dbus-1.2.10 and dbus-

Colin Walters walters at verbum.org
Fri Dec 19 12:39:26 PST 2008

New releases of dbus are available.

Due to a security issue (CVE-2008-4311) for which a large number of
system services need fixes, the dbus 1.2 stable branch has been split
into two streams. The "1.2.4Xpermissive" branch originates from 1.2.4,
and maintains the unintended permissive default for messages. Releases
after 1.2.4 (1.2.6+) have a default deny. It is intended that the
permissive branch only be used temporarily by vendors.  For more
information, see this mail:

Primary stream: http://dbus.freedesktop.org/releases/dbus/dbus-1.2.10.tar.gz
  SHA1: 63088b3443b5fea2df2550fd5827dd514dc31262
Permissive stream:
  SHA1: eefcff01a368717f3a3516ae97856a224930fe70

If you have already changed from 1.2.4 to 1.2.8, then you should
continue with 1.2.10.  My guess is that embedded or other targeted
contexts which only consume a small fixed set of system services could
switch from 1.2.4 to 1.2.10 without much trouble.  General purpose
workstation type OS vendors should probably use 1.2.4permissive for

Bugs fixed:

http://bugs.freedesktop.org/show_bug.cgi?id=19005 - Add system logging
http://bugs.freedesktop.org/show_bug.cgi?id=19060 - System policy cleanup

== Note on new syslog behavior ==

The release will by default log both denied
messages, as well as messages it *would* have denied if the default
policy were deny.  The point of this release is to make it easier to
find and fix broken services.  Here's an example denial:

Dec 19 14:34:09 space-ghost dbus: Would reject message, 1 matched
rules; type="method_call", sender=":1.72" (uid=27 pid=4711
comm="dbus-send --system --print-reply --dest=org.bluez ")
interface="org.bluez.Manager" member="Hello" error name="(unset)"
requested_reply=0 destination="org.bluez" (uid=0 pid=2373
comm="/usr/sbin/bluetoothd "))

This message was sent from "su mysql" to bluez, which is not allowed
because bluez is not at the console.  But - the
release allowed it, logging it.

A regular denial looks like this:

Dec 19 14:17:53 space-ghost dbus: Rejected send message, 1 matched
rules; type="method_return", sender=":1.26" (uid=0 pid=2966
comm="/usr/libexec/nm-dispatcher.action ") interface="(unset)"
member="(unset)" error name="(unset)" requested
_reply=0 destination=":1.18" (uid=0 pid=2806 comm="NetworkManager

This one I see on startup - my current theory is that something in the
dispatcher is sending two replies.  I haven't investigated it closely

If you encounter these messages, first check on this bug:


If the software isn't there, please add it.

More information about the dbus mailing list