Merge ~ogayot/ubuntu/+source/dbus:merge-lp2036180-mantic into ubuntu/+source/dbus:debian/sid

[Olivier Gayot]

Merge of dbus 1.14.10-1 (bug fix only release) from Debian. Upstream changelog:

• Avoid a dbus-daemon crash if re-creating a connection's policy fails.
  If it isn't possible to re-create its policy (for example if it belongs
  to a user account that has been deleted or if the Name Service Switch is
  broken, on a system not supporting SO_PEERGROUPS), we now log a warning,
  continue to use its current policy, and continue to reload other
  connections' policies. (dbus#343; Peter Benie, Simon McVittie)

• If getting the groups from a user ID fails, report the error correctly,
  instead of logging "(null)" (dbus#343, Simon McVittie)

• Return the primary group ID in GetConnectionCredentials()' UnixGroupIDs
  field for processes with a valid-but-empty supplementary group list
  (dbus!422, cptpcrd)

Also includes https://salsa.debian.org/utopia-team/dbus/-/commit/711681d

tags pushed
-----------

* reconstruct, https://git.launchpad.net/~ogayot/ubuntu/+source/dbus/tag/?h=reconstruct/1.14.8-2ubuntu1
* split, https://git.launchpad.net/~ogayot/ubuntu/+source/dbus/tag/?h=split/1.14.8-2ubuntu1
* logical, https://git.launchpad.net/~ogayot/ubuntu/+source/dbus/tag/?h=logical/1.14.8-2ubuntu1

PPA
---

dbus 1.14.10-1ubuntu1~ppa2 is available in the following PPA:

* https://launchpad.net/~ogayot/+archive/ubuntu/mantic-proposed

tests done
----------

* package upgraded from 1.14.8-2ubuntu1
* autopkgtest on amd64 https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-ogayot-mantic-proposed/mantic/amd64/d/dbus/20230915_113716_75665@/log.gz
* package installed on my development machine - no smoke :)

I don't have upload rights and will need sponsorship.

[Jeremy Bícha (jbicha)]

Uploaded

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 82834b1..97f208b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+dbus (1.14.10-1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2036180). Remaining changes:
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (LP #1438612)
+      - Reworked to actually make dbus.service _and_ dbus.socket to not
+        be part of the shutdown transaction. And yet make it possible
+        to still stop/kill/restart dbus.service if one really
+        wants to, because it is stuck and stopped responding to any
+        commands. This allows allows to restart dbus.service with
+        needrestart. However a finalrd hook might still be needed, to kill
+        dbus-daemon for good, once we pivot off rootfs.
+      - Reworked to avoid a deadlock during boot (LP #1936948)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+      - Prevent dbus from being restarted on upgrade (LP #1962036)
+
+ -- Olivier Gayot <[e-mail]>  Fri, 15 Sep 2023 11:42:11 +0200
+
 dbus (1.14.10-1) unstable; urgency=medium
 
   * New upstream stable release
@@ -18,6 +46,36 @@ dbus (1.14.10-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Fri, 01 Sep 2023 15:41:38 +0100
 
+dbus (1.14.8-2ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2027991). Remaining changes:
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (LP: #1438612)
+      - Reworked to actually make dbus.service _and_ dbus.socket to not
+        be part of the shutdown transaction. And yet make it possible
+        to still stop/kill/restart dbus.service if one really
+        wants to, because it is stuck and stopped responding to any
+        commands. This allows allows to restart dbus.service with
+        needrestart. However a finalrd hook might still be needed, to kill
+        dbus-daemon for good, once we pivot off rootfs.
+      - Reworked to avoid a deadlock during boot (LP: #1936948)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+      - Prevent dbus from being restarted on upgrade (LP #1962036)
+  * Removed unnecessary delta:
+    - git configuration changes for Ubuntu (d/gbp.conf, d/.gitignore)
+
+ -- Olivier Gayot <[e-mail]>  Mon, 17 Jul 2023 18:10:48 +0200
+
 dbus (1.14.8-2) unstable; urgency=high
 
   * dbus-daemon.postinst: Stop trying to take DPKG_ROOT into account.
@@ -42,6 +100,42 @@ dbus (1.14.8-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Tue, 06 Jun 2023 15:05:50 +0100
 
+dbus (1.14.6-1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2023301). Remaining changes:
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - Rework ubuntu/dont-stop-dbus.patch to actually make dbus.service _and_
+      dbus.socket to not be part of the shutdown transaction. And yet make
+      it possible to still stop/kill/restart dbus.service if one really
+      wants to, because it is stuck and stopped responding to any
+      commands. This allows allows to restart dbus.service with
+      needrestart. However a finalrd hook might still be needed, to kill
+      dbus-daemon for good, once we pivot off rootfs.
+    - Rework d/p/ubuntu/dont-stop-dbus.patch to avoid a deadlock during boot
+      (LP #1936948)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Prevent dbus from being restarted on upgrade (LP #1962036)
+    - git configuration changes for Ubuntu (d/gbp.conf, d/.gitignore)
+  * Removed obsoleted patches:
+    - d/p/u/concrete-dbus-socket.patch: Add the "real" path used by the apparmor
+      autopkgtest to the apparmor profile in the test
+      [merged upstream in 1.14.6]
+    - d/control: Add M-A: foreign to the new dbus-{session,system}-bus-common
+      packages to permit the resolver to use them to satisfy i386 dependencies
+      [merged in debian in 1.14.6-1]
+
+ -- Olivier Gayot <[e-mail]>  Thu, 08 Jun 2023 17:46:03 +0200
+
 dbus (1.14.6-1) unstable; urgency=medium
 
   * New upstream stable release
@@ -59,6 +153,52 @@ dbus (1.14.6-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Wed, 08 Feb 2023 13:21:47 +0000
 
+dbus (1.14.4-1ubuntu1) lunar; urgency=medium
+
+  * Merge from Debian unstable (LP: #1999258). Remaining changes:
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - Rework ubuntu/dont-stop-dbus.patch to actually make dbus.service _and_
+      dbus.socket to not be part of the shutdown transaction. And yet make it
+      possible to still stop/kill/restart dbus.service if one really wants to,
+      because it is stuck and stopped responding to any commands. This allows
+      allows to restart dbus.service with needrestart. However a finalrd hook
+      might still be needed, to kill dbus-daemon for good, once we pivot off
+      rootfs.
+    - Rework d/p/ubuntu/dont-stop-dbus.patch to avoid a deadlock during boot
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus on
+      demand after package installation.
+    - Prevent dbus from being restarted on upgrade
+    - git configuration changes for Ubuntu (d/gbp.conf, d/.gitignore)
+    - d/control: Add M-A: foreign to the new dbus-{session,system}-bus-common
+      packages to permit the resolver to use them to satisfy i386 dependencies
+  * Removed patches obsoleted/merged by upstream:
+    - Make autopkgtests cross-test-friendly.
+    - SECURITY UPDATE: Assertion failure in dbus-marshal-validate
+      - debian/patches/CVE-2022-42010.patch: Check brackets in signature nest
+        correctly
+      - CVE-2022-42010
+    - SECURITY UPDATE: Out-of-bound access in dbus-marshal-validate
+      - debian/patches/CVE-2022-42011.patch: Validate length of arrays of
+        fixed-length items
+      - CVE-2022-42011
+    - SECURITY UPDATE: Out-of-bound access in dbus-marshal-byteswap
+      - debian/patches/CVE-2022-42012.patch: Byte-swap Unix fd indexes if
+        needed
+      - CVE-2022-42012
+  * d/p/u/concrete-dbus-socket.patch: Add the "real" path used by the apparmor
+    autopkgtest to the apparmor profile in the test
+
+ -- Dave Jones <[e-mail]>  Fri, 09 Dec 2022 15:00:27 +0000
+
 dbus (1.14.4-1) unstable; urgency=high
 
   * New upstream stable release 1.14.4
@@ -81,6 +221,58 @@ dbus (1.14.2-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Mon, 26 Sep 2022 17:09:42 +0100
 
+dbus (1.14.0-2ubuntu3) kinetic; urgency=medium
+
+  * SECURITY UPDATE: Assertion failure in dbus-marshal-validate
+    - debian/patches/CVE-2022-42010.patch: Check brackets in signature nest
+      correctly
+    - CVE-2022-42010
+  * SECURITY UPDATE: Out-of-bound access in dbus-marshal-validate
+    - debian/patches/CVE-2022-42011.patch: Validate length of arrays of
+      fixed-length items
+    - CVE-2022-42011
+  * SECURITY UPDATE: Out-of-bound access in dbus-marshal-byteswap
+    - debian/patches/CVE-2022-42012.patch: Byte-swap Unix fd indexes if needed
+    - CVE-2022-42012
+
+ -- Nishit Majithia <[e-mail]>  TUe, 25 Oct 2022 18:48:42 +0530
+
+dbus (1.14.0-2ubuntu2) kinetic; urgency=medium
+
+  * d/control: Add M-A: foreign to the new dbus-{session,system}-bus-common
+    packages to permit the resolver to use them to satisfy i386 dependencies
+
+ -- Dave Jones <[e-mail]>  Tue, 30 Aug 2022 15:15:24 +0100
+
+dbus (1.14.0-2ubuntu1) kinetic; urgency=medium
+
+  * Merge from Debian unstable (LP: #1959211). Remaining changes:
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - Rework ubuntu/dont-stop-dbus.patch to actually make dbus.service _and_
+      dbus.socket to not be part of the shutdown transaction. And yet make it
+      possible to still stop/kill/restart dbus.service if one really wants to,
+      because it is stuck and stopped responding to any commands. This allows
+      allows to restart dbus.service with needrestart. However a finalrd hook
+      might still be needed, to kill dbus-daemon for good, once we pivot off
+      rootfs.
+    - Rework d/p/ubuntu/dont-stop-dbus.patch to avoid a deadlock during boot
+    - Make autopkgtests cross-test-friendly.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus on
+      demand after package installation.
+    - Prevent dbus from being restarted on upgrade
+    - git configuration changes for Ubuntu (d/gbp.conf, d/.gitignore)
+
+ -- Dave Jones <[e-mail]>  Tue, 23 Aug 2022 15:07:57 +0100
+
 dbus (1.14.0-2) unstable; urgency=medium
 
   * Revert workaround for #994204. Since debhelper 13.7, the workaround
@@ -527,6 +719,51 @@ dbus (1.12.20-3) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Mon, 25 Oct 2021 10:32:43 +0100
 
+dbus (1.12.20-2ubuntu4) jammy; urgency=medium
+
+  * Prevent dbus from being restarted on upgrade (LP: #1962036)
+
+ -- Dave Jones <[e-mail]>  Fri, 01 Apr 2022 18:02:54 +0100
+
+dbus (1.12.20-2ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild to update maintainer scripts, see LP: 1959054
+
+ -- Dave Jones <[e-mail]>  Wed, 16 Feb 2022 16:50:50 +0000
+
+dbus (1.12.20-2ubuntu2) impish; urgency=medium
+
+  * Rework d/p/ubuntu/dont-stop-dbus.patch to avoid a deadlock during boot
+    (LP: #1936948)
+
+ -- Lukas Märdian <[e-mail]>  Thu, 09 Sep 2021 15:45:30 +0200
+
+dbus (1.12.20-2ubuntu1) impish; urgency=medium
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Make autopkgtests cross-test-friendly.
+    - Rework ubuntu/dont-stop-dbus.patch to actually make dbus.service _and_
+      dbus.socket to not be part of the shutdown transaction. And yet make
+      it possible to still stop/kill/restart dbus.service if one really
+      wants to, because it is stuck and stopped responding to any
+      commands. This allows allows to restart dbus.service with
+      needrestart. However a finalrd hook might still be needed, to kill
+      dbus-daemon for good, once we pivot off rootfs.
+
+ -- Balint Reczey <[e-mail]>  Tue, 18 May 2021 10:59:54 +0200
+
 dbus (1.12.20-2) unstable; urgency=medium
 
   * Add Provides for the split binary packages added in experimental.
@@ -542,6 +779,43 @@ dbus (1.12.20-2) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Sun, 21 Feb 2021 14:02:17 +0000
 
+dbus (1.12.20-1ubuntu3) hirsute; urgency=medium
+
+  * Rework ubuntu/dont-stop-dbus.patch to actually make dbus.service _and_
+    dbus.socket to not be part of the shutdown transaction. And yet make
+    it possible to still stop/kill/restart dbus.service if one really
+    wants to, because it is stuck and stopped responding to any
+    commands. This allows allows to restart dbus.service with
+    needrestart. However a finalrd hook might still be needed, to kill
+    dbus-daemon for good, once we pivot off rootfs.
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 26 Feb 2021 19:43:15 +0000
+
+dbus (1.12.20-1ubuntu2) hirsute; urgency=medium
+
+  * No-change rebuild to drop the udeb package.
+
+ -- Matthias Klose <[e-mail]>  Mon, 22 Feb 2021 10:30:40 +0100
+
+dbus (1.12.20-1ubuntu1) groovy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Make autopkgtests cross-test-friendly.
+
+ -- Iain Lane <[e-mail]>  Thu, 10 Sep 2020 12:25:12 +0100
+
 dbus (1.12.20-1) unstable; urgency=medium
 
   [ Mark Hindley ]
@@ -556,6 +830,25 @@ dbus (1.12.20-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Thu, 02 Jul 2020 14:19:21 +0100
 
+dbus (1.12.18-1ubuntu1) groovy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+    - Make autopkgtests cross-test-friendly.
+
+ -- Steve Langasek <[e-mail]>  Tue, 09 Jun 2020 13:55:57 -0700
+
 dbus (1.12.18-1) unstable; urgency=medium
 
   [ Simon McVittie ]
@@ -620,6 +913,33 @@ dbus (1.12.18-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Tue, 02 Jun 2020 19:48:04 +0100
 
+dbus (1.12.16-2ubuntu2) focal; urgency=medium
+
+  * Make autopkgtests cross-test-friendly.
+
+ -- Steve Langasek <[e-mail]>  Fri, 06 Dec 2019 21:22:40 -0800
+
+dbus (1.12.16-2ubuntu1) focal; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+  * Removed patches included in new version:
+    - d/p/0001-auth-Reject-DBUS_COOKIE_SHA1-for-users-other-than-th.patch
+    - d/p/0002-test-Add-basic-test-coverage-for-DBUS_COOKIE_SHA1.patch
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 26 Nov 2019 12:58:43 -0500
+
 dbus (1.12.16-2) unstable; urgency=medium
 
   * Add bug number to previous changelog entry
@@ -653,6 +973,55 @@ dbus (1.12.16-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Sun, 09 Jun 2019 21:34:34 +0100
 
+dbus (1.12.14-1ubuntu2) eoan; urgency=medium
+
+  * SECURITY UPDATE: DBUS_COOKIE_SHA1 implementation flaw
+    - d/p/0001-auth-Reject-DBUS_COOKIE_SHA1-for-users-other-than-th.patch:
+      reject DBUS_COOKIE_SHA1 for users other than the server owner in
+      dbus/dbus-auth.c.
+    - d/p/0002-test-Add-basic-test-coverage-for-DBUS_COOKIE_SHA1.patch:
+      add basic test coverage for DBUS_COOKIE_SHA1 in
+      dbus/dbus-auth-script.c, dbus/dbus-sysdeps-util-unix.c,
+      dbus/dbus-sysdeps-util-win.c, dbus/dbus-sysdeps.h, test/Makefile.am,
+      test/data/auth/cookie-sha1-username.auth-script,
+      test/data/auth/cookie-sha1.auth-script.
+    - CVE-2019-12749
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 11 Jun 2019 13:04:53 -0400
+
+dbus (1.12.14-1ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit.
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+
+ -- Steve Langasek <[e-mail]>  Wed, 22 May 2019 16:41:21 -0700
+
+dbus (1.12.16-1) unstable; urgency=medium
+
+  * New upstream stable release
+    - CVE-2019-12749: Do not attempt to carry out DBUS_COOKIE_SHA1
+      authentication for identities that differ from the user running the
+      DBusServer. Previously, a local attacker could manipulate symbolic
+      links in their own home directory to bypass authentication and
+      connect to a DBusServer with elevated privileges. The standard
+      system and session dbus-daemons in their default configuration were
+      immune to this attack because they did not allow DBUS_COOKIE_SHA1,
+      but third-party users of DBusServer such as Upstart could be
+      vulnerable. (Closes: #930375)
+
+ -- Simon McVittie <[e-mail]>  Sun, 09 Jun 2019 21:34:34 +0100
+
 dbus (1.12.14-1) unstable; urgency=medium
 
   * New upstream release
@@ -666,6 +1035,30 @@ dbus (1.12.14-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Sat, 18 May 2019 17:37:08 +0100
 
+dbus (1.12.12-1ubuntu1) disco; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (see patch header and upstream bug for details). Fixes various
+      causes of shutdown hangs, particularly with remote file systems.
+      (LP: #1438612) (LP: #1540282)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+  * Dropped changes, superseded in Debian:
+    - debian/tests/root: don't set ulimit on containers, since the container
+      may be unprivileged and "root" may not be able to raise ulimits again.
+
+ -- Steve Langasek <[e-mail]>  Thu, 31 Jan 2019 17:47:44 -0800
+
 dbus (1.12.12-1) unstable; urgency=medium
 
   [ Ritesh Raj Sarraf ]
@@ -694,6 +1087,37 @@ dbus (1.12.12-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Tue, 04 Dec 2018 15:58:18 +0000
 
+dbus (1.12.10-1ubuntu2) cosmic; urgency=medium
+
+  * debian/tests/root: don't set ulimit on containers, since the container
+    may be unprivileged and "root" may not be able to raise ulimits again.
+
+ -- Steve Langasek <[e-mail]>  Thu, 06 Sep 2018 03:56:07 +0000
+
+dbus (1.12.10-1ubuntu1) cosmic; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (see patch header and upstream bug for details). Fixes various
+      causes of shutdown hangs, particularly with remote file systems.
+      (LP: #1438612) (LP: #1540282)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+  * Dropped changes, no longer needed:
+    - Clean up /etc/init/dbus.conf on upgrades. This needs to be kept until
+      after 18.04 LTS.
+
+ -- Steve Langasek <[e-mail]>  Fri, 31 Aug 2018 10:29:17 -0700
+
 dbus (1.12.10-1) unstable; urgency=medium
 
   * New upstream release
@@ -782,6 +1206,29 @@ dbus (1.12.4-1) unstable; urgency=medium
 
  -- Simon McVittie <[e-mail]>  Thu, 08 Feb 2018 15:05:57 +0000
 
+dbus (1.12.2-1ubuntu1) bionic; urgency=medium
+
+  * Sync with Debian. Remaining changes:
+    - Clean up /etc/init/dbus.conf on upgrades. This needs to be kept until
+      after 18.04 LTS.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (see patch header and upstream bug for details). Fixes various
+      causes of shutdown hangs, particularly with remote file systems.
+      (LP: #1438612) (LP: #1540282)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+
+ -- Jeremy Bicha <[e-mail]>  Wed, 15 Nov 2017 17:22:22 -0500
+
 dbus (1.12.2-1) unstable; urgency=low
 
   * New upstream release 1.12.2
@@ -803,6 +1250,29 @@ dbus (1.12.2-1) unstable; urgency=low
 
  -- Simon McVittie <[e-mail]>  Mon, 13 Nov 2017 15:36:08 +0000
 
+dbus (1.12.0-1ubuntu1) bionic; urgency=medium
+
+  * Sync with Debian. Remaining changes:
+    - Clean up /etc/init/dbus.conf on upgrades. This needs to be kept until
+      after 18.04 LTS.
+    - Add dont-stop-dbus.patch: Don't stop D-Bus in the service unit
+      (see patch header and upstream bug for details). Fixes various
+      causes of shutdown hangs, particularly with remote file systems.
+      (LP: #1438612) (LP: #1540282)
+    - debian/dbus.postinst, debian/rules: Don't start D-Bus on package
+      installation, as that doesn't work any more with dont-stop-dbus.patch.
+      Instead, start dbus.socket in postinst, which will then start D-Bus
+      on demand after package installation.
+    - Add aa-get-connection-apparmor-security-context.patch: This is not
+      intended for upstream inclusion. It implements a bus method
+      (GetConnectionAppArmorSecurityContext) to get a connection's AppArmor
+      security context but upstream D-Bus has recently added a generic way of
+      getting a connection's security credentials (GetConnectionCredentials).
+      Ubuntu should carry this patch until packages in the archive are moved
+      over to the new, generic method of getting a connection's credentials.
+
+ -- Jeremy Bicha <[e-mail]>  Mon, 30 Oct 2017 19:25:39 -0400
+
 dbus (1.12.0-1) unstable; urgency=medium
 
   * New upstream stable release 1.12.0
@@ -2712,7 +3182,6 @@ dbus (1.1.1-2) UNRELEASED; urgency=low
 
  -- Michael Biebl <[e-mail]>  Wed, 27 Jun 2007 01:42:38 +0200
 
-
 dbus (1.1.1-1) unstable; urgency=low
 
   [ Michael Biebl ]
@@ -3022,8 +3491,6 @@ dbus (0.62-2) unstable; urgency=low
 
  -- Sjoerd Simons <[e-mail]>  Wed, 21 Jun 2006 10:47:00 +0200
 
-
-
 dbus (0.62-1) unstable; urgency=low
 
   * New upstream release
diff --git a/debian/control b/debian/control
index 1d3b701..b24aaa5 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: dbus
 Section: admin
 Priority: optional
-Maintainer: Utopia Maintenance Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Utopia Maintenance Team <[e-mail]>
 Uploaders:
  Sjoerd Simons <[e-mail]>,
  Sebastian Dröge <[e-mail]>,
diff --git a/debian/dbus.postinst b/debian/dbus.postinst
index 1cfd5e1..dd04aff 100644
--- a/debian/dbus.postinst
+++ b/debian/dbus.postinst
@@ -70,4 +70,9 @@ if [ -z "${DPKG_ROOT:-}" ] && [ "$1" = configure ] && [ -n "$2" ]; then
     reload_dbus_config
 fi
 
+# We don't start dbus.service in postinst, so ensure dbus.socket is running
+if [ "$1" = configure ] && [ -d /run/systemd/system ]; then
+    systemctl try-restart sockets.target || true
+fi
+
 # vim:set sw=4 sts=4 et:
diff --git a/debian/patches/series b/debian/patches/series
index b926ef8..edf7b82 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,3 @@
 debian/tests-Multiply-timeouts-by-20-on-riscv64.patch
+ubuntu/aa-get-connection-apparmor-security-context.patch
+ubuntu/dont-stop-dbus.patch
diff --git a/debian/patches/ubuntu/aa-get-connection-apparmor-security-context.patch b/debian/patches/ubuntu/aa-get-connection-apparmor-security-context.patch
new file mode 100644
index 0000000..4c897ae
--- /dev/null
+++ b/debian/patches/ubuntu/aa-get-connection-apparmor-security-context.patch
@@ -0,0 +1,192 @@
+From: Tyler Hicks <[e-mail]>
+Date: Fri, 15 Aug 2014 13:37:15 -0500
+Subject: Add DBus method to return the AA context of a connection
+
+Allows the AppArmor label that is attached to a D-Bus connection to be
+queried using the unique connection name.
+
+For example,
+$ dbus-send --print-reply --system --dest=org.freedesktop.DBus \
+   /org/freedesktop/DBus \
+   org.freedesktop.DBus.GetConnectionAppArmorSecurityContext string::1.4
+ method return sender=org.freedesktop.DBus -> dest=:1.50 reply_serial=2
+    string "/usr/sbin/cupsd"
+
+[Altered by Simon McVittie: survive non-UTF-8 contexts which
+would otherwise be a local denial of service, except that Ubuntu
+inherits a non-fatal warnings patch from Debian; new commit message
+taken from the Ubuntu changelog; do not emit unreachable code if
+AppArmor is disabled.]
+
+22 July 2023 Updates from ogayot
+
+This method has been deprecated for a while now but some packages in Ubuntu
+still use it. See LP #1489489
+
+Forwarded: not-needed
+---
+ bus/apparmor.c       | 15 +++++++++
+ bus/apparmor.h       |  1 +
+ bus/driver.c         | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++++
+ dbus/dbus-protocol.h |  2 ++
+ 4 files changed, 108 insertions(+)
+
+diff --git a/bus/apparmor.c b/bus/apparmor.c
+index 985f5e9..2eba37b 100644
+--- a/bus/apparmor.c
++++ b/bus/apparmor.c
+@@ -502,6 +502,21 @@ bus_apparmor_enabled (void)
+ #endif
+ }
+ 
++const char*
++bus_apparmor_confinement_get_label (BusAppArmorConfinement *confinement)
++{
++#ifdef HAVE_APPARMOR
++  if (!apparmor_enabled)
++    return NULL;
++
++  _dbus_assert (confinement != NULL);
++
++  return confinement->label;
++#else
++  return NULL;
++#endif
++}
++
+ void
+ bus_apparmor_confinement_unref (BusAppArmorConfinement *confinement)
+ {
+diff --git a/bus/apparmor.h b/bus/apparmor.h
+index ed465f7..b8146df 100644
+--- a/bus/apparmor.h
++++ b/bus/apparmor.h
+@@ -38,6 +38,7 @@ dbus_bool_t bus_apparmor_enabled (void);
+ 
+ void bus_apparmor_confinement_unref (BusAppArmorConfinement *confinement);
+ void bus_apparmor_confinement_ref (BusAppArmorConfinement *confinement);
++const char* bus_apparmor_confinement_get_label (BusAppArmorConfinement *confinement);
+ BusAppArmorConfinement* bus_apparmor_init_connection_confinement (DBusConnection *connection,
+                                                                   DBusError      *error);
+ 
+diff --git a/bus/driver.c b/bus/driver.c
+index cd0a714..d1669cb 100644
+--- a/bus/driver.c
++++ b/bus/driver.c
+@@ -2005,6 +2005,91 @@ bus_driver_handle_get_connection_credentials (DBusConnection *connection,
+   return FALSE;
+ }
+ 
++static dbus_bool_t
++bus_driver_handle_get_connection_apparmor_security_context (DBusConnection *connection,
++                                                            BusTransaction *transaction,
++                                                            DBusMessage    *message,
++                                                            DBusError      *error)
++{
++  const char *service;
++  DBusString str;
++  BusRegistry *registry;
++  BusService *serv;
++  DBusConnection *primary_connection;
++  DBusMessage *reply;
++  BusAppArmorConfinement *confinement;
++  const char *label;
++
++  _DBUS_ASSERT_ERROR_IS_CLEAR (error);
++
++  registry = bus_connection_get_registry (connection);
++
++  service = NULL;
++  reply = NULL;
++  confinement = NULL;
++
++  if (! dbus_message_get_args (message, error, DBUS_TYPE_STRING, &service,
++                               DBUS_TYPE_INVALID))
++      goto failed;
++
++  _dbus_verbose ("asked for security context of connection %s\n", service);
++
++  _dbus_string_init_const (&str, service);
++  serv = bus_registry_lookup (registry, &str);
++  if (serv == NULL)
++    {
++      dbus_set_error (error,
++                      DBUS_ERROR_NAME_HAS_NO_OWNER,
++                      "Could not get security context of name '%s': no such name", service);
++      goto failed;
++    }
++
++  primary_connection = bus_service_get_primary_owners_connection (serv);
++
++  reply = dbus_message_new_method_return (message);
++  if (reply == NULL)
++    goto oom;
++
++  confinement = bus_connection_dup_apparmor_confinement (primary_connection);
++  label = bus_apparmor_confinement_get_label (confinement);
++
++  if (label == NULL)
++    {
++      dbus_set_error (error,
++                      DBUS_ERROR_APPARMOR_SECURITY_CONTEXT_UNKNOWN,
++                      "Could not determine security context for '%s'", service);
++      goto failed;
++    }
++
++  if (!dbus_validate_utf8 (label, error))
++    goto failed;
++
++  if (! dbus_message_append_args (reply,
++                                  DBUS_TYPE_STRING,
++                                  &label,
++                                  DBUS_TYPE_INVALID))
++    goto failed;
++
++  if (! bus_transaction_send_from_driver (transaction, connection, reply))
++    goto oom;
++
++  bus_apparmor_confinement_unref (confinement);
++  dbus_message_unref (reply);
++
++  return TRUE;
++
++ oom:
++  BUS_SET_OOM (error);
++
++ failed:
++  _DBUS_ASSERT_ERROR_IS_SET (error);
++  if (confinement)
++    bus_apparmor_confinement_unref (confinement);
++  if (reply)
++    dbus_message_unref (reply);
++  return FALSE;
++}
++
+ static dbus_bool_t
+ bus_driver_handle_reload_config (DBusConnection *connection,
+ 				 BusTransaction *transaction,
+@@ -2479,6 +2564,11 @@ static const MessageHandler dbus_message_handlers[] = {
+     DBUS_TYPE_ARRAY_AS_STRING DBUS_TYPE_BYTE_AS_STRING,
+     bus_driver_handle_get_connection_selinux_security_context,
+     METHOD_FLAG_ANY_PATH },
++  { "GetConnectionAppArmorSecurityContext",
++    DBUS_TYPE_STRING_AS_STRING,
++    DBUS_TYPE_STRING_AS_STRING,
++    bus_driver_handle_get_connection_apparmor_security_context,
++    METHOD_FLAG_ANY_PATH },
+   { "ReloadConfig",
+     "",
+     "",
+diff --git a/dbus/dbus-protocol.h b/dbus/dbus-protocol.h
+index 933c365..2b7fd23 100644
+--- a/dbus/dbus-protocol.h
++++ b/dbus/dbus-protocol.h
+@@ -444,6 +444,8 @@ extern "C" {
+ #define DBUS_ERROR_INVALID_FILE_CONTENT       "org.freedesktop.DBus.Error.InvalidFileContent"
+ /** Asked for SELinux security context and it wasn't available. */
+ #define DBUS_ERROR_SELINUX_SECURITY_CONTEXT_UNKNOWN    "org.freedesktop.DBus.Error.SELinuxSecurityContextUnknown"
++/** Asked for AppArmor security context and it wasn't available. */
++#define DBUS_ERROR_APPARMOR_SECURITY_CONTEXT_UNKNOWN   "org.freedesktop.DBus.Error.AppArmorSecurityContextUnknown"
+ /** Asked for ADT audit data and it wasn't available. */
+ #define DBUS_ERROR_ADT_AUDIT_DATA_UNKNOWN     "org.freedesktop.DBus.Error.AdtAuditDataUnknown"
+ /** There's already an object with the requested object path. */
diff --git a/debian/patches/ubuntu/dont-stop-dbus.patch b/debian/patches/ubuntu/dont-stop-dbus.patch
new file mode 100644
index 0000000..0313060
--- /dev/null
+++ b/debian/patches/ubuntu/dont-stop-dbus.patch
@@ -0,0 +1,98 @@
+From: Martin Pitt <[e-mail]>
+Date: Tue, 31 Mar 2015 18:46:06 +0200
+Subject: Don't stop D-Bus in the service unit
+
+D-Bus is getting stopped too early during shutdown, so that services on the bus
+are still running (and being shut down) after that. This leads to shutdown
+hangs due to remote file systems not getting unmounted as wpa_supplicant is
+already gone, or avahi or NetworkManager getting lots of errors because they
+get disconnected, etc.  As D-Bus does not keep its state between restarts,
+dbus.socket also does not help us.
+
+Also, stopping D-Bus in a running system isn't something which we ever
+supported; to the contrary, we patched several packages to avoid
+restarting/stopping D-Bus in postinsts, as stopping d-bus in a running system
+is shooting yourself into the foot (independent of which init system you use).
+Thus leaving D-Bus running until the bitter end should be fine, it doesn't have
+any file system things to do on shutdown. This also approximates the brave new
+kdbus world where d-bus is basically "always available".
+
+Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89847
+Bug-Ubuntu: https://launchpad.net/bugs/1438612
+
+26 Feb 2021 Updates from xnox
+
+Whilst the original patch was okish, it didn't actually work
+right. dbus.service had Requires dbus.socket, which in turn did not
+try refuse being stopped, thus socket was being stopped / going away
+whilst the dbus service is still running. Also that happened on
+shutdown. And sometimes dbus can hang and refuses to answer, in such
+cases it is best to let people be able to kill it and restart it. Plus
+with needrestart integration we kind of can restart dbus and some
+basic services to keep machine alive. So, to actually prevent dbus
+from being stopped on shutdown undo the previous incarnation of the
+patch and instead do this:
+
+Dependencies:
+* Add DefaultDependencies=no
+* Instead of Requires/After sysinit.target, add back Wants/After sysinit.target.
+* Add back After basic.target
+* Do not add back Conflicts/Before shutdown.target
+
+Do that for _both_ dbus.service and dbus.socket.
+
+dbus.service:
+* Drop the Killmode, ExecStop things
+* Make ExecStart be @/usr/bin/dbus-daemon @dbus-daemon .... thus it
+  will now be survie systemd-shutdown kill spree
+
+End result is that now one can use $ sudo
+/etc/needrestart/restart.d/dbus.service to restart dbus, and yet it is
+not part of the shutdown transactions.
+
+09 Sep 2021 Updates from slyon
+
+The previous update made it be not part of the shutdown transaction, but
+introduced a deadlock during bootup like this:
+
+  systemd[1]: basic.target: starting held back, waiting for: sockets.target
+  systemd[1]: dbus.socket: starting held back, waiting for: basic.target
+  systemd[1]: dbus.service: starting held back, waiting for: dbus.socket
+
+Therefore we need to remove the After=basic.target dependency of dbus.socket
+to break that dependency loop.
+
+---
+ bus/dbus.service.in | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/bus/dbus.service.in
++++ b/bus/dbus.service.in
+@@ -2,10 +2,14 @@
+ Description=D-Bus System Message Bus
+ Documentation=man:dbus-daemon(1)
+ Requires=dbus.socket
++# Do not stop on shutdown
++DefaultDependencies=no
++Wants=sysinit.target
++After=sysinit.target basic.target
+ 
+ [Service]
+ Type=notify
+ NotifyAccess=main
+-ExecStart=@EXPANDED_BINDIR@/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
++ExecStart=@@EXPANDED_BINDIR@/dbus-daemon @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
+ ExecReload=@EXPANDED_BINDIR@/dbus-send --print-reply --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig
+ OOMScoreAdjust=-900
+--- a/bus/dbus.socket.in
++++ b/bus/dbus.socket.in
+@@ -1,5 +1,9 @@
+ [Unit]
+ Description=D-Bus System Message Bus Socket
++# Do not stop on shutdown
++DefaultDependencies=no
++Wants=sysinit.target
++After=sysinit.target
+ 
+ [Socket]
+ ListenStream=@DBUS_SYSTEM_SOCKET@
diff --git a/debian/rules b/debian/rules
index 16f76c8..59aab5e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -254,11 +254,10 @@ endif
 override_dh_missing:
 	dh_missing $(dh_missing_options)
 
-# Yes, we do need both --no- options here. https://bugs.debian.org/837528
 override_dh_installinit:
-	dh_installinit -pdbus --no-stop-on-upgrade --no-restart-after-upgrade
+	dh_installinit -pdbus --no-start --no-stop-on-upgrade
 override_dh_installsystemd:
-	dh_installsystemd -pdbus --no-stop-on-upgrade --no-restart-after-upgrade
+	dh_installsystemd -pdbus --no-start --no-stop-on-upgrade
 
 override_dh_installdocs:
 	dh_installdocs --all AUTHORS NEWS README