(In reply to christophe@krop.fr from comment #8)
> done, should we close the bug with RESOLVED/WONTFIX?

Well, you already did it, but it's all right with me.

Maybe you add some clarification to the patch. It now sounds like we're
disabling a security feature without giving any reasoning. The reasoning is
that the KAuth helper is useless and does not add to security.

If upstream KDE really worries about this strange scenario then they could
just as well run something like `sudo -U $USERNAME true` and achieve the same
result without shipping a fake kauth service helper and routing all of this
through D-Bus for nothing.
Comment 11 Christophe Marin 2024-02-16 11:40:43 UTC
(In reply to Matthias Gerstner from comment #9)
> Maybe you add some clarification to the patch. It now sounds like we're
> disabling a security feature without giving any reasoning. The reasoning is
> that the KAuth helper is useless and does not add to security.
> 

done