security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 18 Wiki Activity

app/dbus: accept system bus config

Browse Source 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra 2024-09-09 21:19:12 +09:00
parent 20c0e66d8f
commit 44301cd979
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
4 changed files with 99 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
flag.go
View File

@ -7,10 +7,13 @@ import (
)
var (
userName string
dbusConfig string
dbusID string
mpris bool
userName string
dbusConfigSession string
dbusConfigSystem string
dbusVerbose bool
dbusID string
mpris bool
mustWayland bool
mustX bool
@ -23,7 +26,10 @@ var (
func init() {
flag.StringVar(&userName, "u", "chronos", "Passwd name of user to run as")
flag.StringVar(&dbusConfig, "dbus-config", "builtin", "Path to D-Bus proxy config file, or \"builtin\" for defaults")
flag.StringVar(&dbusConfigSession, "dbus-config", "builtin", "Path to D-Bus proxy config file, or \"builtin\" for defaults")
flag.StringVar(&dbusConfigSystem, "dbus-system", "nil", "Path to system D-Bus proxy config file, or \"nil\" to disable")
flag.BoolVar(&dbusVerbose, "dbus-log", false, "Enable logging in the D-Bus proxy")
flag.StringVar(&dbusID, "dbus-id", "", "D-Bus ID of application, leave empty to disable own paths, has no effect if custom config is available")
flag.BoolVar(&mpris, "mpris", false, "Allow owning MPRIS D-Bus path, has no effect if custom config is available")

83
internal/app/dbus.go
View File

@ -14,16 +14,30 @@ import (
"git.ophivana.moe/cat/fortify/internal/util"
)
const dbusSessionBusAddress = "DBUS_SESSION_BUS_ADDRESS"
const (
dbusSessionBusAddress = "DBUS_SESSION_BUS_ADDRESS"
dbusSystemBusAddress = "DBUS_SYSTEM_BUS_ADDRESS"
)
var dbusAddress string
var (
dbusAddress [2]string
dbusSystem bool
)
func (a *App) ShareDBus(c *dbus.Config) {
func (a *App) ShareDBus(dse, dsg *dbus.Config, verbose bool) {
a.setEnablement(state.EnableDBus)
var binPath, address string
dbusSystem = dsg != nil
var binPath string
var sessionBus, systemBus [2]string
target := path.Join(system.V.Share, strconv.Itoa(os.Getpid()))
dbusAddress = "unix:path=" + target
sessionBus[1] = target + ".bus"
systemBus[1] = target + ".system-bus"
dbusAddress = [2]string{
"unix:path=" + sessionBus[1],
"unix:path=" + systemBus[1],
}
if b, ok := util.Which("xdg-dbus-proxy"); !ok {
state.Fatal("D-Bus: Did not find 'xdg-dbus-proxy' in PATH")
@ -32,17 +46,36 @@ func (a *App) ShareDBus(c *dbus.Config) {
}
if addr, ok := os.LookupEnv(dbusSessionBusAddress); !ok {
state.Fatal("D-Bus: DBUS_SESSION_BUS_ADDRESS not set")
if system.V.Verbose {
fmt.Println("D-Bus: DBUS_SESSION_BUS_ADDRESS not set, assuming default format")
}
sessionBus[0] = fmt.Sprintf("unix:path=/run/user/%d/bus", os.Getuid())
} else {
address = addr
sessionBus[0] = addr
}
c.Log = system.V.Verbose
p := dbus.New(binPath, address, target)
if system.V.Verbose {
fmt.Println("D-Bus: sealing proxy", c.Args(address, target))
if addr, ok := os.LookupEnv(dbusSystemBusAddress); !ok {
if system.V.Verbose {
fmt.Println("D-Bus: DBUS_SYSTEM_BUS_ADDRESS not set, assuming default format")
}
systemBus[0] = "unix:path=/run/dbus/system_bus_socket"
} else {
systemBus[0] = addr
}
if err := p.Seal(c); err != nil {
p := dbus.New(binPath, sessionBus, systemBus)
dse.Log = verbose
if system.V.Verbose {
fmt.Println("D-Bus: sealing session proxy", dse.Args(sessionBus))
}
if dsg != nil {
dsg.Log = verbose
if system.V.Verbose {
fmt.Println("D-Bus: sealing system proxy", dsg.Args(systemBus))
}
}
if err := p.Seal(dse, dsg); err != nil {
state.Fatal("D-Bus: invalid config when sealing proxy,", err)
}
@ -50,7 +83,10 @@ func (a *App) ShareDBus(c *dbus.Config) {
done := make(chan struct{})
if system.V.Verbose {
fmt.Printf("Starting session bus proxy '%s' for address '%s'\n", dbusAddress, address)
fmt.Printf("Starting session bus proxy '%s' for address '%s'\n", dbusAddress[0], sessionBus[0])
if dsg != nil {
fmt.Printf("Starting system bus proxy '%s' for address '%s'\n", dbusAddress[1], systemBus[0])
}
}
if err := p.Start(&ready); err != nil {
state.Fatal("D-Bus: error starting proxy,", err)
@ -80,13 +116,24 @@ func (a *App) ShareDBus(c *dbus.Config) {
state.Fatal("D-Bus: proxy did not start correctly")
}
a.AppendEnv(dbusSessionBusAddress, dbusAddress)
if err := acl.UpdatePerm(target, a.UID(), acl.Read, acl.Write); err != nil {
state.Fatal(fmt.Sprintf("Error preparing D-Bus proxy '%s':", dbusAddress), err)
a.AppendEnv(dbusSessionBusAddress, dbusAddress[0])
if err := acl.UpdatePerm(sessionBus[1], a.UID(), acl.Read, acl.Write); err != nil {
state.Fatal(fmt.Sprintf("Error preparing D-Bus session proxy '%s':", dbusAddress[0]), err)
} else {
state.RegisterRevertPath(target)
state.RegisterRevertPath(sessionBus[1])
}
if dsg != nil {
a.AppendEnv(dbusSystemBusAddress, dbusAddress[1])
if err := acl.UpdatePerm(systemBus[1], a.UID(), acl.Read, acl.Write); err != nil {
state.Fatal(fmt.Sprintf("Error preparing D-Bus system proxy '%s':", dbusAddress[1]), err)
} else {
state.RegisterRevertPath(systemBus[1])
}
}
if system.V.Verbose {
fmt.Printf("Session bus proxy '%s' for address '%s' configured\n", dbusAddress, address)
fmt.Printf("Session bus proxy '%s' for address '%s' configured\n", dbusAddress[0], sessionBus[0])
if dsg != nil {
fmt.Printf("System bus proxy '%s' for address '%s' configured\n", dbusAddress[1], systemBus[0])
}
}
}

5
internal/app/run.go
View File

@ -167,7 +167,10 @@ func (a *App) commandBuilderMachineCtl() (args []string) {
state.Fatal("Error reading executable path:", err)
} else {
if a.enablements.Has(state.EnableDBus) {
innerCommand.WriteString(dbusSessionBusAddress + "=" + "'" + dbusAddress + "' ")
innerCommand.WriteString(dbusSessionBusAddress + "=" + "'" + dbusAddress[0] + "' ")
if dbusSystem {
innerCommand.WriteString(dbusSystemBusAddress + "=" + "'" + dbusAddress[1] + "' ")
}
}
innerCommand.WriteString("exec " + executable + " -V")
}

25
main.go
View File

@ -21,7 +21,9 @@ var (
Version = "impure"
a *app.App
c *dbus.Config
dbusSession *dbus.Config
dbusSystem *dbus.Config
)
func tryVersion() {
@ -47,13 +49,24 @@ func main() {
// parse D-Bus config file if applicable
if mustDBus {
if dbusConfig == "builtin" {
c = dbus.NewConfig(dbusID, true, mpris)
if dbusConfigSession == "builtin" {
dbusSession = dbus.NewConfig(dbusID, true, mpris)
} else {
if f, err := os.Open(dbusConfig); err != nil {
if f, err := os.Open(dbusConfigSession); err != nil {
state.Fatal("Error opening D-Bus proxy config file:", err)
} else {
if err = json.NewDecoder(f).Decode(&c); err != nil {
if err = json.NewDecoder(f).Decode(&dbusSession); err != nil {
state.Fatal("Error parsing D-Bus proxy config file:", err)
}
}
}
// system bus proxy is optional
if dbusConfigSystem != "nil" {
if f, err := os.Open(dbusConfigSystem); err != nil {
state.Fatal("Error opening D-Bus proxy config file:", err)
} else {
if err = json.NewDecoder(f).Decode(&dbusSystem); err != nil {
state.Fatal("Error parsing D-Bus proxy config file:", err)
}
}
@ -122,7 +135,7 @@ func main() {
}
if mustDBus {
a.ShareDBus(c)
a.ShareDBus(dbusSession, dbusSystem, dbusVerbose)
}
if mustPulse {