D-Bus policy allows any local user to call the root service #18

New issue

Closed

opened 2026-08-17 16:57:01 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-17 16:57:01 -04:00

Owner

systemd/org.aqomui.service.conf grants send_destination under
<policy context="default">, so any local user can invoke any method on
the root service. Several act on caller-supplied data with root authority:

cfgupdate(cfg) writes caller bytes straight to root-owned config.json
(aqomui_service.py:410-416)
change_ovpn_config(provider, certpath) copies files from a caller-chosen
path into root-owned locations (aqomui_service.py:306-318)
connect_to_server / import_thread drive config generation and subprocess
execution from an untyped a{ss} dict

connect_to_server also does setattr(self, "<server-name>_dict", ...) on the
service object (aqomui_service.py:143), where the name comes from a provider
API or an imported folder -- an attacker-influenced attribute write on a root
object, plus a collision risk.

In order of leverage:

Restrict the policy to a dedicated group; add Polkit checks on state-changing
methods
Treat the a{ss} dict as an untrusted wire format -- validate every field
server-side (provider against SUPPORTED_PROVIDERS, paths canonicalised and
confined)
Narrow what runs as root -- write to fixed service-owned locations rather
than caller-named paths

This is the one audit finding that is a vulnerability rather than a robustness
issue.

`systemd/org.aqomui.service.conf` grants `send_destination` under `<policy context="default">`, so **any** local user can invoke **any** method on the root service. Several act on caller-supplied data with root authority: - `cfgupdate(cfg)` writes caller bytes straight to root-owned `config.json` (`aqomui_service.py:410-416`) - `change_ovpn_config(provider, certpath)` copies files from a **caller-chosen path** into root-owned locations (`aqomui_service.py:306-318`) - `connect_to_server` / `import_thread` drive config generation and subprocess execution from an untyped `a{ss}` dict `connect_to_server` also does `setattr(self, "<server-name>_dict", ...)` on the service object (`aqomui_service.py:143`), where the name comes from a provider API or an imported folder -- an attacker-influenced attribute write on a root object, plus a collision risk. In order of leverage: 1. Restrict the policy to a dedicated group; add Polkit checks on state-changing methods 2. Treat the `a{ss}` dict as an untrusted wire format -- validate every field server-side (provider against `SUPPORTED_PROVIDERS`, paths canonicalised and confined) 3. Narrow what runs as root -- write to fixed service-owned locations rather than caller-named paths This is the one audit finding that is a vulnerability rather than a robustness issue.

mysticalsoap added the

security

label

2026-08-17 16:57:01 -04:00

mysticalsoap referenced this issue

2026-08-18 19:26:40 -04:00

change: drop the self-update mechanism #46

mysticalsoap referenced this issue

2026-08-18 19:26:40 -04:00

fix: authorize service calls through polkit #47

mysticalsoap referenced this issue from a pull request that will close it,

2026-08-18 21:44:46 -04:00