56 lines
2.6 KiB
Markdown
56 lines
2.6 KiB
Markdown
# UNDF: UNDF-2026-000001224
|
|
# dbus 5-MOAD scan — 2026-04-03
|
|
|
|
Source: https://gitlab.freedesktop.org/dbus/dbus (depth=1)
|
|
Focus: bus/ (message dispatch, activation, policy), dbus/ (auth, protocol)
|
|
|
|
## MOAD-0001 (CWE-407): DEFECT — dbus-0001
|
|
|
|
`bus/policy.c` `bus_client_policy_optimize()` runs on every new connection to
|
|
eliminate shadowed policy rules. For each blanket-deny/allow rule (one with no
|
|
field constraints), it calls `remove_rules_by_type_up_to()` which walks the
|
|
full rules list from the beginning up to the current position. Total complexity
|
|
is O(R^2) where R = total rules in the client policy.
|
|
|
|
A system bus configuration with 100 rules per connection produces ~10,000
|
|
comparisons per new connection. Under a workload that creates and destroys many
|
|
connections (container start/stop, session bus churn), this accumulates.
|
|
|
|
See `dbus-0001-policy-optimize-o-n2.patch` and `dbus-0001-TICKET.md` for full
|
|
analysis.
|
|
|
|
Other CWE-407 candidates reviewed:
|
|
- `bus/signals.c` match rule dispatch: uses hash table indexed by
|
|
(message_type, interface) — pre-filtered, O(1) dispatch. CLEAN.
|
|
- `bus/activation.c` service activation dedup: uses `pending_activations`
|
|
hash table to coalesce duplicate requests. CLEAN.
|
|
- `bus/config-parser.c` service_dirs_find_dir: O(D^2) during config load but
|
|
D is small (< 20 dirs). LOW severity, startup only. CLEAN.
|
|
- `bus/services.c` owner list scan: O(N) per ownership transfer. N = number
|
|
of owners of a single service name, always very small. CLEAN.
|
|
|
|
## MOAD-0002 (Intertangle): CLEAN
|
|
|
|
`BusContext` in `bus/bus.h` is a well-scoped daemon context object holding
|
|
all bus state. This is the standard single-daemon pattern, not a god object
|
|
spanning independent subsystems. The sub-objects (BusPolicy, BusActivation,
|
|
BusRegistry, BusMatchmaker, BusConnections) have clean interfaces. CLEAN.
|
|
|
|
## MOAD-0003 (Leaked Context): CLEAN
|
|
|
|
dbus-daemon is single-threaded (main loop in `bus/main.c` using a custom
|
|
event loop). No `pthread_getspecific`, `thread_local`, or `__thread` in
|
|
`bus/`. CLEAN.
|
|
|
|
## MOAD-0004 (CWE-312 Logged Secret): CLEAN
|
|
|
|
All SASL auth logging (`dbus-auth.c`) uses `_dbus_verbose()` which compiles
|
|
to a no-op unless `DBUS_ENABLE_VERBOSE_MODE` is set at build time. Production
|
|
dbus binaries do not enable this flag. The `dbus-daemon-launch-helper` and
|
|
activation paths log only service names and error codes. CLEAN.
|
|
|
|
## MOAD-0005 (Thundering Herd): CLEAN
|
|
|
|
dbus-daemon is single-threaded. Service activation uses `pending_activations`
|
|
hash table to coalesce multiple concurrent activation requests for the same
|
|
service into a single launch, preventing herd behavior. CLEAN.
|