iio-sensor-proxy: Insecure configuration of dbus service

[Jeremy Bícha]

The dbus configuration for iio-sensor-proxy allowed any process on the system bus to send an org.freedesktop.DBus.Properties.Set() call to any other process on the system bus, even if the destination process expected to be only accessible by root.

https://github.com/hadess/iio-sensor-proxy/commit/e2d81f2

This was fixed in the upstream version 2.1
and in Debian's 2.0-4 (which was autosynced to zesty).

Test Case
=========
dbus-send --system --dest=org.freedesktop.nm_dispatcher --type=method_call \
    --print-reply / org.freedesktop.DBus.Properties.Set string:Foo variant:string:bar

Bad response:
Error org.freedesktop.DBus.Error.UnknownMethod: No such interface
 'org.freedesktop.DBus.Properties' on object at path /

Good response:
Error org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 2 matched  rules; type="method_call", sender=":1.5523" (uid=1000 pid=13527
 comm="dbus-send --system --dest=org.freedesktop.nm_dispa")
 interface="org.freedesktop.DBus.Properties" member="Set" error
 name="(unset)" requested_reply="0"
 destination="org.freedesktop.nm_dispatcher" (uid=0 pid=13528
 comm="/usr/lib/NetworkManager/nm-dispatcher ")

Testing Done
============
I built the packages in my PPA and installed to Ubuntu GNOME 16.04.2 and 16.10. The test cases completed successfully after install; no log out required.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs in comments 1 and 2. Packages are building now and will be released as security updates. Thanks!

[Marc Deslauriers (mdeslaur)]

Actually, while the xenial debdiff does look good, the package is failing to build properly. The binary package ends up with the following files:

 drwxr-xr-x root/root 0 2017-02-28 07:44 ./rules.d/
 -rw-r--r-- root/root 381 2017-02-28 07:44 ./rules.d/40-iio-sensor-proxy.rules

Instead of what is expected:

 drwxr-xr-x root/root 0 2015-08-14 13:14 ./lib/udev/
 drwxr-xr-x root/root 0 2015-08-14 13:14 ./lib/udev/rules.d/
 -rw-r--r-- root/root 381 2015-08-14 13:14 ./lib/udev/rules.d/40-iio-sensor-proxy.rules

Could you please submit a fixed debdiff? Thanks.

[Marc Deslauriers (mdeslaur)]

Actually, never mind, simply adding udev to the Build-Depends solved the issue, so I'm uploading it now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package iio-sensor-proxy - 1.3-1ubuntu2

---------------
iio-sensor-proxy (1.3-1ubuntu2) yakkety-security; urgency=medium

   * SECURITY UPDATE: insecure dbus configuration (LP: #1666358)
    - debian/patches/iio-dbus-policy-security.patch:
      Patch from Debian, applied upstream. Restrict send_destination
      to "net.hadess.SensorProxy" in net.hadess.SensorProxy.conf

 -- Jeremy Bicha <email address hidden> Mon, 20 Feb 2017 21:17:39 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package iio-sensor-proxy - 1.1-1ubuntu1

---------------
iio-sensor-proxy (1.1-1ubuntu1) xenial-security; urgency=medium

  [ Jeremy Bicha ]
  * SECURITY UPDATE: insecure dbus configuration (LP: #1666358)
    - debian/patches/iio-dbus-policy-security.patch:
      Patch from Debian, applied upstream. Restrict send_destination
      to "net.hadess.SensorProxy" in net.hadess.SensorProxy.conf

  [ Marc Deslauriers ]
  * debian/control: added udev to Build-Depends.

 -- Marc Deslauriers <email address hidden> Tue, 28 Feb 2017 07:55:12 -0500