Security considerations in PolicyKit-enabled daemons

[Richard Hughes]

2009/7/14 David Zeuthen <david at fubar.dk>:
> It's also worth remembering that the system bus daemon, in the default
> install, does throttling and limits, see the <limit> directive in the
> dbus-daemon(1) man page. It _probably_ means that you don't have to
> worry about Denial Of Service at all in your service, that was the
> rationale for adding these features to the bus daemon anyway (e.g. solve
> the DoS problem in the bus daemon instead of doing it in each and every
> system service). But it's definitely worth thinking about anyway.

Right, this limits the number of connections and the amount of data,
but isn't really context sensitive enough for PackageKit. Even in 2048
bytes of data, we can do a resolve of
"a;b;c;d;e;f;g;h;i;j;k;l;m;n;o;p;q;r;s;u;v;w;x;y;z;a;b;c..." which is
going to take the backend quite some time to process. That's why we
put limits on the number of packages and the number of search entries
in one transaction.

Richard.