Changes/DbusBrokerAsTheDefaultDbusImplementation

Make dbus-broker the default DBus implementation

Summary

Enable dbus-broker.service to use dbus-broker as system and session message bus backend.

Owner

• Name: David Herrmann
• Email: dh.herrmann@gmail.com

• Name: Tom Gundersen
• Email: teg@jklm.no

• Release notes owner:

Current status

• Targeted release: Fedora 29
• Last updated: 2018-12-17
• Tracker bug: #1557954
• Release Notes tracking: #128

Detailed Description

The dbus-broker project is an implementation of a message bus as defined by the D-Bus specification. Its aim is to provide high performance and reliability while keeping compatibility to the D-Bus reference implementation. It is exclusively written for Linux systems and makes use of many modern features provided by recent Linux kernel releases.

The main focus points of dbus-broker are reliability, scalability, and security. The dbus-broker project tries to improve on these points over dbus-daemon, and thus provide a better alternative. And in-depth analysis can be found in the initial announcement of dbus-broker. An excerpt:

• Accounting: dbus-broker maintains per-user accounting, including inter-user quotas. This guarantees that no single user can cause irregularly high memory consumption in the daemon. Unlike dbus-broker, dbus-daemon accounts memory in a multi-tier system, based on plain resource counters on users, connections, and other resources. The multi-tier system suffers from resource-chaining-exhaustion, where clients effectively circumvent the accounting by creating multiple connections/objects, which themselves grant them each a new set of quotas. The single-tier accounting scheme of dbus-broker avoids this, while at the same time adding inter-user quotas to prevent misuse even across clients.

• Reliability: While D-Bus is used on reliable transports, dbus-daemon might still silently drop messages and given circumstances. This is the only possible solution dbus-daemon has, given several of its runtime guarantees. The dbus-broker project changed the architecture of the bus daemon to a degree, that it can provide many guarantees, including that no message will be silently, or unexpectedly, dropped.

• Scalability: The message bus broker is a crucial infrastructure on a modern Linux system, which is a hot-path for almost all IPC going on. Hence, the broker should perform fast and be scalable to its users. dbus-daemon has several **global** data-structures that affect the overall scalability of independent message transactions. dbus-broker does not employ any global data-structures (unless required by the spec), as such any message transaction is only affected by the data provided by the involved peers. Moreover, even for spec-defined global behavior, dbus-broker avoids global data-structures, unless clients actually make use of these obscure features. In several other cases, dbus-daemon scales O(n) time looking up message targets and related data. dbus-broker runs all these in O(log(n)) time.

• Linux-specific: The dbus-broker project was explicitly designed for linux system, making use of many linux-specific APIs and behavior. This allows mitigation of several possible DoS attacks.

Benefit to Fedora

D-Bus is a core part of Fedora, both used by system services, and in the user sessions. It will only become more critical as more things get containerized. This change provides a more scalable and more reliable implementation in place of the reference implementation. The reference implementation suffers from long-standing issues including potential dead-locks and susceptibility to denial of service attacks, which the replacement implementation does not.

Scope

• Proposal owners:
  • Fix regressions.
  • Rename the dbus package to dbus-daemon, split off its utility tools (dbus-send, etc.) to dbus-utils.
  • Move dbus.service to dbus-daemon.service, but add an alias to dbus.service (which is also what dbus-broker does).
  • Create a new dbus-common package which carriers the dbus policies and configuration. Make both dbus-daemon and dbus-broker depend on it.
  • Add a systemd-preset file to enable dbus-broker.service.

• Other developers:
  • Watch for regressions

• Release engineering: #7262
  • List of deliverables: N/A

• Policies and guidelines: No changes needed.

• Trademark approval: No changes needed.

Upgrade/compatibility impact

It is safe to switch back and forth between dbus-daemon and dbus-broker as backend for the system and session buses. There is no data migration needed. The configuration and data formats are equivalent for both implementations.

All known compatibility issues are listed and discussed on the project wiki.

How To Test

Install the dbus-broker package and enable it via:

   systemctl enable dbus-broker.service
   systemctl --global enable dbus-broker.service

After a reboot dbus-broker will be used as system and session message bus. This can be easily reverted by running the corresponding systemctl disable commands.

User Experience

No visible changes in behavior are expected, except for different log messages. Any visibly different behavior to dbus-daemon should be reported as a regression. Ideally, this change should only improve the performance and security of the message bus.

Dependencies

None

Contingency Plan

• Contingency mechanism: Revert to dbus-daemon.
• Contingency deadline: Any
• Blocks release? No
• Blocks product? None

Documentation

• In-depth Look into the Project
• Upstream Wiki

Release Notes

WIP