Bugzilla – Bug 906718
AUDIT-0: Review blueman 2.x alpha package
Last modified: 2017-02-06 15:36:25 UTC
See home:posophe:branches:Base:System/blueman E: suse-dbus-unauthorized-service (Badness: 10000) /usr/share/dbus-1/system-services/org.blueman.Mechanism.service E: suse-dbus-unauthorized-service (Badness: 10000) /etc/dbus-1/system.d/org.blueman.Mechanism.conf I: polkit-untracked-privilege org.blueman.network.setup (??:no:auth_admin_keep) I: polkit-untracked-privilege org.blueman.hal.manager (??:no:auth_admin_keep) I: polkit-untracked-privilege org.blueman.bluez.config (??:no:auth_admin_keep) E: polkit-unauthorized-privilege (Badness: 10000) org.blueman.dhcp.client (??:no:yes) I: polkit-cant-acquire-privilege org.blueman.network.setup (??:no:auth_admin_keep) I: polkit-cant-acquire-privilege org.blueman.hal.manager (??:no:auth_admin_keep) I: polkit-cant-acquire-privilege org.blueman.dhcp.client (??:no:yes) I: polkit-cant-acquire-privilege org.blueman.bluez.config (??:no:auth_admin_keep) Blueman will be the next bluetooth manager into mate DE and I would like to push Mate unstable to Factory. Thanks
sr#262767
dhcp.client with "yes" ... likely not a good idea. we will take a look
I really need someone have a look on blueman 2.x before Mate 1.10 release. Thanks
Update : Now stable 2.0.1 release The files requiring a review are now reduced to two files : E: suse-dbus-unauthorized-service (Badness: 10000) /usr/share/dbus-1/system-services/org.blueman.Mechanism.service E: suse-dbus-unauthorized-service (Badness: 10000) /etc/dbus-1/system.d/org.blueman.Mechanism.conf
Still the same issues with blueman. Every DBUS function running as root, allowed to be called by anyone without any authorization. CVE-2015-8612 as an recent example. Cant be whitelisted.
Ok I relay on upstream
CVE-2015-8612 is fixed upstream. Debian stretch and sid contain blueman 2.0.4 (which contains the fix). This CVE is the only one reported in the debian security database. https://security-tracker.debian.org/tracker/source-package/blueman If it is good enough for debian, it might be good enough for openSUSE?
It has been fixed especially for openSUSE. Please re-evaluate
Please see https://bugzilla.suse.com/show_bug.cgi?id=1006601 They fixed the particular issue but most of the functions are still w/o polkit rules.
solved via bsc#987141