import UBI dbus-broker-36-5.el10_2

aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde.patch

@@ -0,0 +1,87 @@
+From 8c42f4a9ea5c716819714a0bef787d19ea1310c3 Mon Sep 17 00:00:00 2001
+From: David Rheinsberg <david@readahead.eu>
+Date: Wed, 24 Jun 2026 11:52:23 +0200
+Subject: [PATCH] broker/main: bump RLIMIT_NOFILE to hard limit
+
+Ensure that we can allocate enough FDs to serve the limits configured by
+the system. Bump NOFILE to the hard-limit set for us.
+
+Reported-by: Josh Simmons <josh@nega.tv>
+Signed-off-by: David Rheinsberg <david@readahead.eu>
+(cherry picked from commit aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde)
+---
+ src/broker/main.c |  5 +++++
+ src/util/misc.c   | 20 ++++++++++++++++++++
+ src/util/misc.h   |  1 +
+ 3 files changed, 26 insertions(+)
+
+diff --git a/src/broker/main.c b/src/broker/main.c
+index 292b2bb..327f5a2 100644
+--- a/src/broker/main.c
++++ b/src/broker/main.c
+@@ -13,6 +13,7 @@
+ #include "broker/main.h"
+ #include "util/audit.h"
+ #include "util/error.h"
++#include "util/misc.h"
+ #include "util/selinux.h"
+ #include "util/string.h"
+ 
+@@ -247,6 +248,10 @@ static int setup(void) {
+         if (r < 0)
+                 return error_origin(-errno);
+ 
++        r = util_bump_nofile();
++        if (r < 0)
++                return error_fold(r);
++
+         return 0;
+ }
+ 
+diff --git a/src/util/misc.c b/src/util/misc.c
+index a505caf..d7bea0b 100644
+--- a/src/util/misc.c
++++ b/src/util/misc.c
+@@ -8,6 +8,7 @@
+ #include <fcntl.h>
+ #include <grp.h>
+ #include <stdlib.h>
++#include <sys/resource.h>
+ #include <sys/stat.h>
+ #include <unistd.h>
+ #include "util/error.h"
+@@ -218,3 +219,22 @@ int util_drop_permissions(uint32_t uid, uint32_t gid) {
+ 
+         return 0;
+ }
++
++int util_bump_nofile(void) {
++        struct rlimit rl;
++        int r;
++
++        r = getrlimit(RLIMIT_NOFILE, &rl);
++        if (r < 0)
++                return error_origin(-errno);
++
++        if (rl.rlim_cur < rl.rlim_max) {
++                rl.rlim_cur = rl.rlim_max;
++
++                r = setrlimit(RLIMIT_NOFILE, &rl);
++                if (r < 0)
++                        return error_origin(-errno);
++        }
++
++        return 0;
++}
+diff --git a/src/util/misc.h b/src/util/misc.h
+index ee33c13..92bfee3 100644
+--- a/src/util/misc.h
++++ b/src/util/misc.h
+@@ -26,3 +26,4 @@ int misc_memfd_get_seals(int fd);
+ 
+ uint64_t util_umul64_saturating(uint64_t a, uint64_t b);
+ int util_drop_permissions(uint32_t uid, uint32_t gid);
++int util_bump_nofile(void);
+-- 
+2.55.0
+

c4a3c886366f7bd566ec9a55b3855ade8290fa17.patch

@@ -0,0 +1,46 @@
+From 3b9e477bb8d7b48dea97439e5ae41e9cfed11852 Mon Sep 17 00:00:00 2001
+From: David Rheinsberg <david@readahead.eu>
+Date: Wed, 24 Jun 2026 11:33:35 +0200
+Subject: [PATCH] bus/peer: account peer-pidfd on peers
+
+Ensure that pidfds are properly accounted on a peer. They represent
+internal resources a peer pins, so it better be accounted on them.
+
+Note that we do not strictly account each and every pinned byte and
+other resource, but grant peers some leeway, as long as it is fixed in
+size. However, for file-descriptors, being a bit more strict seems like
+a good decision.
+
+Signed-off-by: David Rheinsberg <david@readahead.eu>
+(cherry picked from commit c4a3c886366f7bd566ec9a55b3855ade8290fa17)
+---
+ src/bus/peer.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/bus/peer.c b/src/bus/peer.c
+index 9d64d78..4ac0938 100644
+--- a/src/bus/peer.c
++++ b/src/bus/peer.c
+@@ -261,7 +261,7 @@ int peer_new_with_fd(Peer **peerp,
+         _c_cleanup_(c_freep) char *seclabel = NULL;
+         _c_cleanup_(c_closep) int pid_fd = -1;
+         CRBNode **slot, *parent;
+-        size_t n_seclabel, n_gids = 0;
++        size_t n_fds, n_seclabel, n_gids = 0;
+         struct ucred ucred;
+         socklen_t socklen = sizeof(ucred);
+         int r;
+@@ -310,8 +310,9 @@ int peer_new_with_fd(Peer **peerp,
+         seclabel = NULL;
+         peer->n_seclabel = n_seclabel;
+ 
++        n_fds = 1 + !!(peer->pid_fd >= 0);
+         r = user_charge(peer->user, &peer->charges[0], NULL, USER_SLOT_BYTES, sizeof(Peer));
+-        r = r ?: user_charge(peer->user, &peer->charges[1], NULL, USER_SLOT_FDS, 1);
++        r = r ?: user_charge(peer->user, &peer->charges[1], NULL, USER_SLOT_FDS, n_fds);
+         r = r ?: user_charge(peer->user, &peer->charges[2], NULL, USER_SLOT_OBJECTS, 1);
+         if (r) {
+                 if (r == USER_E_QUOTA)
+-- 
+2.55.0
+

dbus-broker.spec

@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.6.5)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 4;
+    release_number = 5;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -17,7 +17,9 @@ Summary:              Linux D-Bus Message Broker
 License:              Apache-2.0 AND LGPL-2.0-or-later AND LGPL-2.1-or-later AND (Apache-2.0 OR LGPL-2.1-or-later)
 URL:                  https://github.com/bus1/dbus-broker
 Source0:              https://github.com/bus1/dbus-broker/releases/download/v%{version}/dbus-broker-%{version}.tar.xz
-Patch:                https://github.com/bus1/dbus-broker/commit/4b1d9da51dc2703b7596243cb555a689bb27b4c1.patch
+Patch0:               https://github.com/bus1/dbus-broker/commit/4b1d9da51dc2703b7596243cb555a689bb27b4c1.patch
+Patch1:               https://github.com/bus1/dbus-broker/commit/aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde.patch
+Patch2:               https://github.com/bus1/dbus-broker/commit/c4a3c886366f7bd566ec9a55b3855ade8290fa17.patch
 
 BuildRequires:        pkgconfig(audit)
 BuildRequires:        pkgconfig(expat)
@@ -97,6 +99,9 @@ fi
 
 %changelog
 ## START: Generated by rpmautospec
+* Tue Aug 11 2026 Siteshwar Vashisht <svashisht@redhat.com> - 36-5
+- Fix session bus denial of service via EMFILE during peer setup.
+
 * Thu Aug 14 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 36-4
 - Change dbus user GECOS to avoid warning