dbus-unbreaker | test whether dbus-broker will break the boot

seth · 2024-02-02 18:40:32

Context: https://github.com/bus1/dbus-broker/issues/341

Script, this is heuristics - no guarantee. I don't even know how fragile dbus-broker exactly is itr.

#!/bin/bash

dbus_path=/usr/share/dbus-1

false_positive='eavesdrop|- invalid|own_prefix' # the dtd check will say invalid for most files because the dtd is probably unmaintained
false_positive+='|receive_interface|receive_member|receive_requested_reply|receive_sender|receive_type'
false_positive+='|send_destination|send_interface|send_member|send_path|send_requested_reply|send_type'

error() {
    printf '\n\e[1;31m'
    printf "ERROR: $*"
    printf '\e[0m\n'
}

warning() {
    printf '\e[1;33m'
    printf "WARNING: $*"
    printf '\e[0m\n'
}

shopt -s globstar

shady_path=false

safepath() {
    local uid gid perm
    local badwrite=0x2
    read uid gid perm < <(stat -c '%u %g %a' "$1")
    (($uid)) && shady_path=true && error "$1 is not owned by root!"
    (($gid)) && badwrite=0x22 && shady_path=true && warning "$1 does not belong to the root group!"
    ((0x$perm & $badwrite)) && shady_path=true && error "$1 can be written by non-root user!"
}

entiresafepath() {
    local testpath="$1"
    while [ -n "$testpath" ]; do
        safepath "$testpath"
        [ "$testpath" = "/" ] && break
        testpath="$(dirname "$testpath")"
    done
}

etc_confs=()
[ -d /etc/dbus-1/system.d ] && etc_confs=(/etc/dbus-1/system.d/**) && entiresafepath /etc/dbus-1/system.d

entiresafepath "$dbus_path"
safepath "$dbus_path/session.d"
safepath "$dbus_path/system.d"

have_xml=true
if ! type xmlstarlet >/dev/null 2>&1; then
    warning "xmlstarlet not found, limited validity check only"
    have_xml=false
fi
all_files=0
good_files=0
for config_file in $dbus_path/system.d/** $dbus_path/session.d/** \
                   $dbus_path/system.conf $dbus_path/session.conf \
                   "${etc_confs[@]}"; do
    [ -d "$config_file" ] && continue # skip directories
    ((++all_files))
    
    # does the file exist?
    if [ ! -e "$config_file" ]; then
        error "$config_file is stale symlink"
        continue
    fi
    
    safepath "$config_file"
    
    # does this try to be a busconfig at all?
    if ! grep '!DOCTYPE busconfig' "$config_file" >/dev/null; then
        warning "$config_file does seem to have a busconfig DOCTYPE"
    fi
    
    if ! grep '<busconfig>' "$config_file" >/dev/null; then
        error "$config_file does not remotely look like a D-Bus busconfig file"
        continue
    fi

    # skip on if xmlstarlet isn't available
    $have_xml || ((++good_files))
    $have_xml || continue
    
    # basic xml validation - "is is a sane xml at all"
    if ! xmlstarlet -q val $config_file; then
        error "$config_file is invalid xml"
        printf "===============================================================\n"
        xmlstarlet el $config_file
        printf "===============================================================\n"
        continue
    fi
    
    ((++good_files)) # at this point the file will most likely be accepted by dbus-breaker, but still…
    
    # these two are so much off the dtd that it's pointless, we assume nobody fucked them up at this point
    [ "$config_file" = "$dbus_path/system.conf" -o "$config_file" = "$dbus_path/session.conf" ] && continue
    
    # check for busconfig dtd validity
    printf '\e[1;33m'
    xmlstarlet fo -D "$config_file" | # the canonical dtd url is 404…
        xmlstarlet val -e --dtd /usr/share/xml/dbus-1/busconfig.dtd /dev/stdin 2>&1 | 
        sed -E "/(${false_positive})/d; s%/dev/stdin%${config_file}%g" # filter strings that are known to not be covered by the dtd…
    printf '\e[0m'
done
((good_files < all_files)) && error "$((all_files-good_files)) file(s) might trip dbus-broker\n"
printf " -------\n$good_files of $all_files look ok to me"
$shady_path && printf ",\e[1;31m but there some insecure paths\e[0m"
printf "\n"

Edit:
#1 conditional /etc/dbus-1/system.d handling
#2 test for path safety
#3 typo
#4 more lenient doctype handling

Last edited by seth (2024-02-08 10:33:08)

dogknowsnx · 2024-02-03 09:41:02

Thanks for making Arch better every single day!

One suggestion to avoid another false positive - there are only a few (official) packages that will create '/etc/dbus-1/system.d/':

~ ❯ pacman -F /etc/dbus-1/system.d/                                                                                                                                               [1] 10:35
etc/dbus-1/system.d/ ist in extra/deepin-file-manager 1:6.0.37-4 enthalten
etc/dbus-1/system.d/ ist in extra/kylin-nm 3.0.2-2 enthalten
etc/dbus-1/system.d/ ist in extra/system76-firmware 1.0.58-1 enthalten
etc/dbus-1/system.d/ ist in extra/system76-scheduler 2.0.1-1 enthalten
etc/dbus-1/system.d/ ist in extra/ukui-control-center 3.0.4-10 enthalten
etc/dbus-1/system.d/ ist in extra/ukui-notebook 3.1.1-2 enthalten
etc/dbus-1/system.d/ ist in extra/ukui-settings-daemon 3.1.1.1-4 enthalten

Suggestion:

~ ❯  diff -u dbus-unbreaker.sh dbus-unbreaker_1.sh                                                                                                                                [0] 10:33
--- dbus-unbreaker.sh	2024-02-03 10:29:43.356695766 +0100
+++ dbus-unbreaker_1.sh	2024-02-03 10:33:36.050041233 +0100
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 dbus_path=/usr/share/dbus-1
+[ -d /etc/dbus-1/system.d ] && etc_path=/etc/dbus-1/system.d/*
 false_positive='eavesdrop|- invalid' # the dtd check will say invalid for most files because the dtd is probably unmaintained
 false_positive+='|receive_interface|receive_member|receive_sender|receive_type'
 false_positive+='|send_destination|send_interface|send_member|send_path|send_requested_reply|send_type'
@@ -26,8 +27,7 @@
 all_files=0
 good_files=0
 for config_file in $dbus_path/system.d/** $dbus_path/session.d/** \
-                   $dbus_path/system.conf $dbus_path/session.conf \
-                   /etc/dbus-1/system.d/*; do
+                   $dbus_path/system.conf $dbus_path/session.conf $etc_path ; do
     [ -d "$config_file" ] && continue # skip directories
     ((++all_files))

Last edited by dogknowsnx (2024-02-03 09:48:19)

seth · 2024-02-03 10:04:21

Thanks for the heads up, see the updated script.
If you run into attributes that should™ work but aren't covered by the dtd, please post them.

I might have to git this

dogknowsnx · 2024-02-03 15:48:46

Typo:

printf " -------\n$good_files or $all_files look ok to me"

?

seth · 2024-02-03 15:54:04

typo…

sekret · 2024-02-07 20:08:01

Never had a problem since the update, but this

$ ./script
/usr/share/dbus-1/system.d/org.kde.k3b.conf - valid
 -------
34 of 34 look ok to me

gives a nice feeling

seth · 2024-02-07 21:05:15

Thanks for testing (not entirely sure whyt the k3b config shows up there)

The stock configs from the repo software should™ all be no problem.
What has shown up so far are some (possibly dated residuals from) AUR packages (some panter launcher thing ships the config as symlink to the service) and user errors (eg. empty files, stale symlinks)
There's no systematic problem where configs are frequently bad, it's just that every slight mistake and oversight gets capital punishment…

Fuxino · 2024-02-08 09:25:23

Is this another false positive?

$ ./dbus-unbreaker.sh

ERROR: /usr/share/dbus-1/system.d/nvidia-dbus.conf does not remotely look like a D-Bus busconfig file
/usr/share/dbus-1/system.d/teamd.conf:5.0: No declaration for attribute own_prefix of element allow
/usr/share/dbus-1/system.d/teamd.conf:9.0: No declaration for attribute own_prefix of element deny

ERROR: 1 file(s) might trip dbus-broker

 -------
33 of 34 look ok to me

File is part of nvidia-utils package.

$ pacman -Qo /usr/share/dbus-1/system.d/nvidia-dbus.conf
/usr/share/dbus-1/system.d/nvidia-dbus.conf is owned by nvidia-utils 545.29.06-3

I have zero issues on my system, btw.

seth · 2024-02-08 09:40:53

The test checks for a very broad (but maybe not enough) doctype pattern

cat /usr/share/dbus-1/system.d/nvidia-dbus.conf

I have zero issues on my system, btw.

Are you using dbus-broker-units?

own_prefix is a false positive (ie. not part of the dtd, but supported by the spec)

Fuxino · 2024-02-08 10:22:16

seth wrote:

cat /usr/share/dbus-1/system.d/nvidia-dbus.conf

$ cat /usr/share/dbus-1/system.d/nvidia-dbus.conf
<busconfig>
  <type>system</type>
  <policy context="default">
    <allow own="nvidia.powerd.server"/>
    <allow send_requested_reply="true" send_type="method_return"/>
    <allow send_requested_reply="true" send_type="error"/>
    <allow receive_requested_reply="true" receive_type="method_return"/>
    <allow receive_requested_reply="true" receive_type="error"/>
    <allow send_destination="nvidia.powerd.server"/>
  </policy>
</busconfig>

seth wrote:

Are you using dbus-broker-units?

Yes, of course, I should have specified it

seth · 2024-02-08 10:28:14

The xml is valid, but it doesn't include any doctype declaration what technically violates the spec, https://dbus.freedesktop.org/doc/dbus-d … ation_file but apparently doesn't bother dbus-broker

I'll adjust the initial test to warn specifically about this but continue w/ the xml checks.

Arch Linux

#1 2024-02-02 18:40:32

dbus-unbreaker | test whether dbus-broker will break the boot

#2 2024-02-03 09:41:02

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#3 2024-02-03 10:04:21

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#4 2024-02-03 15:48:46

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#5 2024-02-03 15:54:04

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#6 2024-02-07 20:08:01

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#7 2024-02-07 21:05:15

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#8 2024-02-08 09:25:23

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#9 2024-02-08 09:40:53

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#10 2024-02-08 10:22:16

Re: dbus-unbreaker | test whether dbus-broker will break the boot

#11 2024-02-08 10:28:14

Re: dbus-unbreaker | test whether dbus-broker will break the boot

Board footer