[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1037194: bookworm-pu: package dbus/1.14.8-1~deb12u1



Package: release.debian.org
Severity: normal
Tags: bookworm
User: release.debian.org@packages.debian.org
Usertags: pu
X-Debbugs-Cc: dbus@packages.debian.org, debian-boot@lists.debian.org
Control: affects -1 + src:dbus

[ Reason ]
Fix a local denial of service for which the security team does not intend
to do a DSA (dbus#457, #1037151; CVE assignment pending).

[ Impact ]
While a sysadmin is using `dbus-monitor --system` or similar tools,
an unprivileged local user can cause denial of service by crashing the
`dbus-daemon --system`.

The new upstream release also fixes some smaller bugs:
- minor memory leaks if malloc() returns NULL
- interop with non-Debian compilers
- a documentation typo

The packaging also makes dbus-daemon and dbus-bin correctly Multi-Arch:
foreign, like the larger dbus package already was, which is useful in
some cross-compiling scenarios (#1033056). I can revert this if you want,
but it seems like a low-risk and useful change to sneak into 12.1.

[ Tests ]
Build-time tests and autopkgtests pass. There is new test coverage for the
denial of service, which was able to reproduce the bug. I also smoke-tested
this on a GNOME virtual machine, and I'll be uploading to unstable to get
wider user testing as soon as the trixie cycle opens.

I avoided uploading to unstable right now because one of dbus' udebs
is included in the installer - although as far as I can see, it's only
an enabler for a feature that never happened (a11y in the graphical
installer), and isn't actually practically useful.

[ Risks ]
It's a key package, so any regressions would be highly visible.

Technically dbus has udebs, although as noted above they are not directly
useful for anything.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
      - the debdiff is for what I'll upload to unstable, for bookworm
        it'll get a new 1.14.8-1~deb12u1 changelog entry at the top
  [ ] the issue is verified as fixed in unstable
      - intentionally not done yet due to the full freeze

[ Changes ]
d/control: let dbus-bin:amd64 satisfy Depends: dbus-bin from a non-amd64
    package, and the same for dbus-daemon, to help with cross-compiling
bus/connection.c: fix the denial of service, #1037151
dbus/dbus-connection{.c,-internal.h}: enablers for #1037151
dbus/dbus-internals.h: interop with non-gcc compilers
dbus/dbus-*-win.c: interop with non-gcc compilers, not compiled on Debian
dbus/dbus-message.c: fix minor memory leaks if out-of-memory
doc/dbus-api-design.duck: fix a typo in some sample code, not functionally
    significant
AUTHORS, NEWS, configure.ac: release administrivia
test/data, test/monitor.c: reproducer for the denial of service bug

[ Other info ]
I'm the de facto upstream release manager for dbus, and I intend to keep
1.14.x suitable for Debian security updates and stable point releases
throughout the non-LTS lifetime of Debian 12, the same as I did for
older branches for the last few years.

After the packaging in unstable diverges from what's appropriate for
stable, I'll do the stable updates as 1.14.x-0+deb12u1, similar to how
we handled 1.12.x in buster and bullseye.

Please let me know if any of the changes are considered inappropriate.

    smcv
debdiff *.dsc | filterdiff -p1 -xaminclude_static.am -xMakefile.in -x'*/Makefile.in' -xconfigure

diffstat for dbus-1.14.6 dbus-1.14.8

 AUTHORS                                         |    9 ++
 Makefile.in                                     |    2 
 NEWS                                            |   29 ++++++++
 aminclude_static.am                             |    2 
 bus/Makefile.in                                 |    2 
 bus/connection.c                                |   15 ++++
 cmake/DBus1ConfigVersion.cmake                  |    2 
 configure                                       |   26 +++----
 configure.ac                                    |    4 -
 dbus/Makefile.in                                |    2 
 dbus/dbus-connection-internal.h                 |    2 
 dbus/dbus-connection.c                          |   11 ++-
 dbus/dbus-internals.h                           |    2 
 dbus/dbus-message.c                             |   12 ++-
 dbus/dbus-spawn-win.c                           |    8 +-
 dbus/dbus-sysdeps-win.c                         |    4 -
 debian/changelog                                |   14 ++++
 debian/control                                  |    2 
 doc/dbus-api-design.duck                        |    4 -
 test/Makefile.in                                |    2 
 test/data/valid-config-files/forbidding.conf.in |    3 
 test/monitor.c                                  |   84 +++++++++++++++++++++---
 22 files changed, 197 insertions(+), 44 deletions(-)

diff -Nru dbus-1.14.6/AUTHORS dbus-1.14.8/AUTHORS
--- dbus-1.14.6/AUTHORS	2022-10-05 11:03:53.000000000 +0100
+++ dbus-1.14.8/AUTHORS	2023-06-06 14:00:36.000000000 +0100
@@ -15,6 +15,7 @@
 Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
 Arun Raghavan <arun.raghavan@collabora.co.uk>
 Aurelien Jarno <aurel32@debian.org>
+Barnabás Pőcze <pobrn@protonmail.com>
 Benedikt Heine <bebe@bebehei.de>
 Benjamin Reed <rangerrick@befunk.com>
 Bertrand SIMONNET <bsimonnet@chromium.org>
@@ -46,6 +47,7 @@
 Daniel Reed <djr@redhat.com>
 Daniel Wendt <daniel.wendt@linux.com>
 Dan Williams <dcbw@redhat.com>
+Dave Jones <dave.jones@canonical.com>
 Dave Reisner <dreisner@archlinux.org>
 David King <dking@redhat.com>
 David Redondo <kde@david-redondo.de>
@@ -58,6 +60,7 @@
 Dmitri Iouchtchenko <johnnyspoon@gmail.com>
 DreamNik <dreamnik@mail.ru>
 Eamon Walsh <ewalsh@tycho.nsa.gov>
+Evgeny Vereshchagin <evvers@ya.ru>
 eXeC001er <execooler@gmail.com>
 Federico Mena Quintero <federico@novell.com>
 Felipe Franciosi <felipe@nutanix.com>
@@ -75,6 +78,7 @@
 Havoc Pennington <hp@pobox.com>
 Havoc Pennington <hp@redhat.com>
 Hendrik Buschmeier <hbuschme@TechFak.Uni-Bielefeld.DE>
+hongjinghao <q1204531485@163.com>
 hyeric <eric.hyer@diehl.com>
 ilovezfs <ilovezfs@icloud.com>
 Ioan-Adrian Ratiu <adrian.ratiu@ni.com>
@@ -90,6 +94,7 @@
 Jean-Louis Fuchs <jean-louis.fuchs@adfinis-sygroup.ch>
 Jens Granseuer <jensgr@gmx.net>
 Jérémie Dimino <jeremie@dimino.org>
+Jeremi Piotrowski <jpiotrowski@microsoft.com>
 Jesper Dam <jalf@medical-insight.com>
 Jiří Klimeš <jklimes@redhat.com>
 Joe Marcus Clarke <marcus@freedesktop.org>
@@ -104,7 +109,9 @@
 Jon Trowbridge <trow@ximian.com>
 Julien Schueller <schueller@phimeca.com>
 Justin Lee <justinlee5455@gmail.com>
+Kai A. Hiller <V02460@gmail.com>
 Kay Sievers <kay.sievers@vrfy.org>
+Khem Raj <raj.khem@gmail.com>
 Kimmo Hämäläinen <kimmo.hamalainen@nokia.com>
 Kir Kolyshkin <kolyshkin@gmail.com>
 Kjartan Maraas <kmaraas@gnome.org>
@@ -126,6 +133,7 @@
 Marc Brockschmidt <he@debian.org>
 Marc Mutz <marc@kdab.net>
 Marc Mutz <marc.mutz@kdab.com>
+Marco Trevisan (Treviño) <mail@3v1n0.net>
 Marcus Brinkmann <marcus.brinkmann@ruhr-uni-bochum.de>
 Mark Brand <mabrand@mabrand.nl>
 Mark McLoughlin <mark@skynet.ie>
@@ -236,6 +244,7 @@
 Wulf C. Krueger <philantrop@exherbo.org>
 Xan Lopez <xan@gnome.org>
 Yaakov Selkowitz <yselkowitz@users.sourceforge.net>
+Yen-Chin, Lee <coldnew.tw@gmail.com>
 Yiyang Fei <YiYang.Fei@barco.com>
 Zack Rusin <zack@kde.org>
 Zeeshan Ali <zeenix@gmail.com>
diff -Nru dbus-1.14.6/bus/connection.c dbus-1.14.8/bus/connection.c
--- dbus-1.14.6/bus/connection.c	2022-10-02 15:06:53.000000000 +0100
+++ dbus-1.14.8/bus/connection.c	2023-06-06 14:00:36.000000000 +0100
@@ -2374,6 +2374,21 @@
   if (!dbus_message_set_sender (message, DBUS_SERVICE_DBUS))
     return FALSE;
 
+  /* Make sure the message has a non-zero serial number, otherwise
+   * bus_transaction_capture_error_reply() will not be able to mock up
+   * a corresponding reply for it. Normally this would be delayed until
+   * the first time we actually send the message out from a
+   * connection, when the transaction is committed, but that's too late
+   * in this case.
+   */
+  if (dbus_message_get_serial (message) == 0)
+    {
+      dbus_uint32_t next_serial;
+
+      next_serial = _dbus_connection_get_next_client_serial (connection);
+      dbus_message_set_serial (message, next_serial);
+    }
+
   if (bus_connection_is_active (connection))
     {
       if (!dbus_message_set_destination (message,
diff -Nru dbus-1.14.6/cmake/DBus1ConfigVersion.cmake dbus-1.14.8/cmake/DBus1ConfigVersion.cmake
--- dbus-1.14.6/cmake/DBus1ConfigVersion.cmake	2023-02-08 12:04:29.000000000 +0000
+++ dbus-1.14.8/cmake/DBus1ConfigVersion.cmake	2023-06-06 14:02:14.000000000 +0100
@@ -1,4 +1,4 @@
-set(PACKAGE_VERSION 1.14.6)
+set(PACKAGE_VERSION 1.14.8)
 
 # Check whether the requested PACKAGE_FIND_VERSION is compatible
 if("${PACKAGE_VERSION}" VERSION_LESS "${PACKAGE_FIND_VERSION}")
diff -Nru dbus-1.14.6/configure.ac dbus-1.14.8/configure.ac
--- dbus-1.14.6/configure.ac	2023-02-08 12:04:12.000000000 +0000
+++ dbus-1.14.8/configure.ac	2023-06-06 14:00:36.000000000 +0100
@@ -3,7 +3,7 @@
 
 m4_define([dbus_major_version], [1])
 m4_define([dbus_minor_version], [14])
-m4_define([dbus_micro_version], [6])
+m4_define([dbus_micro_version], [8])
 m4_define([dbus_version],
           [dbus_major_version.dbus_minor_version.dbus_micro_version])
 AC_INIT([dbus], [dbus_version], [https://gitlab.freedesktop.org/dbus/dbus/issues], [dbus])
@@ -42,7 +42,7 @@
 
 ## increment any time the source changes; set to
 ##  0 if you increment CURRENT
-LT_REVISION=2
+LT_REVISION=3
 
 ## increment if any interfaces have been added; set to 0
 ## if any interfaces have been changed or removed. removal has
diff -Nru dbus-1.14.6/dbus/dbus-connection.c dbus-1.14.8/dbus/dbus-connection.c
--- dbus-1.14.6/dbus/dbus-connection.c	2023-01-30 09:57:39.000000000 +0000
+++ dbus-1.14.8/dbus/dbus-connection.c	2023-06-06 14:00:36.000000000 +0100
@@ -1459,7 +1459,16 @@
     _dbus_connection_last_unref (connection);
 }
 
-static dbus_uint32_t
+/**
+ * Allocate and return the next non-zero serial number for outgoing messages.
+ *
+ * This method is only valid to call from single-threaded code, such as
+ * the dbus-daemon, or with the connection lock held.
+ *
+ * @param connection the connection
+ * @returns A suitable serial number for the next message to be sent on the connection.
+ */
+dbus_uint32_t
 _dbus_connection_get_next_client_serial (DBusConnection *connection)
 {
   dbus_uint32_t serial;
diff -Nru dbus-1.14.6/dbus/dbus-connection-internal.h dbus-1.14.8/dbus/dbus-connection-internal.h
--- dbus-1.14.6/dbus/dbus-connection-internal.h	2023-01-30 09:57:39.000000000 +0000
+++ dbus-1.14.8/dbus/dbus-connection-internal.h	2023-06-06 14:00:36.000000000 +0100
@@ -55,6 +55,8 @@
 DBusConnection *  _dbus_connection_ref_unlocked                (DBusConnection     *connection);
 DBUS_PRIVATE_EXPORT
 void              _dbus_connection_unref_unlocked              (DBusConnection     *connection);
+DBUS_PRIVATE_EXPORT
+dbus_uint32_t     _dbus_connection_get_next_client_serial      (DBusConnection *connection);
 void              _dbus_connection_queue_received_message_link (DBusConnection     *connection,
                                                                 DBusList           *link);
 dbus_bool_t       _dbus_connection_has_messages_to_send_unlocked (DBusConnection     *connection);
diff -Nru dbus-1.14.6/dbus/dbus-internals.h dbus-1.14.8/dbus/dbus-internals.h
--- dbus-1.14.6/dbus/dbus-internals.h	2023-02-08 10:03:39.000000000 +0000
+++ dbus-1.14.8/dbus/dbus-internals.h	2023-06-06 10:36:49.000000000 +0100
@@ -104,7 +104,7 @@
 DBUS_PRIVATE_EXPORT
 void _dbus_verbose_real       (const char *file, const int line, const char *function, 
                                const char *format,...) _DBUS_GNUC_PRINTF (4, 5);
-#  define _dbus_verbose(fmt,...) _dbus_verbose_real( __FILE__,__LINE__,__FUNCTION__,fmt, ## __VA_ARGS__)
+#  define _dbus_verbose(fmt,...) _dbus_verbose_real( __FILE__,__LINE__,_DBUS_FUNCTION_NAME,fmt, ## __VA_ARGS__)
 #else
 DBUS_PRIVATE_EXPORT
 void _dbus_verbose_real       (const char *format,
diff -Nru dbus-1.14.6/dbus/dbus-message.c dbus-1.14.8/dbus/dbus-message.c
--- dbus-1.14.6/dbus/dbus-message.c	2023-01-30 09:57:39.000000000 +0000
+++ dbus-1.14.8/dbus/dbus-message.c	2023-06-06 10:36:49.000000000 +0100
@@ -2275,7 +2275,7 @@
 {
   const DBusString *sig;
   DBusString retstr;
-  char *ret;
+  char *ret = NULL;
   int start, len;
   DBusMessageRealIter *real = (DBusMessageRealIter *)iter;
 
@@ -2289,9 +2289,13 @@
   if (!_dbus_string_append_len (&retstr,
 				_dbus_string_get_const_data (sig) + start,
 				len))
-    return NULL;
-  if (!_dbus_string_steal_data (&retstr, &ret))
-    return NULL;
+    goto oom;
+
+  /* This is correct whether it succeeds or fails: on success it sets `ret`,
+   * and on failure it leaves `ret` set to NULL. */
+  _dbus_string_steal_data (&retstr, &ret);
+
+oom:
   _dbus_string_free (&retstr);
   return ret;
 }
diff -Nru dbus-1.14.6/dbus/dbus-spawn-win.c dbus-1.14.8/dbus/dbus-spawn-win.c
--- dbus-1.14.6/dbus/dbus-spawn-win.c	2022-10-02 15:06:53.000000000 +0100
+++ dbus-1.14.8/dbus/dbus-spawn-win.c	2023-06-06 10:36:49.000000000 +0100
@@ -5,7 +5,7 @@
 #if !defined(SPAWN_DEBUG) || defined(_MSC_VER)
 #define PING()
 #else
-#define PING() fprintf (stderr, "%s:%s:%d\n", __FILE__, __FUNCTION__, __LINE__); fflush (stderr)
+#define PING() fprintf (stderr, "%s:%s:%d\n", __FILE__, _DBUS_FUNCTION_NAME, __LINE__); fflush (stderr)
 #endif
 
 #include <stdio.h>
@@ -105,7 +105,7 @@
 
   old_refcount = _dbus_atomic_inc (&sitter->refcount);
 
-  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount+1, __FUNCTION__);
+  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount+1, _DBUS_FUNCTION_NAME);
 
   sitter->child_handle = NULL;
 
@@ -139,7 +139,7 @@
 
   old_refcount = _dbus_atomic_inc (&sitter->refcount);
   _dbus_assert (old_refcount > 0);
-  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount+1, __FUNCTION__);
+  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount+1, _DBUS_FUNCTION_NAME);
 
   return sitter;
 }
@@ -180,7 +180,7 @@
 
   old_refcount = _dbus_atomic_dec (&sitter->refcount);
   _dbus_assert (old_refcount > 0);
-  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount-1, __FUNCTION__);
+  _dbus_babysitter_trace_ref (sitter, old_refcount, old_refcount-1, _DBUS_FUNCTION_NAME);
 
   if (old_refcount == 1)
     {
diff -Nru dbus-1.14.6/dbus/dbus-sysdeps-win.c dbus-1.14.8/dbus/dbus-sysdeps-win.c
--- dbus-1.14.6/dbus/dbus-sysdeps-win.c	2022-10-02 15:06:53.000000000 +0100
+++ dbus-1.14.8/dbus/dbus-sysdeps-win.c	2023-06-06 10:36:49.000000000 +0100
@@ -1012,12 +1012,12 @@
   psid = token_user->User.Sid;
   if (!IsValidSid (psid))
     {
-      _dbus_verbose("%s invalid sid\n",__FUNCTION__);
+      _dbus_verbose("invalid sid\n");
       goto failed;
     }
   if (!ConvertSidToStringSidA (psid, sid))
     {
-      _dbus_verbose("%s invalid sid\n",__FUNCTION__);
+      _dbus_verbose("invalid sid\n");
       goto failed;
     }
 //okay:
diff -Nru dbus-1.14.6/debian/changelog dbus-1.14.8/debian/changelog
--- dbus-1.14.6/debian/changelog	2023-02-08 13:21:47.000000000 +0000
+++ dbus-1.14.8/debian/changelog	2023-06-06 15:05:50.000000000 +0100
@@ -1,3 +1,17 @@
+dbus (1.14.8-1) unstable; urgency=medium
+
+  [ Simon McVittie ]
+  * New upstream stable release
+    - Fixes a denial of service issue if the root or messagebus user is
+      monitoring messages on the system bus with the Monitoring interface
+      (dbus-monitor, busctl monitor, gdbus monitor or similar)
+      (Closes: #1037151)
+
+  [ Helmut Grohne ]
+  * Mark dbus-daemon and dbus-bin Multi-Arch: foreign (Closes: #1033056)
+
+ -- Simon McVittie <smcv@debian.org>  Tue, 06 Jun 2023 15:05:50 +0100
+
 dbus (1.14.6-1) unstable; urgency=medium
 
   * New upstream stable release
diff -Nru dbus-1.14.6/debian/control dbus-1.14.8/debian/control
--- dbus-1.14.6/debian/control	2023-02-08 13:21:47.000000000 +0000
+++ dbus-1.14.8/debian/control	2023-06-06 15:05:50.000000000 +0100
@@ -130,6 +130,7 @@
 
 Package: dbus-bin
 Architecture: any
+Multi-Arch: foreign
 Depends:
  ${misc:Depends},
  ${shlibs:Depends},
@@ -147,6 +148,7 @@
 
 Package: dbus-daemon
 Architecture: any
+Multi-Arch: foreign
 Depends:
  dbus-bin (= ${binary:Version}),
  dbus-session-bus-common (>= ${source:Version}),
diff -Nru dbus-1.14.6/doc/dbus-api-design.duck dbus-1.14.8/doc/dbus-api-design.duck
--- dbus-1.14.6/doc/dbus-api-design.duck	2022-10-02 15:06:53.000000000 +0100
+++ dbus-1.14.8/doc/dbus-api-design.duck	2023-06-06 10:36:49.000000000 +0100
@@ -320,7 +320,7 @@
     -->
     <signal name="ProgressNotification">
       <arg name="progress_message" type="s" />
-    </method>
+    </signal>
 
   The progress should be reported as an enumerated value:
   [code style="valid" mime="application/xml"]
@@ -335,7 +335,7 @@
     -->
     <signal name="ProgressNotification">
       <arg name="progress_state" type="u" />
-    </method>
+    </signal>
 
 D-Bus has none of the problems of signed versus unsigned integers which C has
 (specifically, it does not do implicit sign conversion), so integer types should
diff -Nru dbus-1.14.6/NEWS dbus-1.14.8/NEWS
--- dbus-1.14.6/NEWS	2023-02-08 12:04:12.000000000 +0000
+++ dbus-1.14.8/NEWS	2023-06-06 14:00:36.000000000 +0100
@@ -1,3 +1,32 @@
+dbus 1.14.8 (2023-06-06)
+========================
+
+Denial-of-service fixes:
+
+• Fix an assertion failure in dbus-daemon when a privileged Monitoring
+  connection (dbus-monitor, busctl monitor, gdbus monitor or similar)
+  is active, and a message from the bus driver cannot be delivered to a
+  client connection due to <deny> rules or outgoing message quota. This
+  is a denial of service if triggered maliciously by a local attacker.
+  (dbus#457; hongjinghao, Simon McVittie)
+
+Other fixes:
+
+• Fix compilation on compilers not supporting __FUNCTION__
+  (dbus!404, Barnabás Pőcze)
+
+• Fix some memory leaks on out-of-memory conditions
+  (dbus!403, Barnabás Pőcze)
+
+• Documentation:
+  · Fix syntax of a code sample in dbus-api-design
+    (dbus!396; Yen-Chin, Lee)
+
+Tests and CI enhancements:
+
+• Fix CI pipelines after freedesktop/freedesktop#540
+  (dbus!405, dbus#456; Simon McVittie)
+
 dbus 1.14.6 (2023-02-08)
 ========================
 
diff -Nru dbus-1.14.6/test/data/valid-config-files/forbidding.conf.in dbus-1.14.8/test/data/valid-config-files/forbidding.conf.in
--- dbus-1.14.6/test/data/valid-config-files/forbidding.conf.in	2022-02-23 14:39:11.000000000 +0000
+++ dbus-1.14.8/test/data/valid-config-files/forbidding.conf.in	2023-06-06 14:00:36.000000000 +0100
@@ -24,5 +24,8 @@
     <allow send_interface="com.example.CannotUnicast2" send_broadcast="true"/>
 
     <deny receive_interface="com.example.CannotReceive"/>
+
+    <!-- Used to reproduce dbus#457 -->
+    <deny receive_interface="org.freedesktop.DBus" receive_member="NameAcquired"/>
   </policy>
 </busconfig>
diff -Nru dbus-1.14.6/test/monitor.c dbus-1.14.8/test/monitor.c
--- dbus-1.14.6/test/monitor.c	2023-01-30 09:57:39.000000000 +0000
+++ dbus-1.14.8/test/monitor.c	2023-06-06 14:00:36.000000000 +0100
@@ -157,6 +157,21 @@
     TRUE
 };
 
+static dbus_bool_t
+config_forbids_name_acquired_signal (const Config *config)
+{
+  if (config == NULL)
+    return FALSE;
+
+  if (config->config_file == NULL)
+    return FALSE;
+
+  if (strcmp (config->config_file, forbidding_config.config_file) == 0)
+    return TRUE;
+
+  return FALSE;
+}
+
 static inline const char *
 not_null2 (const char *x,
     const char *fallback)
@@ -198,6 +213,10 @@
       not_null (dbus_message_get_signature (m)));
   g_test_message ("\terror name: %s",
       not_null (dbus_message_get_error_name (m)));
+  g_test_message ("\tserial number: %u",
+      dbus_message_get_serial (m));
+  g_test_message ("\tin reply to: %u",
+      dbus_message_get_reply_serial (m));
 
   if (strcmp ("s", dbus_message_get_signature (m)) == 0)
     {
@@ -251,9 +270,6 @@
 
 #define assert_name_acquired(m) \
 do { \
-  DBusError _e = DBUS_ERROR_INIT; \
-  const char *_s; \
-    \
   g_assert_cmpstr (dbus_message_type_to_string (dbus_message_get_type (m)), \
       ==, dbus_message_type_to_string (DBUS_MESSAGE_TYPE_SIGNAL)); \
   g_assert_cmpstr (dbus_message_get_sender (m), ==, DBUS_SERVICE_DBUS); \
@@ -263,7 +279,14 @@
   g_assert_cmpstr (dbus_message_get_signature (m), ==, "s"); \
   g_assert_cmpint (dbus_message_get_serial (m), !=, 0); \
   g_assert_cmpint (dbus_message_get_reply_serial (m), ==, 0); \
+} while (0)
+
+#define assert_unique_name_acquired(m) \
+do { \
+  DBusError _e = DBUS_ERROR_INIT; \
+  const char *_s; \
     \
+  assert_name_acquired (m); \
   dbus_message_get_args (m, &_e, \
         DBUS_TYPE_STRING, &_s, \
         DBUS_TYPE_INVALID); \
@@ -331,6 +354,21 @@
   g_assert_cmpint (dbus_message_get_reply_serial (m), !=, 0); \
 } while (0)
 
+/* forbidding.conf does not allow receiving NameAcquired, so if we are in
+ * that configuration, then dbus-daemon synthesizes an error reply to itself
+ * and sends that to monitors */
+#define expect_name_acquired_error(queue, in_reply_to) \
+do { \
+  DBusMessage *message; \
+  \
+  message = g_queue_pop_head (queue); \
+  assert_error_reply (message, DBUS_SERVICE_DBUS, DBUS_SERVICE_DBUS, \
+                      DBUS_ERROR_ACCESS_DENIED); \
+  g_assert_cmpint (dbus_message_get_reply_serial (message), ==, \
+                   dbus_message_get_serial (in_reply_to)); \
+  dbus_message_unref (message); \
+} while (0)
+
 /* This is called after processing pending replies to our own method
  * calls, but before anything else.
  */
@@ -341,6 +379,9 @@
 {
   Fixture *f = user_data;
 
+  g_test_message ("Monitor received message:");
+  log_message (message);
+
   g_assert_cmpstr (dbus_message_get_interface (message), !=,
       "com.example.Tedious");
 
@@ -722,6 +763,11 @@
   test_assert_no_error (&f->e);
   g_assert_cmpint (ret, ==, DBUS_REQUEST_NAME_REPLY_PRIMARY_OWNER);
 
+  /* If the policy forbids receiving NameAcquired, then we'll never
+   * receive it, so behave as though we had */
+  if (config_forbids_name_acquired_signal (f->config))
+    got_unique = got_a = got_b = got_c = TRUE;
+
   while (!got_unique || !got_a || !got_b || !got_c)
     {
       if (g_queue_is_empty (&f->monitored))
@@ -1373,6 +1419,7 @@
 {
   DBusMessage *m;
   int res;
+  size_t n_expected;
 
   if (f->address == NULL)
     return;
@@ -1388,7 +1435,12 @@
   test_assert_no_error (&f->e);
   g_assert_cmpint (res, ==, DBUS_RELEASE_NAME_REPLY_RELEASED);
 
-  while (g_queue_get_length (&f->monitored) < 8)
+  n_expected = 8;
+
+  if (config_forbids_name_acquired_signal (context))
+    n_expected += 1;
+
+  while (g_queue_get_length (&f->monitored) < n_expected)
     test_main_context_iterate (f->ctx, TRUE);
 
   m = g_queue_pop_head (&f->monitored);
@@ -1401,10 +1453,12 @@
       "NameOwnerChanged", "sss", NULL);
   dbus_message_unref (m);
 
-  /* FIXME: should we get this? */
   m = g_queue_pop_head (&f->monitored);
-  assert_signal (m, DBUS_SERVICE_DBUS, DBUS_PATH_DBUS, DBUS_INTERFACE_DBUS,
-      "NameAcquired", "s", f->sender_name);
+  assert_name_acquired (m);
+
+  if (config_forbids_name_acquired_signal (f->config))
+    expect_name_acquired_error (&f->monitored, m);
+
   dbus_message_unref (m);
 
   m = g_queue_pop_head (&f->monitored);
@@ -1626,8 +1680,14 @@
 expect_new_connection (Fixture *f)
 {
   DBusMessage *m;
+  size_t n_expected;
 
-  while (g_queue_get_length (&f->monitored) < 4)
+  n_expected = 4;
+
+  if (config_forbids_name_acquired_signal (f->config))
+    n_expected += 1;
+
+  while (g_queue_get_length (&f->monitored) < n_expected)
     test_main_context_iterate (f->ctx, TRUE);
 
   m = g_queue_pop_head (&f->monitored);
@@ -1644,7 +1704,11 @@
   dbus_message_unref (m);
 
   m = g_queue_pop_head (&f->monitored);
-  assert_name_acquired (m);
+  assert_unique_name_acquired (m);
+
+  if (config_forbids_name_acquired_signal (f->config))
+    expect_name_acquired_error (&f->monitored, m);
+
   dbus_message_unref (m);
 }
 
@@ -1983,6 +2047,8 @@
       setup, test_method_call, teardown);
   g_test_add ("/monitor/forbidden-method", Fixture, &forbidding_config,
       setup, test_forbidden_method_call, teardown);
+  g_test_add ("/monitor/forbidden-reply", Fixture, &forbidding_config,
+      setup, test_dbus_daemon, teardown);
   g_test_add ("/monitor/dbus-daemon", Fixture, NULL,
       setup, test_dbus_daemon, teardown);
   g_test_add ("/monitor/selective", Fixture, &selective_config,

Reply to: