nikon/tuned
1
0
Fork 0
Code Activity Actions

Lower permissions for plugin info dbus interfaces

Browse source 
As these interfaces allow loading and thus executing code from plugins
the default permission policy is lowered from:
yes:yes:yes
to
auth_admin:auth_admin:yes
So only users logged into the X server are allowed to use this interface
without extra root/admin authentication.

This was found by security review by Matthias Gerstner
<matthias.gerstner@suse.com>

Also see:
https://github.com/redhat-performance/tuned/issues/180
This commit is contained in:
Thomas Renninger 2019-05-03 13:13:38 +02:00
parent 2f05df2675
commit cfbeb8e67e
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
com.redhat.tuned.policy
View file

@ -181,8 +181,8 @@
<description>Get plugins which Tuned daemon can acces</description>
<message>Authentication is required to get Tuned plugins</message>
<defaults>
<allow_any>yes</allow_any>
<allow_inactive>yes</allow_inactive>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
@ -191,8 +191,8 @@
<description>Get documentation of tuned plugin</description>
<message>Authentication is required to get documentation of tuned plugin</message>
<defaults>
<allow_any>yes</allow_any>
<allow_inactive>yes</allow_inactive>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>
@ -201,8 +201,8 @@
<description>Get hints for parameters of Tuned plugin</description>
<message>Authentication is required to get hints for parameters of Tuned plugin</message>
<defaults>
<allow_any>yes</allow_any>
<allow_inactive>yes</allow_inactive>
<allow_any>auth_admin</allow_any>
<allow_inactive>auth_admin</allow_inactive>
<allow_active>yes</allow_active>
</defaults>
</action>