rpms/dbus-broker
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI dbus-broker-28-9.el9_8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-31 11:03:00 -04:00
parent 98ba77a99e
commit e9a77967d0
3 changed files with 141 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
SOURCES/aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde.patch Normal file
View File

@ -0,0 +1,87 @@
From c773e46910569608f62c3b7eff044fdac09c0c13 Mon Sep 17 00:00:00 2001
From: David Rheinsberg <david@readahead.eu>
Date: Wed, 24 Jun 2026 11:52:23 +0200
Subject: [PATCH] broker/main: bump RLIMIT_NOFILE to hard limit
Ensure that we can allocate enough FDs to serve the limits configured by
the system. Bump NOFILE to the hard-limit set for us.
Reported-by: Josh Simmons <josh@nega.tv>
Signed-off-by: David Rheinsberg <david@readahead.eu>
(cherry picked from commit aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde)
---
src/broker/main.c | 5 +++++
src/util/misc.c | 20 ++++++++++++++++++++
src/util/misc.h | 1 +
3 files changed, 26 insertions(+)
diff --git a/src/broker/main.c b/src/broker/main.c
index 292b2bb..327f5a2 100644
--- a/src/broker/main.c
+++ b/src/broker/main.c
@@ -13,6 +13,7 @@
#include "broker/main.h"
#include "util/audit.h"
#include "util/error.h"
+#include "util/misc.h"
#include "util/selinux.h"
#include "util/string.h"
@@ -247,6 +248,10 @@ static int setup(void) {
if (r < 0)
return error_origin(-errno);
+ r = util_bump_nofile();
+ if (r < 0)
+ return error_fold(r);
+
return 0;
}
diff --git a/src/util/misc.c b/src/util/misc.c
index c0206db..e99ac49 100644
--- a/src/util/misc.c
+++ b/src/util/misc.c
@@ -7,6 +7,7 @@
#include <c-stdaux.h>
#include <grp.h>
#include <stdlib.h>
+#include <sys/resource.h>
#include <unistd.h>
#include "util/error.h"
#include "util/misc.h"
@@ -46,3 +47,22 @@ int util_drop_permissions(uint32_t uid, uint32_t gid) {
return 0;
}
+
+int util_bump_nofile(void) {
+ struct rlimit rl;
+ int r;
+
+ r = getrlimit(RLIMIT_NOFILE, &rl);
+ if (r < 0)
+ return error_origin(-errno);
+
+ if (rl.rlim_cur < rl.rlim_max) {
+ rl.rlim_cur = rl.rlim_max;
+
+ r = setrlimit(RLIMIT_NOFILE, &rl);
+ if (r < 0)
+ return error_origin(-errno);
+ }
+
+ return 0;
+}
diff --git a/src/util/misc.h b/src/util/misc.h
index 47eda00..f5b04bd 100644
--- a/src/util/misc.h
+++ b/src/util/misc.h
@@ -9,3 +9,4 @@
uint64_t util_umul64_saturating(uint64_t a, uint64_t b);
int util_drop_permissions(uint32_t uid, uint32_t gid);
+int util_bump_nofile(void);
--
2.55.0

35
SOURCES/c4a3c886366f7bd566ec9a55b3855ade8290fa17.patch Normal file
View File

@ -0,0 +1,35 @@
From 345269e6ab95bb17bcaffd886789791df85aa74c Mon Sep 17 00:00:00 2001
From: David Rheinsberg <david@readahead.eu>
Date: Wed, 24 Jun 2026 11:33:35 +0200
Subject: [PATCH] bus/peer: account peer-pidfd on peers
Ensure that pidfds are properly accounted on a peer. They represent
internal resources a peer pins, so it better be accounted on them.
Note that we do not strictly account each and every pinned byte and
other resource, but grant peers some leeway, as long as it is fixed in
size. However, for file-descriptors, being a bit more strict seems like
a good decision.
Signed-off-by: David Rheinsberg <david@readahead.eu>
(cherry picked from commit c4a3c886366f7bd566ec9a55b3855ade8290fa17)
---
src/bus/peer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/bus/peer.c b/src/bus/peer.c
index ce4584c..f71b13a 100644
--- a/src/bus/peer.c
+++ b/src/bus/peer.c
@@ -260,7 +260,7 @@ int peer_new_with_fd(Peer **peerp,
_c_cleanup_(c_freep) gid_t *gids = NULL;
_c_cleanup_(c_freep) char *seclabel = NULL;
CRBNode **slot, *parent;
- size_t n_seclabel, n_gids = 0;
+ size_t n_fds, n_seclabel, n_gids = 0;
struct ucred ucred;
socklen_t socklen = sizeof(ucred);
int r;
--
2.55.0

34
SPECS/dbus-broker.spec
View File

@ -2,7 +2,7 @@
Name: dbus-broker
Version: 28
Release: 7%{?dist}
Release: 9%{?dist}
Summary: Linux D-Bus Message Broker
License: ASL 2.0
URL: https://github.com/bus1/dbus-broker
@ -12,6 +12,8 @@ Patch0001: https://github.com/bus1/dbus-broker/commit/b82b670bfec6600
Patch0002: cve-2022-31212.patch
Patch0003: cve-2022-31213.patch
Patch0004: https://github.com/bus1/dbus-broker/commit/33e0595b1c7cf8fa0e7ca3a353f4380c1307dc25.patch
Patch0005: https://github.com/bus1/dbus-broker/commit/aaa9fd6bbc2d5d7bfeca039f9c457b7f88a50dde.patch
Patch0006: https://github.com/bus1/dbus-broker/commit/c4a3c886366f7bd566ec9a55b3855ade8290fa17.patch
%{?systemd_requires}
BuildRequires: pkgconfig(audit)
BuildRequires: pkgconfig(expat)
@ -25,7 +27,6 @@ BuildRequires: glibc-devel
BuildRequires: meson
BuildRequires: python3-docutils
Requires: dbus-common
Requires(pre): shadow-utils
Requires(post): /usr/bin/systemctl
# for triggerpostun
Requires: /usr/bin/systemctl
@ -40,6 +41,11 @@ recent Linux kernel releases.
%prep
%autosetup -p1
# Create a sysusers.d config file
cat >dbus-broker.sysusers.conf <<EOF
u dbus %{dbus_user_id} 'System Message Bus' - -
EOF
%build
%meson -Dselinux=true -Daudit=true -Ddocs=true -Dsystem-console-users=gdm -Dlinux-4-17=true
%meson_build
@ -47,21 +53,11 @@ recent Linux kernel releases.
%install
%meson_install
install -m0644 -D dbus-broker.sysusers.conf %{buildroot}%{_sysusersdir}/dbus-broker.conf
%check
%meson_test
%pre
# create dbus user and group
getent group dbus >/dev/null || groupadd -f -g %{dbus_user_id} -r dbus
if ! getent passwd dbus >/dev/null ; then
if ! getent passwd %{dbus_user_id} >/dev/null ; then
useradd -r -u %{dbus_user_id} -g %{dbus_user_id} -d '/' -s /sbin/nologin -c "System message bus" dbus
else
useradd -r -g %{dbus_user_id} -d '/' -s /sbin/nologin -c "System message bus" dbus
fi
fi
exit 0
%post
%systemd_post dbus-broker.service
%systemd_user_post dbus-broker.service
@ -96,8 +92,17 @@ fi
%{_mandir}/man1/dbus-broker-launch.1*
%{_unitdir}/dbus-broker.service
%{_userunitdir}/dbus-broker.service
%{_sysusersdir}/dbus-broker.conf
%changelog
* Tue Aug 11 2026 Siteshwar Vashisht <svashisht@redhat.com> - 28-9
- Fix session bus denial of service via EMFILE during peer setup.
Resolves: RHEL-233014
* Mon Sep 22 2025 Lukas Nykryn <lnykryn@redhat.com> - 28-8
- Switch from useradd to systemd sysusers
Resolves: RHEL-109036
* Mon Aug 22 2022 Frantisek Sumsal <fsumsal@redhat.com> - 28-7
- Add coverage for CVE-2022-31213 and other config-file-related issues
Related: CVE-2022-31213
@ -314,4 +319,3 @@ Resolves: CVE-2022-31213
* Sun Aug 13 2017 Tom Gundersen <teg@jklm.no> - 1-1
- Initial RPM release