UNDF: UNDF-2026-000001224

dbus 5-MOAD scan — 2026-04-03

Source: https://gitlab.freedesktop.org/dbus/dbus (depth=1) Focus: bus/ (message dispatch, activation, policy), dbus/ (auth, protocol)

MOAD-0001 (CWE-407): DEFECT — dbus-0001

bus/policy.c bus_client_policy_optimize() runs on every new connection to eliminate shadowed policy rules. For each blanket-deny/allow rule (one with no field constraints), it calls remove_rules_by_type_up_to() which walks the full rules list from the beginning up to the current position. Total complexity is O(R^2) where R = total rules in the client policy.

A system bus configuration with 100 rules per connection produces ~10,000 comparisons per new connection. Under a workload that creates and destroys many connections (container start/stop, session bus churn), this accumulates.

See dbus-0001-policy-optimize-o-n2.patch and dbus-0001-TICKET.md for full analysis.

Other CWE-407 candidates reviewed:

bus/signals.c match rule dispatch: uses hash table indexed by (message_type, interface) — pre-filtered, O(1) dispatch. CLEAN.
bus/activation.c service activation dedup: uses pending_activations hash table to coalesce duplicate requests. CLEAN.
bus/config-parser.c service_dirs_find_dir: O(D^2) during config load but D is small (< 20 dirs). LOW severity, startup only. CLEAN.
bus/services.c owner list scan: O(N) per ownership transfer. N = number of owners of a single service name, always very small. CLEAN.

MOAD-0002 (Intertangle): CLEAN

BusContext in bus/bus.h is a well-scoped daemon context object holding all bus state. This is the standard single-daemon pattern, not a god object spanning independent subsystems. The sub-objects (BusPolicy, BusActivation, BusRegistry, BusMatchmaker, BusConnections) have clean interfaces. CLEAN.

MOAD-0003 (Leaked Context): CLEAN

dbus-daemon is single-threaded (main loop in bus/main.c using a custom event loop). No pthread_getspecific, thread_local, or __thread in bus/. CLEAN.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

All SASL auth logging (dbus-auth.c) uses _dbus_verbose() which compiles to a no-op unless DBUS_ENABLE_VERBOSE_MODE is set at build time. Production dbus binaries do not enable this flag. The dbus-daemon-launch-helper and activation paths log only service names and error codes. CLEAN.

MOAD-0005 (Thundering Herd): CLEAN

dbus-daemon is single-threaded. Service activation uses pending_activations hash table to coalesce multiple concurrent activation requests for the same service into a single launch, preventing herd behavior. CLEAN.

2.6 KiB Raw Blame History