fixup! security: Verify session user_id against DBus connection

diff --git a/tools/actions/container_manager.py b/tools/actions/container_manager.py
index 38b0040b92e07eee15a14b1af18545b1f7173c2f..0092f1e61e5c6898a27550b96563561a5496a879 100644 (file)
--- a/tools/actions/container_manager.py
+++ b/tools/actions/container_manager.py
@@ -24,11 +24,10 @@ class DbusContainerManager(dbus.service.Object):
 
     @dbus.service.method("id.waydro.ContainerManager", in_signature='a{ss}', out_signature='', sender_keyword="sender", connection_keyword="conn")
     def Start(self, session, sender, conn):
 
     @dbus.service.method("id.waydro.ContainerManager", in_signature='a{ss}', out_signature='', sender_keyword="sender", connection_keyword="conn")
     def Start(self, session, sender, conn):

-        if session["user_id"] != "0":
-            dbus_info = dbus.Interface(conn.get_object("org.freedesktop.DBus", "/org/freedesktop/DBus/Bus", False), "org.freedesktop.DBus")
-            uid = dbus_info.GetConnectionUnixUser(sender)
-            if str(uid) != session["user_id"]:
-                raise RuntimeError("Cannot start a session on behalf of another user")
+        dbus_info = dbus.Interface(conn.get_object("org.freedesktop.DBus", "/org/freedesktop/DBus/Bus", False), "org.freedesktop.DBus")
+        uid = dbus_info.GetConnectionUnixUser(sender)
+        if str(uid) not in ["0", session["user_id"]]:
+            raise RuntimeError("Cannot start a session on behalf of another user")

         do_start(self.args, session)
 
     @dbus.service.method("id.waydro.ContainerManager", in_signature='b', out_signature='')
         do_start(self.args, session)
 
     @dbus.service.method("id.waydro.ContainerManager", in_signature='b', out_signature='')