Skip to content

Fix fm-shim-backend D-Bus name registration and quoting#357

Open
assisted-by-ai wants to merge 1 commit intoKicksecure:masterfrom
assisted-by-ai:claude/security-review-fm-shim-4ugcF
Open

Fix fm-shim-backend D-Bus name registration and quoting#357
assisted-by-ai wants to merge 1 commit intoKicksecure:masterfrom
assisted-by-ai:claude/security-review-fm-shim-4ugcF

Conversation

@assisted-by-ai
Copy link
Copy Markdown

Summary

This PR improves the robustness and security of the fm-shim-backend D-Bus service by fixing shell argument quoting issues in the build script and preventing the service from running in a degraded state when another process owns the D-Bus name.

Key Changes

  • Build script quoting: Fixed potential word-splitting issues by storing pkg-config output in arrays and properly expanding them with "${array[@]}" syntax instead of unquoted command substitution
  • D-Bus name registration: Added DBUS_NAME_FLAG_DO_NOT_QUEUE flag to prevent the service from being queued when the D-Bus name is unavailable
  • Error handling: Changed behavior when another process owns the D-Bus name from a warning with degraded operation to a fatal error, preventing the service from running in an insecure state
  • Systemd service: Added NotifyAccess=main to the service unit to properly handle systemd readiness notifications

Implementation Details

The changes ensure that:

  1. The build process correctly handles pkg-config flags that may contain spaces or special characters
  2. The fm-shim-backend service fails fast if it cannot acquire the required D-Bus name, rather than running with reduced functionality
  3. The systemd service properly validates readiness notifications from the main process only

https://claude.ai/code/session_01HJPNe7hjMrPvPtuJmPBhNa

…otify

- Quote pkg-config output in build script via bash arrays to prevent
  injection through malicious .pc files
- Add NotifyAccess=main to systemd service to restrict sd_notify to the
  main process only
- Add DBUS_NAME_FLAG_DO_NOT_QUEUE to fail fast when another process owns
  the D-Bus name, replacing the IN_QUEUE warning with an EXISTS error exit

https://claude.ai/code/session_01HJPNe7hjMrPvPtuJmPBhNa
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants