Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\))
Subject: Re: [PATCH BlueZ v5 1/1] mesh: Add APIs for Provisioner and Config
 Client
From:   Johan Hedberg <johan.hedberg@gmail.com>
In-Reply-To: <DEBB0CAA2616974FAE35E4B560B9A4376CAFE9DF@ORSMSX103.amr.corp.intel.com>
Date:   Thu, 18 Apr 2019 18:28:14 +0300
Cc:     Michal Lowas-Rzechonek <michal.lowas-rzechonek@silvair.com>,
        "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>,
        "Stotland, Inga" <inga.stotland@intel.com>,
        Marcel Holtmann <marcel@holtmann.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <A7F44065-0021-4172-B28F-7DBAFB8F11EB@gmail.com>
References: <20190415194946.13121-1-brian.gix@intel.com>
 <20190415194946.13121-2-brian.gix@intel.com>
 <20190417055132.scxvzhusx2suasdv@kynes>
 <DEBB0CAA2616974FAE35E4B560B9A4376CAFE9DF@ORSMSX103.amr.corp.intel.com>
To:     "Gix, Brian" <brian.gix@intel.com>
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

Hi Brian,

> On 17 Apr 2019, at 20.58, Gix, Brian <brian.gix@intel.com> wrote:
>> From: Michal Lowas-Rzechonek
>>> +	 uint64 token ImportLocalNode(string config_file)
>>=20
>> I am somewhat uncomfortable with passing a file path here. The caller =
would
>> need to create a temporary file, which is a little cumbersome, and =
might fail if
>> the daemon is running on another machine.
>>=20
>> Not sure what are the size constraints (if any), but I think it might =
be better
>> to pass the JSON as a string.
>=20
> Indeed, this has been discussed internally as well, and is still =
subject to the change you mention. We are still wait8ing for input from =
all stakeholders, and your preference is noted.
> will be composing all Config Client messages (except for OTA key =
messages)

Passing a file name like that could also be a security vulnerability: =
you=E2=80=99d allow a non-privileged process (the D-Bus client) to =
request a privileged process (meshd) to go open and read a file that the =
non-privileged process otherwise would have no access to. The =
non-privileged process could then e.g. make some inferences of the =
content of this file based on subsequent meshd behaviour (logs, etc). So =
either a file descriptor or just a string parameter sounds saner to me.

Johan