DBus API lacks authentication and authorization

[montfort]

Risk ID: RISK-002 / VULN-002
Severity: HIGH (CVSS 7.5)
Component: DBus Service
Attack Vector: Local
Privileges Required: Low
Impact: Unauthorized Operations

Description

The DBus API does not implement explicit authentication. Any process in the same user session can call any method, including sensitive operations like deleting sync configuration or forcing re-authentication.

Vulnerable Endpoints

<interface name="com.strangedaystech.LNXDrive.Manager">
  <!-- No auth required -->
  <method name="RemoveAccount">
    <arg type="s" name="namespace"/>
  </method>
  <method name="ResetSync"/>
  <method name="ClearCache"/>
</interface>

Attack Scenario

# Malicious script removes all accounts
dbus-send --session --dest=com.strangedaystech.LNXDrive \
  /org/strangedaystech/LNXDrive/Manager \
  com.strangedaystech.LNXDrive.Manager.ResetSync

Impact

• Account configuration deletion
• Forced re-authentication
• Data loss from cache clearing
• Denial of service

Remediation (Short-term P0)

1. Implement PolicyKit integration for sensitive operations
2. Require user confirmation for destructive operations
3. Add caller identification logging

Simulation Scenario

SIM-L1-002

Source

Imported from .straymark/02-design/risk-analysis/RISK-002-security-vulns.md on 2026-05-29.

[montfort]

Triage M0 — degradado P1→P2 y asignado a v0.2.0-beta (epic D-Bus hardening).

Verificado 2026-07-04: vigente — service.rs no integra polkit ni checks por-caller en ninguna de las 9 interfaces. Matiz que justifica la degradación: el bus es session bus (service.rs:1218), mismo usuario/UID — un atacante con ejecución en la sesión ya tiene los privilegios del usuario; esto es defensa-en-profundidad, no un límite de privilegio real. El vector de mayor severidad (tokens vía D-Bus) ya lo cerró RISK-002 en Charter-01 Fase 1: complete_auth_via_goa recibe solo el object-path GOA validado (service.rs:895-961); los tokens nunca cruzan el bus.