Merge lp:~jamesodhunt/upstart/disable-system-bus into lp:upstart

[Dimitri John Ledkov]

* init/control.c: Typo.
* init/main.c: Add '--no-dbus' command-line option.
  init/man/init.8: Added '--no-dbus' option.

This option has the effect of stopping Session Inits having access to system-level events for those systems which require such behaviour; in such environments, even if the upstart-event-bridge is running, no events will (can) be proxied from the system level.

A side-effect of booting with '--no-dbus' is that a non-priv user will be unable to query system jobs using initctl (since such users will not have access to the private socket). However, for those making use of '--no-dbus', such behaviour would be deemed a security advantage rather than a limitation.

[Stéphane Graber (stgraber)]

The code looks good to me, we should just add one test to confirm that upstart with --disable-dbus won't do anything on SIGUSR1.

[James Hunt (jamesodhunt)]

Hi Stéphane - new tests added.

review: Needs Resubmitting

=== modified file 'ChangeLog'
--- ChangeLog	2013-11-04 11:43:30 +0000
+++ ChangeLog	2013-11-04 12:41:33 +0000
@@ -1,3 +1,4 @@
+<<<<<<< TREE
 2013-11-03  James Hunt  <[e-mail]>
 
 	* init/job_class.c:
@@ -197,6 +198,16 @@
 	    startup".
 	  - Adjusted expected shutdown times.
 
+=======
[phone]  James Hunt  <[e-mail]>
+
+	* init/control.c: Typo.
+	* init/main.c: Add '--no-dbus' command-line option.
+	  init/man/init.8: Added '--no-dbus' option.
+	* util/tests/test_initctl.c: test_no_dbus(): New test
+	  to test '--no-dbus' option.
+
+>>>>>>> MERGE-SOURCE
 2013-09-12  Steve Langasek  <[e-mail]>
 
 	* configure.ac:

=== modified file 'init/control.c'
=== modified file 'init/main.c'
--- init/main.c	2013-11-04 11:43:30 +0000
+++ init/main.c	2013-11-04 12:41:33 +0000
@@ -120,6 +120,14 @@
  **/
 static int disable_startup_event = FALSE;
 
+/**
+ * disable_dbus:
+ *
+ * If TRUE, do not connect to a D-Bus bus
+ * (only connect to the private socket).
+ **/
+static int disable_dbus = FALSE;
+
 extern int          no_inherit_env;
 extern int          user_mode;
 extern int          disable_sessions;
@@ -143,6 +151,9 @@
 	{ 0, "default-console", N_("default value for console stanza"),
 		NULL, "VALUE", NULL, console_type_setter },
 
+	{ 0, "no-dbus", N_("do not connect to a D-Bus bus"),
+		NULL, NULL, &disable_dbus, NULL },
+
 	{ 0, "no-inherit-env", N_("jobs will not inherit environment of init"),
 		NULL, NULL, &no_inherit_env , NULL },
 
@@ -608,16 +619,21 @@
 	 * fail (since dbus-daemon probably isn't running yet) and will try again
 	 * later - don't let ENOMEM stop us though.
 	 */
-	while (control_bus_open () < 0) {
-		NihError *err;
-		int       number;
-
-		err = nih_error_get ();
-		number = err->number;
-		nih_free (err);
-
-		if (number != ENOMEM)
-			break;
+	if (disable_dbus) {
+		nih_info (_("Not connecting to %s bus"),
+				use_session_bus ? "session" : "system");
+	} else {
+		while (control_bus_open () < 0) {
+			NihError *err;
+			int       number;
+
+			err = nih_error_get ();
+			number = err->number;
+			nih_free (err);
+
+			if (number != ENOMEM)
+				break;
+		}
 	}
 
 #ifndef DEBUG
@@ -948,9 +964,16 @@
 usr1_handler (void      *data,
 	      NihSignal *signal)
 {
+<<<<<<< TREE
 	nih_assert (! user_mode);
 
+=======
+	if (disable_dbus)
+		return;
+
+>>>>>>> MERGE-SOURCE
 	if (! control_bus) {
+<<<<<<< TREE
 		char *dbus_bus_name;
 
 		dbus_bus_name = dbus_bus_type == DBUS_BUS_SESSION
@@ -958,6 +981,10 @@
 
 		nih_info (_("Reconnecting to D-Bus %s bus"),
 				dbus_bus_name);
+=======
+		nih_info (_("Reconnecting to %s bus"),
+				use_session_bus ? "session" : "system");
+>>>>>>> MERGE-SOURCE
 
 		if (control_bus_open () < 0) {
 			NihError *err;

=== modified file 'init/man/init.8'
--- init/man/init.8	2013-04-02 10:19:07 +0000
+++ init/man/init.8	2013-11-04 12:41:33 +0000
@@ -84,6 +84,10 @@
 .BR console "."
 .\"
 .TP
+.B \-\-no\-dbus
+Do not connect to a D-Bus bus.
+.\"
+.TP
 .B \-\-no\-inherit\-env
 Stop jobs from inheriting the initial environment. Only meaningful when
 running in user mode.

=== modified file 'util/tests/test_initctl.c'
--- util/tests/test_initctl.c	2013-11-04 11:43:30 +0000
+++ util/tests/test_initctl.c	2013-11-04 12:41:33 +0000
@@ -11121,6 +11121,69 @@
 }
 
 void
+test_no_dbus (void)
+{
+	nih_local char  *cmd = NULL;
+	char           **output;
+	size_t           lines;
+	pid_t            upstart_pid = 0;
+	pid_t            dbus_pid = 0;
+	char            *extra[] = { "--no-dbus", NULL };
+
+	TEST_GROUP ("Test '--no-dbus'");
+
+	TEST_DBUS (dbus_pid);
+
+	/*******************************************************************/
+	/* First perform a sanity check */
+
+	TEST_FEATURE ("Ensure version can be queried normally");
+
+	start_upstart_common (&upstart_pid, FALSE, NULL, NULL, NULL);
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+	TEST_EQ (lines, 1);
+	TEST_STR_MATCH (output[0], "init*(upstart [0-9]*");
+	nih_free (output);
+
+	STOP_UPSTART (upstart_pid);
+
+	/*******************************************************************/
+	/* Now, try with dbus disabled */
+
+	TEST_FEATURE ("Ensure '--no-dbus' disables D-Bus");
+
+	start_upstart_common (&upstart_pid, FALSE, NULL, NULL, extra);
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+
+	/* No output on stdout expected */
+	TEST_EQ (lines, 0);
+
+	/*******************************************************************/
+	TEST_FEATURE ("Ensure D-Bus still disabled on SIGUSR1");
+
+	assert0 (kill (upstart_pid, SIGUSR1));
+
+	cmd = nih_sprintf (NULL, "%s version 2>/dev/null", get_initctl ());
+	TEST_NE_P (cmd, NULL);
+	RUN_COMMAND (NULL, cmd, &output, &lines);
+
+	/* No output on stdout expected */
+	TEST_EQ (lines, 0);
+
+	STOP_UPSTART (upstart_pid);
+
+	/*******************************************************************/
+
+	TEST_DBUS_END (dbus_pid);
+}
+
+void
 test_quiesce (void)
 {
 	char                      confdir[PATH_MAX];
@@ -17028,7 +17091,11 @@
 	test_reexec ();
 	test_list_sessions ();
 	test_quiesce ();
+<<<<<<< TREE
 	test_umask ();
+=======
+	test_no_dbus ();
+>>>>>>> MERGE-SOURCE
 
 	if (in_chroot () && !dbus_configured ()) {
 		fprintf(stderr, "\n\n"