From e339ad74ca408c665a62bb4bd98dd1ef6caedd20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 27 Oct 2020 15:14:27 +0100
Subject: [PATCH] display: Exit with failure if loading existing users fails

Given not having users may make GDM to launch initial setup, that
allows to create new users (potentially with sudo capabilities), it's
better to make look_for_existing_users() to return its status and only
if it didn't fail continue the gdm execution.

GHSL-2020-202
CVE-2020-16125

Fixes #642
---
 daemon/gdm-display.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/daemon/gdm-display.c b/daemon/gdm-display.c
index 929fa13bd..1b60eb621 100644
--- a/daemon/gdm-display.c
+++ b/daemon/gdm-display.c
@@ -436,106 +436,110 @@ finish_idle (GdmDisplay *self)
 static void
 queue_finish (GdmDisplay *self)
 {
         if (self->priv->finish_idle_id == 0) {
                 self->priv->finish_idle_id = g_idle_add ((GSourceFunc)finish_idle, self);
         }
 }
 
 static void
 _gdm_display_set_status (GdmDisplay *self,
                          int         status)
 {
         if (status != self->priv->status) {
                 self->priv->status = status;
                 g_object_notify (G_OBJECT (self), "status");
         }
 }
 
 static gboolean
 gdm_display_real_prepare (GdmDisplay *self)
 {
         g_return_val_if_fail (GDM_IS_DISPLAY (self), FALSE);
 
         g_debug ("GdmDisplay: prepare display");
 
         _gdm_display_set_status (self, GDM_DISPLAY_PREPARED);
 
         return TRUE;
 }
 
-static void
+static gboolean
 look_for_existing_users_sync (GdmDisplay *self)
 {
         g_autoptr (GVariant) result = NULL;
         g_autoptr (GVariant) result_child = NULL;
         g_autoptr (GError) error = NULL;
         gboolean has_no_users = FALSE;
 
         result = g_dbus_connection_call_sync (self->priv->connection,
                                               "org.freedesktop.Accounts",
                                               "/org/freedesktop/Accounts",
                                               "org.freedesktop.DBus.Properties",
                                               "Get",
                                               g_variant_new ("(ss)", "org.freedesktop.Accounts", "HasNoUsers"),
                                               G_VARIANT_TYPE ("(v)"),
                                               G_DBUS_CALL_FLAGS_NONE,
                                               -1,
                                               NULL,
                                               &error);
 
         if (result == NULL) {
-                g_warning ("Failed to contact accountsservice: %s", error->message);
-                return;
+                g_critical ("Failed to contact accountsservice: %s", error->message);
+                goto out;
         }
 
         g_variant_get (result, "(v)", &result_child);
         has_no_users = g_variant_get_boolean (result_child);
         self->priv->have_existing_user_accounts = !has_no_users;
 
         g_debug ("GdmDisplay: machine does %shave existing user accounts",
                  has_no_users? "not " : "");
+out:
+        return result != NULL;
 }
 
 gboolean
 gdm_display_prepare (GdmDisplay *self)
 {
         gboolean ret;
 
         g_return_val_if_fail (GDM_IS_DISPLAY (self), FALSE);
 
         g_debug ("GdmDisplay: Preparing display: %s", self->priv->id);
 
         /* FIXME: we should probably do this in a more global place,
          * asynchronously
          */
-        look_for_existing_users_sync (self);
+        if (!look_for_existing_users_sync (self)) {
+                exit (EXIT_FAILURE);
+        }
 
         self->priv->doing_initial_setup = wants_initial_setup (self);
 
         g_object_ref (self);
         ret = GDM_DISPLAY_GET_CLASS (self)->prepare (self);
         g_object_unref (self);
 
         return ret;
 }
 
 gboolean
 gdm_display_manage (GdmDisplay *self)
 {
         gboolean res;
 
         g_return_val_if_fail (GDM_IS_DISPLAY (self), FALSE);
 
         g_debug ("GdmDisplay: Managing display: %s", self->priv->id);
 
         /* If not explicitly prepared, do it now */
         if (self->priv->status == GDM_DISPLAY_UNMANAGED) {
                 res = gdm_display_prepare (self);
                 if (! res) {
                         return FALSE;
                 }
         }
 
         if (g_strcmp0 (self->priv->session_class, "greeter") == 0) {
                 if (GDM_DISPLAY_GET_CLASS (self)->manage != NULL) {
                         GDM_DISPLAY_GET_CLASS (self)->manage (self);
-- 
2.28.0