Arch Linux and Dbus mediation

[curiosityseeker]

Arch Linux is planning to make dbus-broker its default dbus daemon. The reasoning is that dbus-broker provides better performance and higher reliability than dbus-daemon, with per-user accounting of resources in the broker.

However, it is argued that dbus-broker has no AppArmor support (also mentioned in the Arch wiki).

On the other hand, it's mentioned here that "on archlinux, the dbus mediation is not enabled". Why is that? Is that caused by the fact that only the kernels used in Ubuntu have a respective patch added which hasn't landed yet in the mainstream kernel? If so - wouldn't that mean that at the time being it doesn't make a difference for AppArmor if dbus-broker or dbus-daemon is used in Arch Linux?

[roddhjav]

As mentioned in the comment on arch's Gitlab: AppArmor integration with dbus is an Ubuntu feature requiring a patched kernel adding SO_PEERSEC and a patched dbus-daemon. So as you said, arch decision would not change anything anyway.

Now, I am aware that the ubuntu kernel patch is going in to merged upstream, at this point, we could consider what is the best option (adding apparmor support to dbus-broker most likely)

[curiosityseeker]

Thanks! So my interpretation was correct and we have to wait until those patches will be upstreamed. This is the PR for adding AppArmor support to dbus-broker.

[curiosityseeker]

FWIW, the transition to dbus-broker has taken place. 2 processes - dbus-broker and dbus-broker-launch - need to be confined.