[OpenWrt-Devel] Ubus crashes when using its ACL feature

[Wang Bin]

Hi,

I'm using UBUS ACL features as my application is in non ROOT group.

I define
/usr/share/acl.d/myapp.json

{
"group" : "mygroup",
"access" : {"methods" : [ "*" ]},
"publish" : [ "*" ],
"subscribe" : [ "*" ]
}

Then ubusd crashes.

By analysis, my app calls

ubus_register_event_handler

{

241   ret = ubus_invoke(ctx, UBUS_SYSTEM_OBJECT_EVENT, "register", b2.head,

242         NULL, NULL, 0);

}



At server, it crashes at

ubusd_handle_invoke

{

if (ubusd_acl_check(cl, obj->path.key, method, UBUS_ACL_ACCESS))

}



Here obj(with id UBUS_SYSTEM_OBJECT_EVENT) is an internal object, and with obj->path.key NULL. Inside, UBUS directly use it in strcmp. Some coredump information at last part.



I suggest to modify the above line to

259   if ((blob_get_u32(attr[UBUS_ATTR_OBJID]) != UBUS_SYSTEM_OBJECT_EVENT) && (ubusd_acl_check(cl, obj->path.key, method, UBUS_ACL_ACCESS)))



After add this, it works well and the event path is checked at other place.



Coredump:

#2  0x00402a9c in ubusd_handle_invoke (cl=0x8e30b8, ub=0x8e3e40, attr=0x415230) at

ubusd_proto.c:259

259                      if (ubusd_acl_check(cl, obj->path.key, method, UBUS_ACL_ACCESS))

(gdb) info local

obj = 0x8df138

id = 0x8df138

method = 0x8e3e68 "register"

(gdb) print *id

$25 = {avl = {list = {next = 0x8df1b0, prev = 0x41531c}, parent = 0x8df1b0, left = 0x0, right = 0x0, key = 0x8df154, balance = 0 '\000', leader = true}, id = 1}

(gdb) print *obj

$26 = {id = {avl = {list = {next = 0x8df1b0, prev = 0x41531c}, parent = 0x8df1b0, left = 0x0, right = 0x0, key = 0x8df154, balance = 0 '\000', leader = true}, id = 1}, list = {

    next = 0x8df158, prev = 0x8df158}, events = {next = 0x8df160, prev = 0x8df160}, subscribers = {next = 0x8df168, prev = 0x8df168}, target_list = {next = 0x8df170,

    prev = 0x8df170}, type = 0x0, path = {list = {next = 0x0, prev = 0x0}, parent = 0x0, left = 0x0, right = 0x0, key = 0x0, balance = 0 '\000', leader = false}, client = 0x0,

  recv_msg = 0x403940 <ubusd_event_recv>, event_seen = 0, invoke_seq = 0}



BR
Wang Bin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.infradead.org/pipermail/openwrt-devel/attachments/20151026/56bc9876/attachment.htm>
-------------- next part --------------
_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel