# dbus 5-MOAD scan — 2026-04-03

Source: https://gitlab.freedesktop.org/dbus/dbus (depth=1)
Focus: bus/ (message dispatch, activation, policy), dbus/ (auth, protocol)

## MOAD-0001 (CWE-407): DEFECT — dbus-0001

`bus/policy.c` `bus_client_policy_optimize()` runs on every new connection to
eliminate shadowed policy rules. For each blanket-deny/allow rule (one with no
field constraints), it calls `remove_rules_by_type_up_to()` which walks the
full rules list from the beginning up to the current position. Total complexity
is O(R^2) where R = total rules in the client policy.

A system bus configuration with 100 rules per connection produces ~10,000
comparisons per new connection. Under a workload that creates and destroys many
connections (container start/stop, session bus churn), this accumulates.

See `dbus-0001-policy-optimize-o-n2.patch` and `dbus-0001-TICKET.md` for full
analysis.

Other CWE-407 candidates reviewed:
- `bus/signals.c` match rule dispatch: uses hash table indexed by
  (message_type, interface) — pre-filtered, O(1) dispatch. CLEAN.
- `bus/activation.c` service activation dedup: uses `pending_activations`
  hash table to coalesce duplicate requests. CLEAN.
- `bus/config-parser.c` service_dirs_find_dir: O(D^2) during config load but
  D is small (< 20 dirs). LOW severity, startup only. CLEAN.
- `bus/services.c` owner list scan: O(N) per ownership transfer. N = number
  of owners of a single service name, always very small. CLEAN.

## MOAD-0002 (Intertangle): CLEAN

`BusContext` in `bus/bus.h` is a well-scoped daemon context object holding
all bus state. This is the standard single-daemon pattern, not a god object
spanning independent subsystems. The sub-objects (BusPolicy, BusActivation,
BusRegistry, BusMatchmaker, BusConnections) have clean interfaces. CLEAN.

## MOAD-0003 (Leaked Context): CLEAN

dbus-daemon is single-threaded (main loop in `bus/main.c` using a custom
event loop). No `pthread_getspecific`, `thread_local`, or `__thread` in
`bus/`. CLEAN.

## MOAD-0004 (CWE-312 Logged Secret): CLEAN

All SASL auth logging (`dbus-auth.c`) uses `_dbus_verbose()` which compiles
to a no-op unless `DBUS_ENABLE_VERBOSE_MODE` is set at build time. Production
dbus binaries do not enable this flag. The `dbus-daemon-launch-helper` and
activation paths log only service names and error codes. CLEAN.

## MOAD-0005 (Thundering Herd): CLEAN

dbus-daemon is single-threaded. Service activation uses `pending_activations`
hash table to coalesce multiple concurrent activation requests for the same
service into a single launch, preventing herd behavior. CLEAN.