russell@unturf.com decacb5dbd systemd+dbus: 5-MOAD scan; systemd-0004 CWE-407 seccomp strv O(K*A), dbus-0001 CWE-407 policy optimize O(R^2)

systemd-0004: seccomp_load_syscall_filter_set() in src/shared/seccomp-util.c uses
strv_contains(added, name) — O(|added|) linear scan — inside NULSTR_FOREACH over
~537 KNOWN syscalls. On x86_64 (3 arches): ~484,000 string comparisons per service
start with SeccompFilter=. Sibling function seccomp_load_syscall_filter_set_raw()
already uses hashmap_contains for O(1); this function was left behind.
Fix: build Set* from added strv before the NULSTR_FOREACH loop. MEDIUM severity.

dbus-0001: bus_client_policy_optimize() in bus/policy.c iterates R rules and for
each blanket deny/allow calls remove_rules_by_type_up_to() which scans backward
from current position to head — O(R^2) total per new connection creation.
At R=100 rules (realistic system bus): ~10,000 comparisons per connect.
Fix: single O(R) reverse pass tracking last-seen blanket per rule type. MEDIUM.

dbus 5-MOAD summary:
  MOAD-0001: dbus-0001 DEFECT (policy optimize O(R^2))
  MOAD-0002: CLEAN (BusContext is standard daemon context, not a god object)
  MOAD-0003: CLEAN (single-threaded event loop, no thread-local state)
  MOAD-0004: CLEAN (_dbus_verbose is no-op in production builds)
  MOAD-0005: CLEAN (pending_activations hash table coalesces duplicate requests)

2026-04-03 15:53:52 -04:00

2.5 KiB

Raw Blame History

dbus 5-MOAD scan — 2026-04-03

Source: https://gitlab.freedesktop.org/dbus/dbus (depth=1) Focus: bus/ (message dispatch, activation, policy), dbus/ (auth, protocol)

MOAD-0001 (CWE-407): DEFECT — dbus-0001

bus/policy.c bus_client_policy_optimize() runs on every new connection to eliminate shadowed policy rules. For each blanket-deny/allow rule (one with no field constraints), it calls remove_rules_by_type_up_to() which walks the full rules list from the beginning up to the current position. Total complexity is O(R^2) where R = total rules in the client policy.

A system bus configuration with 100 rules per connection produces ~10,000 comparisons per new connection. Under a workload that creates and destroys many connections (container start/stop, session bus churn), this accumulates.

See dbus-0001-policy-optimize-o-n2.patch and dbus-0001-TICKET.md for full analysis.

Other CWE-407 candidates reviewed:

bus/signals.c match rule dispatch: uses hash table indexed by (message_type, interface) — pre-filtered, O(1) dispatch. CLEAN.
bus/activation.c service activation dedup: uses pending_activations hash table to coalesce duplicate requests. CLEAN.
bus/config-parser.c service_dirs_find_dir: O(D^2) during config load but D is small (< 20 dirs). LOW severity, startup only. CLEAN.
bus/services.c owner list scan: O(N) per ownership transfer. N = number of owners of a single service name, always very small. CLEAN.

MOAD-0002 (Intertangle): CLEAN

BusContext in bus/bus.h is a well-scoped daemon context object holding all bus state. This is the standard single-daemon pattern, not a god object spanning independent subsystems. The sub-objects (BusPolicy, BusActivation, BusRegistry, BusMatchmaker, BusConnections) have clean interfaces. CLEAN.

MOAD-0003 (Leaked Context): CLEAN

dbus-daemon is single-threaded (main loop in bus/main.c using a custom event loop). No pthread_getspecific, thread_local, or __thread in bus/. CLEAN.

MOAD-0004 (CWE-312 Logged Secret): CLEAN

All SASL auth logging (dbus-auth.c) uses _dbus_verbose() which compiles to a no-op unless DBUS_ENABLE_VERBOSE_MODE is set at build time. Production dbus binaries do not enable this flag. The dbus-daemon-launch-helper and activation paths log only service names and error codes. CLEAN.

MOAD-0005 (Thundering Herd): CLEAN

dbus-daemon is single-threaded. Service activation uses pending_activations hash table to coalesce multiple concurrent activation requests for the same service into a single launch, preventing herd behavior. CLEAN.

2.5 KiB Raw Blame History