[gentoo-dev] RFC: virtual/dbus

[gentoo-dev] RFC: virtual/dbus

[Marek Szuba]

[-- Attachment #1.1: Type: text/plain, Size: 581 bytes --]

Dear everyone,

I wonder if we should create a virtual package to allow our users - or 
at least those who run systemd anyway - to choose between sys-apps/dbus 
and sys-apps/dbus-broken as D-Bus implementation for their systems. The 
usual "Gentoo is about choice" thing aside, there is now at least one, 
security-related, problem with the former which can be worked around by 
switching to the latter: https://github.com/systemd/systemd/issues/22737

WDYT?

PS. Cc'ing maintainers of both packages to see what they might have got 
to say about this.

-- 
Marecki

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-dev] Re: RFC: virtual/dbus

[Mike Gilbert]

On Wed, Sep 7, 2022 at 11:56 AM Marek Szuba <marecki@gentoo.org> wrote:
>
> Dear everyone,
>
> I wonder if we should create a virtual package to allow our users - or
> at least those who run systemd anyway - to choose between sys-apps/dbus
> and sys-apps/dbus-broken as D-Bus implementation for their systems. The
> usual "Gentoo is about choice" thing aside, there is now at least one,
> security-related, problem with the former which can be worked around by
> switching to the latter: https://github.com/systemd/systemd/issues/22737
>
> WDYT?

A virtual seems a bit pointless for the following reasons:

1. dbus and dbus-broker can be (and usually are) installed simultaneously.
2. dbus-broker[launcher] utilizes config files installed by dbus, and
actually RDEPENDs on sys-apps/dbus for that reason.
3. Many client applications depend on sys-apps/dbus for libdbus.

If you can think of some way to encourage users to install/enable
dbus-broker, that seems like a good idea to me.

[gentoo-dev] Re: RFC: virtual/dbus

[John Helmert III]

[-- Attachment #1: Type: text/plain, Size: 806 bytes --]

On Wed, Sep 07, 2022 at 04:56:37PM +0100, Marek Szuba wrote:
> Dear everyone,
> 
> I wonder if we should create a virtual package to allow our users - or 
> at least those who run systemd anyway - to choose between sys-apps/dbus 
> and sys-apps/dbus-broken as D-Bus implementation for their systems. The 
> usual "Gentoo is about choice" thing aside, there is now at least one, 
> security-related, problem with the former which can be worked around by 
> switching to the latter: https://github.com/systemd/systemd/issues/22737

If you find a security issue, please file a security bug. I'm not
really sure what the security impact of this is, though.

> WDYT?
> 
> PS. Cc'ing maintainers of both packages to see what they might have got 
> to say about this.
> 
> -- 
> Marecki




[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[gentoo-dev] Re: RFC: virtual/dbus

[Marek Szuba]

[-- Attachment #1.1: Type: text/plain, Size: 652 bytes --]

On 2022-09-07 17:29, Mike Gilbert wrote:

> A virtual seems a bit pointless for the following reasons:
[...]
 > 2. dbus-broker[launcher] utilizes config files installed by dbus, and
 > actually RDEPENDs on sys-apps/dbus for that reason.

Yeah, I failed at reading - even the README of dbus-broker clearly 
states "You still need the dbus reference implementation installed, 
since it provides tools used by many applications, as well as the 
dbus.socket unit file."

> If you can think of some way to encourage users to install/enable
> dbus-broker, that seems like a good idea to me.

Makes sense, I'll think about it.

-- 
Marecki

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Re: RFC: virtual/dbus

[Marek Szuba]

[-- Attachment #1.1: Type: text/plain, Size: 616 bytes --]

On 2022-09-07 17:36, John Helmert III wrote:

> If you find a security issue, please file a security bug. I'm not
> really sure what the security impact of this is, though.

I'm not sure if this is a security issue per se (which is why I 
described it as security-related), here - the default configuration IS 
the more secure one.

 > I'm not really sure what the security impact of this is, though.

The impact is that systemd+dbus-daemon users currently have to disable 
DynamicUser functionality for units communicating over D-Bus in order 
for said communication to actually work.

-- 
Marecki

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] RFC: virtual/dbus

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 1366 bytes --]



> On 7 Sep 2022, at 17:29, Mike Gilbert <floppym@gentoo.org> wrote:
> 
> On Wed, Sep 7, 2022 at 11:56 AM Marek Szuba <marecki@gentoo.org> wrote:
>> 
>> Dear everyone,
>> 
>> I wonder if we should create a virtual package to allow our users - or
>> at least those who run systemd anyway - to choose between sys-apps/dbus
>> and sys-apps/dbus-broken as D-Bus implementation for their systems. The
>> usual "Gentoo is about choice" thing aside, there is now at least one,
>> security-related, problem with the former which can be worked around by
>> switching to the latter: https://github.com/systemd/systemd/issues/22737
>> 
>> WDYT?
> 
> A virtual seems a bit pointless for the following reasons:
> 
> 1. dbus and dbus-broker can be (and usually are) installed simultaneously.
> 2. dbus-broker[launcher] utilizes config files installed by dbus, and
> actually RDEPENDs on sys-apps/dbus for that reason.
> 3. Many client applications depend on sys-apps/dbus for libdbus.

A virtual _might_ have value to add to @system for desktop profiles,
but I'm not sure. The other criticisms remain, of course.

> 
> If you can think of some way to encourage users to install/enable
> dbus-broker, that seems like a good idea to me.
> 

Documentation on the wiki (either on the dbus page, or a new dbus-broker)
explaining how to migrate & its advantages would be most welcome.

[-- Attachment #2: Message signed with OpenPGP --]
[-- Type: application/pgp-signature, Size: 358 bytes --]