<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10px"><div dir="ltr" id="yui_3_16_0_ym19_1_1460476845484_58919"><span id="yui_3_16_0_ym19_1_1460476845484_58918">Thank you for the quick response. The issues you point out are concerns for us but we have not found a solution. We will explore limiting our system to rely only on session bus for now.</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460476845484_58917"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1460476845484_58916">Cheers,</div><div dir="ltr" id="yui_3_16_0_ym19_1_1460476845484_58915">Yiyang</div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 10px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font size="2" face="Arial"> On Tuesday, April 12, 2016 10:48 AM, Simon McVittie <simon.mcvittie@collabora.co.uk> wrote:<br></font></div> <br><br> <div class="y_msg_container">On 12/04/16 17:16, Yiyang Fei wrote:<br clear="none">> I want to use DBUS as a Windows service because we are building a<br clear="none">> cross-platform application that will use DBUS as the primary IPC<br clear="none">> solution. A critical part of our application runs as a service before<br clear="none">> users log in, which is why we need the DBUS to also be available as a<br clear="none">> Windows service.<br clear="none"><br clear="none">From the information you've given, I can only give general responses - I<br clear="none">don't know what your application does, or what it needs. It is possible<br clear="none">that the D-Bus protocol and/or the dbus-daemon implementation of that<br clear="none">protocol are not suitable for your requirements.<br clear="none"><br clear="none">D-Bus on Windows is not treated as a security boundary, and in<br clear="none">particular the reference implementation and the authentication protocols<br clear="none">used have not been audited for multi-user safety (which would be<br clear="none">necessary for an equivalent of the well-known system bus on Unix). If<br clear="none">you want to use it in a multi-user way, you will have to take<br clear="none">responsibility for putting together a design that meets your security<br clear="none">requirements, whatever those are. The authentication protocol that is<br clear="none">normally used on Unix relies on AF_UNIX sockets with<br clear="none">credentials-passing, which are very much Unix-specific; we are not aware<br clear="none">of a way to do the same thing on Windows.<br clear="none"><br clear="none">As I said on the bug you referenced, we don't and shouldn't support a<br clear="none">general-purpose system bus on Windows unless we can get it to a<br clear="none">sufficiently high-quality state that it is secure, both in terms of<br clear="none">"users cannot impersonate other users" and "users cannot crash the<br clear="none">dbus-daemon or make it execute arbitrary code". If you contribute<br clear="none">patches to make this possible, those are the key things I will be<br clear="none">looking for during review.<br clear="none"><br clear="none">If your specific application has weaker requirements than the more<br clear="none">general system bus, then you may be able to put together something<br clear="none">simpler that meets your requirements, but first you need to define what<br clear="none">those requirements are.<br clear="none"><br clear="none">As a consequence of the system bus being unsupported on Windows, our<br clear="none">policy at the moment is that we do not generally treat Windows-specific<br clear="none">bugs as security vulnerabilities, even if we would treat an equivalent<br clear="none">Unix-specific bug as a security vulnerability (embargoes, CVE IDs,<br clear="none">security-fix releases and so on).<div class="yqt1093808084" id="yqtfd39912"><br clear="none"><br clear="none">> The most recent information I found is from 2013<br clear="none">> <a shape="rect" href="https://bugs.freedesktop.org/show_bug.cgi?id=68741" target="_blank">https://bugs.freedesktop.org/show_bug.cgi?id=68741 </a>and pertained to<br clear="none">> v1.5. Does anyone know if this has been fixed in v1.10.x and how to<br clear="none">> configure the daemon to run as a service?</div><br clear="none"><br clear="none">If you compare the source code of 2013 D-Bus with the source code of<br clear="none">2016 D-Bus, you will find that this has not been worked on. If you<br clear="none">require this feature, you will need to implement it (or use a different<br clear="none">protocol).<br clear="none"><br clear="none">-- <br clear="none">Simon McVittie<br clear="none">Collabora Ltd. <<a shape="rect" href="http://www.collabora.com/" target="_blank">http://www.collabora.com/</a>><br clear="none"><br clear="none">_______________________________________________<br clear="none">dbus mailing list<br clear="none"><a shape="rect" ymailto="mailto:dbus@lists.freedesktop.org" href="mailto:dbus@lists.freedesktop.org">dbus@lists.freedesktop.org</a><br clear="none"><a shape="rect" href="https://lists.freedesktop.org/mailman/listinfo/dbus" target="_blank">https://lists.freedesktop.org/mailman/listinfo/dbus</a><div class="yqt1093808084" id="yqtfd70511"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>