Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

External authentication fails between user-namespaces #345

Closed
idleroamer opened this issue Dec 4, 2022 · 1 comment
Closed

External authentication fails between user-namespaces #345

idleroamer opened this issue Dec 4, 2022 · 1 comment

Comments

@idleroamer
Copy link
Contributor

It is not possible to connect to dbus bus running on host from within a user-namespace, a typical containers setup.
The "EXTERNAL authentication" mechansim fails to verify the UID credential passing via the message against the out-of-band credential, due mismatch in user-id crossing user-namespace.

Frameworks like sd-bus, gdbus has already switched to sending empty value instead of UID in DATA payload to fix the issue.
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/2832

systemd/systemd@1ed4723
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Dec 4, 2022
auth: Do not send UID with external auth
24ffd9d 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID

godbus#345
@idleroamer idleroamer mentioned this issue Dec 4, 2022
Merged
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Dec 4, 2022
auth: Do not send UID with external auth
b9e94e4 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Dec 4, 2022
auth: Do not send UID with external auth
ded90ae 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Dec 4, 2022
auth: Do not send UID with external auth
a0a35c0 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
5e02838 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
b54817c 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
e026873 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
b3bac88 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
@idleroamer
Copy link
Contributor Author

already fixed in master in #264

idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
63020a7 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
71f0f3d 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
4d45f30 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue Jan 2, 2023
auth: Optionally not send UID with external auth
f95a472 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
guelfey pushed a commit to idleroamer/dbus that referenced this issue Apr 9, 2023
@guelfey
auth: Optionally not send UID with external auth
19811af 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 13, 2023
auth: Optionally not send UID with external auth
b99ea06 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 13, 2023
auth: Optionally not send UID with external auth
abf1de5 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 13, 2023
auth: Optionally not send UID with external auth
1acf512 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 13, 2023
auth: Optionally not send UID with external auth
c3e67b9 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 13, 2023
auth: Optionally not send UID with external auth
b8baec9 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 14, 2023
auth: Optionally not send UID with external auth
57371fd 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 21, 2023
auth: Test UID not send with external auth
c03106b 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 21, 2023
auth: Test UID not send with external auth
5e9aa2a 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
idleroamer pushed a commit to idleroamer/dbus that referenced this issue May 22, 2023
auth: Test UID not send with external auth
8513e01 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
guelfey pushed a commit to idleroamer/dbus that referenced this issue May 22, 2023
@guelfey
auth: Test UID not send with external auth
2092b54 
Due to mismatch between UID in a user-namespace
and out-of-band credential acquired by server
on another user-namespace refrain from sending UID
with external authentication by default
to keep compatibility still fallback to sending UID
if it fails

godbus#345
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@idleroamer