Merge lp:~jamesodhunt/upstart/disable-system-bus into lp:upstart

[James Hunt]

* init/control.c: Typo.
* init/main.c: Add '--no-dbus' command-line option.
  init/man/init.8: Added '--no-dbus' option.

This option has the effect of stopping Session Inits having access to system-level events for those systems which require such behaviour; in such environments, even if the upstart-event-bridge is running, no events will (can) be proxied from the system level.

A side-effect of booting with '--no-dbus' is that a non-priv user will be unable to query system jobs using initctl (since such users will not have access to the private socket). However, for those making use of '--no-dbus', such behaviour would be deemed a security advantage rather than a limitation.

[Stéphane Graber (stgraber)]

The code looks good to me, we should just add one test to confirm that upstart with --disable-dbus won't do anything on SIGUSR1.

[lp:~jamesodhunt/upstart/disable-system-bus]

1535. By James Hunt on 2013-09-19

* util/tests/test_initctl.c: test_no_dbus(): New test to test
  '--no-dbus' option.

1536. By James Hunt on 2013-09-19

* util/tests/test_initctl.c: test_no_dbus(): Added explicit test for
  SIGUSR1 handling.

[James Hunt (jamesodhunt)]

Hi Stéphane - new tests added.

review: Needs Resubmitting

Unmerged revisions

=== modified file 'ChangeLog'
--- ChangeLog	2013-09-13 04:44:55 +0000
+++ ChangeLog	2013-09-19 20:37:08 +0000
@@ -1,3 +1,11 @@
[phone]  James Hunt  <[e-mail]>
+
+	* init/control.c: Typo.
+	* init/main.c: Add '--no-dbus' command-line option.
+	  init/man/init.8: Added '--no-dbus' option.
+	* util/tests/test_initctl.c: test_no_dbus(): New test
+	  to test '--no-dbus' option.
+
 2013-09-12  Steve Langasek  <[e-mail]>
 
 	* configure.ac:

=== modified file 'init/control.c'
--- init/control.c	2013-04-22 10:30:09 +0000
+++ init/control.c	2013-09-19 20:37:08 +0000
@@ -260,7 +260,7 @@
 
 	control_handle_bus_type ();
 
-	/* Connect to the D-Bus System Bus and hook everything up into
+	/* Connect to the appropriate D-Bus bus and hook everything up into
 	 * our own main loop automatically.
 	 */
 	conn = nih_dbus_bus (use_session_bus ? DBUS_BUS_SESSION : DBUS_BUS_SYSTEM,

=== modified file 'init/main.c'
--- init/main.c	2013-07-31 09:28:48 +0000
+++ init/main.c	2013-09-19 20:37:08 +0000
@@ -120,6 +120,14 @@
  **/
 static int disable_startup_event = FALSE;
 
+/**
+ * disable_dbus:
+ *
+ * If TRUE, do not connect to a D-Bus bus
+ * (only connect to the private socket).
+ **/
+static int disable_dbus = FALSE;
+
 extern int          no_inherit_env;
 extern int          user_mode;
 extern int          disable_sessions;
@@ -142,6 +150,9 @@
 	{ 0, "default-console", N_("default value for console stanza"),
 		NULL, "VALUE", NULL, console_type_setter },
 
+	{ 0, "no-dbus", N_("do not connect to a D-Bus bus"),
+		NULL, NULL, &disable_dbus, NULL },
+
 	{ 0, "no-inherit-env", N_("jobs will not inherit environment of init"),
 		NULL, NULL, &no_inherit_env ,NULL },
 
@@ -592,16 +603,21 @@
 	 * fail (since dbus-daemon probably isn't running yet) and will try again
 	 * later - don't let ENOMEM stop us though.
 	 */
-	while (control_bus_open () < 0) {
-		NihError *err;
-		int       number;
-
-		err = nih_error_get ();
-		number = err->number;
-		nih_free (err);
-
-		if (number != ENOMEM)
-			break;
+	if (disable_dbus) {
+		nih_info (_("Not connecting to %s bus"),
+				use_session_bus ? "session" : "system");
+	} else {
+		while (control_bus_open () < 0) {
+			NihError *err;
+			int       number;
+
+			err = nih_error_get ();
+			number = err->number;
+			nih_free (err);
+
+			if (number != ENOMEM)
+				break;
+		}
 	}
 
 #ifndef DEBUG
@@ -932,8 +948,12 @@
 usr1_handler (void      *data,
 	      NihSignal *signal)
 {
+	if (disable_dbus)
+		return;
+
 	if (! control_bus) {
-		nih_info (_("Reconnecting to system bus"));
+		nih_info (_("Reconnecting to %s bus"),
+				use_session_bus ? "session" : "system");
 
 		if (control_bus_open () < 0) {
 			NihError *err;

=== modified file 'init/man/init.8'
--- init/man/init.8	2013-04-02 10:19:07 +0000
+++ init/man/init.8	2013-09-19 20:37:08 +0000
@@ -84,6 +84,10 @@
 .BR console "."
 .\"
 .TP
+.B \-\-no\-dbus
+Do not connect to a D-Bus bus.
+.\"
+.TP
 .B \-\-no\-inherit\-env
 Stop jobs from inheriting the initial environment. Only meaningful when
 running in user mode.

=== modified file 'util/tests/test_initctl.c'
--- util/tests/test_initctl.c	2013-09-05 16:19:06 +0000
+++ util/tests/test_initctl.c	2013-09-19 20:37:08 +0000
@@ -11121,6 +11121,69 @@
 }
 
 void
+test_no_dbus (void)
+{
+	nih_local char  *cmd = NULL;
+	char           **output;
+	size_t           lines;
+	pid_t            upstart_pid = 0;
+	pid_t            dbus_pid = 0;
+	char            *extra[] = { "--no-dbus", NULL };
+
+	TEST_GROUP ("Test '--no-dbus'");
+
+	TEST_DBUS (dbus_pid);
+
+	/*******************************************************************/
+	/* First perform a sanity check */
+
+	TEST_FEATURE ("Ensure version can be queried normally");
+
+	start_upstart_common (&upstart_pid, FALSE, NULL, NULL, NULL);
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+	TEST_EQ (lines, 1);
+	TEST_STR_MATCH (output[0], "init*(upstart [0-9]*");
+	nih_free (output);
+
+	STOP_UPSTART (upstart_pid);
+
+	/*******************************************************************/
+	/* Now, try with dbus disabled */
+
+	TEST_FEATURE ("Ensure '--no-dbus' disables D-Bus");
+
+	start_upstart_common (&upstart_pid, FALSE, NULL, NULL, extra);
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+
+	/* No output on stdout expected */
+	TEST_EQ (lines, 0);
+
+	/*******************************************************************/
+	TEST_FEATURE ("Ensure D-Bus still disabled on SIGUSR1");
+
+	assert0 (kill (upstart_pid, SIGUSR1));
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+
+	/* No output on stdout expected */
+	TEST_EQ (lines, 0);
+
+	STOP_UPSTART (upstart_pid);
+
+	/*******************************************************************/
+
+	TEST_DBUS_END (dbus_pid);
+}
+
+void
 test_quiesce (void)
 {
 	char                      confdir[PATH_MAX];
@@ -16684,6 +16747,7 @@
 	test_reexec ();
 	test_list_sessions ();
 	test_quiesce ();
+	test_no_dbus ();
 
 	if (in_chroot () && !dbus_configured ()) {
 		fprintf(stderr, "\n\n"