More actionable output for --log-session-bus and --log-system-bus

[nedrichards]

Linux distribution and version

Endless OS 3.8.0

Flatpak version

1.6.2

Description of the problem

Application developers often want to run flatpak run --log-session-bus com.synology.SynologyDrive in order to audit their dbus usage, however the output of the log tool is a confusing mess. e.g. this sample output

C1: -> org.freedesktop.DBus call org.freedesktop.DBus.Hello at /org/freedesktop/DBus
C2: -> org.freedesktop.DBus fake AddMatch for org.kde.StatusNotifierWatcher
C3: -> org.freedesktop.DBus fake GetNameOwner for org.kde.StatusNotifierWatcher
C4: -> org.freedesktop.DBus fake wildcarded AddMatch for org.freedesktop.portal
C5: -> org.freedesktop.DBus fake wildcarded AddMatch for org.mpris.MediaPlayer2.com.synology.SynologyDrive
C6: -> org.freedesktop.DBus fake wildcarded AddMatch for com.synology.SynologyDrive
C7: -> org.freedesktop.DBus fake ListNames
B1: <- org.freedesktop.DBus return from C1
B2: <- org.freedesktop.DBus signal org.freedesktop.DBus.NameAcquired at /org/freedesktop/DBus
B3: <- org.freedesktop.DBus return from C2
SKIPPED
B4: <- org.freedesktop.DBus return from C3
SKIPPED
B5: <- org.freedesktop.DBus return from C4
SKIPPED
B6: <- org.freedesktop.DBus return from C5
SKIPPED
B7: <- org.freedesktop.DBus return from C6
SKIPPED
B8: <- org.freedesktop.DBus return from C7
C8: -> org.freedesktop.DBus fake GetNameOwner for org.freedesktop.DBus
C9: -> org.freedesktop.DBus fake GetNameOwner for org.freedesktop.portal.Desktop
C10: -> org.freedesktop.DBus fake GetNameOwner for org.freedesktop.portal.Documents
C11: -> org.freedesktop.DBus fake GetNameOwner for org.freedesktop.portal.IBus
C12: -> org.freedesktop.DBus fake GetNameOwner for org.kde.StatusNotifierWatcher
SKIPPED
B9: <- org.freedesktop.DBus return from C8
SKIPPED
B10: <- org.freedesktop.DBus return from C9
SKIPPED
B11: <- org.freedesktop.DBus return from C10
SKIPPED
B12: <- org.freedesktop.DBus return from C11
SKIPPED
B13: <- org.freedesktop.DBus return from C12
SKIPPED
C13: -> org.freedesktop.DBus call org.freedesktop.DBus.AddMatch at /org/freedesktop/DBus
C14: -> org.freedesktop.DBus call org.freedesktop.DBus.NameHasOwner at /org/freedesktop/DBus
Filtering message due to arg0 org.a11y.Bus, policy: 0 (required 1)

etc. etc.

Whilst this output is useful the developer actually wants an audit option that tells them (ideally in real time but it could also be after the application has closed)

1. Which dbus names they're asking for in their manifest
2. Which of those names were exercised in the run (include implicit grants here)
3. Which names were denied

This would likely be a different command, I don't dispute that the --log-session-bus and --log-system-bus commands are useful - they're just really hard to use properly and contribute to over and underpermissioning of applications.

[alexlarsson]

Yeah, this is really just some internal debug spew. It would be nice with something that is actually designed.