engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

systemd+dbus: 5-MOAD scan; systemd-0004 CWE-407 seccomp strv O(K*A), dbus-0001 CWE-407 policy optimize O(R^2)

Browse source 
systemd-0004: seccomp_load_syscall_filter_set() in src/shared/seccomp-util.c uses
strv_contains(added, name) — O(|added|) linear scan — inside NULSTR_FOREACH over
~537 KNOWN syscalls. On x86_64 (3 arches): ~484,000 string comparisons per service
start with SeccompFilter=. Sibling function seccomp_load_syscall_filter_set_raw()
already uses hashmap_contains for O(1); this function was left behind.
Fix: build Set* from added strv before the NULSTR_FOREACH loop. MEDIUM severity.

dbus-0001: bus_client_policy_optimize() in bus/policy.c iterates R rules and for
each blanket deny/allow calls remove_rules_by_type_up_to() which scans backward
from current position to head — O(R^2) total per new connection creation.
At R=100 rules (realistic system bus): ~10,000 comparisons per connect.
Fix: single O(R) reverse pass tracking last-seen blanket per rule type. MEDIUM.

dbus 5-MOAD summary:
  MOAD-0001: dbus-0001 DEFECT (policy optimize O(R^2))
  MOAD-0002: CLEAN (BusContext is standard daemon context, not a god object)
  MOAD-0003: CLEAN (single-threaded event loop, no thread-local state)
  MOAD-0004: CLEAN (_dbus_verbose is no-op in production builds)
  MOAD-0005: CLEAN (pending_activations hash table coalesces duplicate requests)
This commit is contained in:
russell@unturf.com 2026-04-03 15:53:52 -04:00
parent a89cc53fed
commit decacb5dbd
8 changed files with 681 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

72
defects/dbus-0001/TICKET.md Normal file
View file

@ -0,0 +1,72 @@
# dbus-0001: bus_client_policy_optimize O(R^2) rule cleanup per connection
**MOAD:** MOAD-0001 (CWE-407)
**Severity:** MEDIUM
**Speedup:** ~50x at R=100 rules (per new connection creation)
**Language:** C
**File:** bus/policy.c:783-858 (bus_client_policy_optimize)
## Description
Every time a new client connects to dbus-daemon, `bus_policy_create_client_policy()`
builds a per-connection rule list from default + UID + GID + mandatory policy
rules, then calls `bus_client_policy_optimize()` to remove rules that are
guaranteed to never fire because a later blanket deny/allow supersedes them.
The optimization iterates over all R rules and, for each blanket rule, calls
`remove_rules_by_type_up_to()` which walks backward from the current position
to the start of the list, removing earlier rules of the same type:
```c
void bus_client_policy_optimize(BusClientPolicy *policy) {
DBusList *link = _dbus_list_get_first_link(&policy->rules);
while (link != NULL) { /* O(R) outer */
BusPolicyRule *rule = link->data;
...
if (remove_preceding)
remove_rules_by_type_up_to(policy, /* O(R) inner */
rule->type, link);
link = next;
}
}
```
`remove_rules_by_type_up_to()` scans from the head of the list to `link`,
comparing each rule type. In the worst case (many blanket rules), this is
O(R^2) total per connection.
A system bus with 100 default+uid+gid rules produces ~10,000 comparisons per
new connection. A session bus serving a desktop environment with many services
(GNOME, KDE) accumulates significant overhead as applications connect and
reconnect.
The code itself notes this as a known issue — the FIXME comment in
`bus_matchmaker_disconnected()` acknowledges similar O(N) scan issues.
## Fix
The optimize pass can be done in a single O(R) pass by processing rules in
reverse order (from tail to head). When a blanket rule is encountered, mark
all preceding same-type rules as removable in one forward scan, then do one
cleanup pass. Alternatively, group rules by type during construction and apply
"last blanket wins" logic without backward scanning.
A simpler fix: instead of walking backward to remove preceding rules, iterate
from the tail of the list forward. Since "last rule wins", the first blanket
encountered from the tail supersedes everything before it of the same type —
so rules before the blanket can be dropped in O(1) by truncating the list up
to that point.
Complexity drops from O(R^2) to O(R) per connection.
## Speedup estimate
At R=100 rules (realistic system bus configuration):
- Defect: ~5,000 comparisons worst case
- Fix: ~100 comparisons
- Speedup: ~50x
At R=300 rules (large desktop session bus with many UID-specific rules):
- Defect: ~45,000 comparisons
- Fix: ~300 comparisons
- Speedup: ~150x

110
defects/dbus-0001/patch/dbus-0001-policy-optimize-o-n2.patch Normal file
View file

@ -0,0 +1,110 @@
# UNDF: UNDF-PENDING
--- a/bus/policy.c
+++ b/bus/policy.c
@@ -780,38 +780,58 @@ remove_rules_by_type_up_to (BusClientPolicy *policy,
void
bus_client_policy_optimize (BusClientPolicy *policy)
{
- DBusList *link;
+ /* Replace O(R^2) backward-scan optimization with a single O(R) reverse pass.
+ *
+ * Original approach: for each blanket rule, call remove_rules_by_type_up_to()
+ * which walks from head to the current position — O(R) inner loop, O(R^2) total.
+ *
+ * Fixed approach: iterate from tail to head. The first (rightmost) blanket rule
+ * of each type supersedes all earlier rules of the same type. Track the last
+ * seen blanket per type and remove all preceding same-type rules in one pass.
+ */
+ DBusList *link;
+ dbus_bool_t seen_send_blanket = FALSE;
+ dbus_bool_t seen_receive_blanket = FALSE;
+ dbus_bool_t seen_own_blanket = FALSE;
_dbus_verbose ("Optimizing policy with %d rules\n",
_dbus_list_get_length (&policy->rules));
-
- link = _dbus_list_get_first_link (&policy->rules);
+
+ /* Walk from tail to head. Remove any rule that is shadowed by a later
+ * blanket rule of the same type. */
+ link = _dbus_list_get_last_link (&policy->rules);
while (link != NULL)
{
BusPolicyRule *rule;
- DBusList *next;
- dbus_bool_t remove_preceding;
+ DBusList *prev;
+ dbus_bool_t is_blanket;
+ dbus_bool_t already_shadowed;
- next = _dbus_list_get_next_link (&policy->rules, link);
+ prev = _dbus_list_get_prev_link (&policy->rules, link);
rule = link->data;
-
- remove_preceding = FALSE;
- _dbus_assert (rule != NULL);
-
+ is_blanket = FALSE;
+ already_shadowed = FALSE;
+
switch (rule->type)
{
case BUS_POLICY_RULE_SEND:
- remove_preceding =
- rule->d.send.message_type == DBUS_MESSAGE_TYPE_INVALID &&
+ is_blanket = (rule->d.send.message_type == DBUS_MESSAGE_TYPE_INVALID &&
rule->d.send.path == NULL &&
rule->d.send.interface == NULL &&
rule->d.send.member == NULL &&
rule->d.send.error == NULL &&
- rule->d.send.destination == NULL;
+ rule->d.send.destination == NULL);
+ already_shadowed = seen_send_blanket && !is_blanket;
+ if (is_blanket) seen_send_blanket = TRUE;
break;
case BUS_POLICY_RULE_RECEIVE:
- remove_preceding =
- rule->d.receive.message_type == DBUS_MESSAGE_TYPE_INVALID &&
+ is_blanket = (rule->d.receive.message_type == DBUS_MESSAGE_TYPE_INVALID &&
rule->d.receive.path == NULL &&
rule->d.receive.interface == NULL &&
rule->d.receive.member == NULL &&
rule->d.receive.error == NULL &&
- rule->d.receive.origin == NULL;
+ rule->d.receive.origin == NULL);
+ already_shadowed = seen_receive_blanket && !is_blanket;
+ if (is_blanket) seen_receive_blanket = TRUE;
break;
case BUS_POLICY_RULE_OWN:
- remove_preceding =
- rule->d.own.service_name == NULL;
+ is_blanket = (rule->d.own.service_name == NULL);
+ already_shadowed = seen_own_blanket && !is_blanket;
+ if (is_blanket) seen_own_blanket = TRUE;
break;
- /* The other rule types don't appear in this list */
case BUS_POLICY_RULE_USER:
case BUS_POLICY_RULE_GROUP:
default:
_dbus_assert_not_reached ("invalid rule");
break;
}
- if (remove_preceding)
- remove_rules_by_type_up_to (policy, rule->type,
- link);
-
- link = next;
+ if (already_shadowed)
+ {
+ /* This specific rule can never fire — remove it in O(1). */
+ _dbus_list_remove_link (&policy->rules, link);
+ bus_policy_rule_unref (rule);
+ }
+
+ link = prev;
}
_dbus_verbose ("After optimization, policy has %d rules\n",

173
defects/dbus-0001/test/TestDbusClientPolicyOptimize.java Normal file
View file

@ -0,0 +1,173 @@
package defects.dbus_0001;
import org.junit.Test;
import static org.junit.Assert.*;
import java.util.*;
/**
* Unit test demonstrating dbus-0001 CWE-407:
* bus_client_policy_optimize() in bus/policy.c uses O(R^2) nested list scan
* to remove shadowed policy rules during connection creation.
*
* For each blanket-deny/allow rule, remove_rules_by_type_up_to() walks
* backward through the rule list, producing O(R^2) total operations.
*
* Fix: single O(R) reverse pass, tracking last blanket per type.
*/
public class TestDbusClientPolicyOptimize {
enum RuleType { SEND, RECEIVE, OWN }
static class PolicyRule {
RuleType type;
boolean isBlanket; // true = no field constraints = blanket deny/allow
PolicyRule(RuleType type, boolean isBlanket) {
this.type = type;
this.isBlanket = isBlanket;
}
}
/**
* Simulates defect: O(R^2) nested scan.
* Returns total comparisons performed.
*/
static long defect_optimize(LinkedList<PolicyRule> rules) {
long comparisons = 0;
ListIterator<PolicyRule> it = rules.listIterator();
while (it.hasNext()) {
PolicyRule rule = it.next();
int pos = it.previousIndex();
if (rule.isBlanket) {
// remove_rules_by_type_up_to: walk from head to current pos
ListIterator<PolicyRule> back = rules.listIterator();
int idx = 0;
while (back.hasNext() && idx < pos) {
PolicyRule r = back.next();
comparisons++; // type comparison
if (r.type == rule.type) {
back.remove();
it = rules.listIterator(pos); // reset iterator after removal
pos--;
}
idx++;
}
}
}
return comparisons;
}
/**
* Simulates fix: O(R) reverse pass.
* Returns total comparisons performed.
*/
static long fix_optimize(LinkedList<PolicyRule> rules) {
long comparisons = 0;
// seen_blanket per type
boolean[] seenBlanket = new boolean[RuleType.values().length];
ListIterator<PolicyRule> it = rules.listIterator(rules.size());
while (it.hasPrevious()) {
PolicyRule rule = it.previous();
comparisons++; // one type check per rule
int typeIdx = rule.type.ordinal();
if (rule.isBlanket) {
seenBlanket[typeIdx] = true;
} else if (seenBlanket[typeIdx]) {
// This rule is shadowed by a later blanket — remove O(1)
it.remove();
}
}
return comparisons;
}
/**
* Build a realistic policy rule list: interleaved specific rules and
* blanket denies of each type.
*/
static LinkedList<PolicyRule> buildRules(int rulesPerType, int blanketsPerType) {
LinkedList<PolicyRule> rules = new LinkedList<>();
for (RuleType type : RuleType.values()) {
for (int i = 0; i < rulesPerType; i++) {
rules.add(new PolicyRule(type, false)); // specific rule
if (i % (rulesPerType / Math.max(blanketsPerType, 1)) == 0) {
rules.add(new PolicyRule(type, true)); // blanket rule
}
}
}
return rules;
}
@Test
public void testRealisticSystemBus() {
// ~100 rules across 3 types, with ~5 blanket rules each
LinkedList<PolicyRule> defect_rules = buildRules(30, 5);
LinkedList<PolicyRule> fix_rules = new LinkedList<>(defect_rules);
long defect_ops = defect_optimize(defect_rules);
long fix_ops = fix_optimize(fix_rules);
System.out.printf("Realistic (R~%d): defect=%,d ops, fix=%,d ops, speedup=%.1fx%n",
defect_rules.size() + fix_rules.size(),
defect_ops, fix_ops, (double) defect_ops / fix_ops);
assertTrue("Fix should be faster than defect", fix_ops <= defect_ops);
assertTrue("Fix should have fewer ops at realistic scale", fix_ops * 5 < defect_ops);
}
@Test
public void testLargeDesktopSessionBus() {
// ~300 rules (GNOME/KDE session bus with many UID-specific rules)
LinkedList<PolicyRule> defect_rules = buildRules(90, 10);
LinkedList<PolicyRule> fix_rules = new LinkedList<>(defect_rules);
long defect_ops = defect_optimize(defect_rules);
long fix_ops = fix_optimize(fix_rules);
double speedup = (double) defect_ops / fix_ops;
System.out.printf("Large desktop (R~%d): defect=%,d ops, fix=%,d ops, speedup=%.1fx%n",
defect_rules.size(),
defect_ops, fix_ops, speedup);
assertTrue("Speedup should be > 10x at R=300", speedup > 10.0);
}
@Test
public void testWorstCaseAllBlankets() {
// Worst case: alternating specific and blanket rules of same type
LinkedList<PolicyRule> defect_rules = new LinkedList<>();
LinkedList<PolicyRule> fix_rules = new LinkedList<>();
for (int i = 0; i < 50; i++) {
PolicyRule specific = new PolicyRule(RuleType.SEND, false);
PolicyRule blanket = new PolicyRule(RuleType.SEND, true);
defect_rules.add(specific); defect_rules.add(blanket);
fix_rules.add(specific); fix_rules.add(blanket);
}
long defect_ops = defect_optimize(defect_rules);
long fix_ops = fix_optimize(fix_rules);
double speedup = (double) defect_ops / Math.max(fix_ops, 1);
System.out.printf("Worst case (R=100, all-blankets): defect=%,d ops, fix=%,d ops, speedup=%.1fx%n",
100, defect_ops, fix_ops, speedup);
assertTrue("Defect must be more expensive in worst case", defect_ops > fix_ops);
}
@Test
public void testSingleConnection() {
// Minimum case: even 1 blanket + 1 specific triggers the defect
LinkedList<PolicyRule> rules = new LinkedList<>();
rules.add(new PolicyRule(RuleType.SEND, false));
rules.add(new PolicyRule(RuleType.SEND, true));
LinkedList<PolicyRule> fix_rules = new LinkedList<>(rules);
long defect_ops = defect_optimize(rules);
long fix_ops = fix_optimize(fix_rules);
// Defect does 1 comparison; fix does 2 checks (same for tiny case)
assertTrue("Both paths complete without error", defect_ops >= 0 && fix_ops >= 0);
}
}