Easy to hijack input context with dbus call.

[wengxt]

E.g. I can do something like from command to manipulate the state of input context.

DBUS_SESSION_BUS_ADDRESS=<ibus's address> qdbus org.freedesktop.IBus /org/freedesktop/IBus/InputContext_3 org.freedesktop.IBus.InputContext.Reset

[fujiwarat]

Now ibus uses flatpak for that scanning and it's not designed to run applications in the server side.

[wengxt]

First, this issue is not specific to flatpak. It's a generic issue to regular or sandboxed application. IBus does not check the call on inputcontext object is from the creator or not.

Second, as for flatpak, it is certainly an issue that it may let sandboxed application to by pass the sandbox and interfere other input contexts that not belong to it. ibus-portal is something that runs normally on regular session bus, it is possible that a bad application may issue malicious call on other ibus input context on portal.

flatpak does not scan the object on the service. It just bypass the dbus service through the sandbox that matches certain service name scheme. Once the object is registered on the service, it will be visible to all applications.

[fujiwarat]

Just fixing your issue does not make a secure connection.
In the sandbox, the connection is per application and the bacd applications would not establish the connection.

[wengxt]

Actually I'd like to point out actually ibus-portal has proper validation https://github.com/ibus/ibus/blob/master/portal/portal.c#L344 , while ibus-daemon itself missing it.

The dbus connection is not per application i'd say. application can freely open any number of dbus connection it's just the connection is sandbox and not visible outside, but the service is shared.

[fujiwarat]

OK, probably the authentication could be applied to ibus-daemon however I think the connection won't become a completely secure without a container likes flatpak.
But thank you for commenting the more tangible source codes.

[fujiwarat]

Actually I'd like to point out actually ibus-portal has proper validation https://github.com/ibus/ibus/blob/master/portal/portal.c#L344 , while ibus-daemon itself missing it.

I added the similar validation:
fujiwarat@f009fb1

Does it work for you?