nix: use reverse-DNS style id as unique identifier

Signed-off-by: Ophestra <cat@gensokyo.uk>

dbus/config.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"os"
+	"strings"
 )
 
 // ProxyPair is an upstream dbus address and a downstream socket path.
@@ -27,6 +28,61 @@ type Config struct {
 	Filter bool `json:"filter"`
 }
 
+func (c *Config) interfaces(yield func(string) bool) {
+	for _, iface := range c.See {
+		if !yield(iface) {
+			return
+		}
+	}
+	for _, iface := range c.Talk {
+		if !yield(iface) {
+			return
+		}
+	}
+	for _, iface := range c.Own {
+		if !yield(iface) {
+			return
+		}
+	}
+
+	for iface := range c.Call {
+		if !yield(iface) {
+			return
+		}
+	}
+	for iface := range c.Broadcast {
+		if !yield(iface) {
+			return
+		}
+	}
+}
+
+func (c *Config) checkInterfaces(segment string) error {
+	for iface := range c.interfaces {
+		/*
+			xdg-dbus-proxy fails without output when this condition is not met:
+				char *dot = strrchr (filter->interface, '.');
+				if (dot != NULL)
+				  {
+				    *dot = 0;
+				    if (strcmp (dot + 1, "*") != 0)
+				      filter->member = g_strdup (dot + 1);
+				  }
+
+			trim ".*" since they are removed before searching for '.':
+				if (g_str_has_suffix (name, ".*"))
+				  {
+				    name[strlen (name) - 2] = 0;
+				    wildcard = TRUE;
+				  }
+		*/
+		if strings.IndexByte(strings.TrimSuffix(iface, ".*"), '.') == -1 {
+			return &BadInterfaceError{iface, segment}
+		}
+	}
+	return nil
+}
+
 func (c *Config) Args(bus ProxyPair) (args []string) {
 	argc := 2 + len(c.See) + len(c.Talk) + len(c.Own) + len(c.Call) + len(c.Broadcast)
 	if c.Log {
@@ -63,9 +119,7 @@ func (c *Config) Args(bus ProxyPair) (args []string) {
 	return
 }
 
-func (c *Config) Load(r io.Reader) error {
-	return json.NewDecoder(r).Decode(&c)
-}
+func (c *Config) Load(r io.Reader) error { return json.NewDecoder(r).Decode(&c) }
 
 // NewConfigFromFile opens the target config file at path and parses its contents into *Config.
 func NewConfigFromFile(path string) (*Config, error) {

dbus/proxy.go

@@ -2,6 +2,7 @@ package dbus
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"os/exec"
 	"sync"
@@ -14,6 +15,15 @@ import (
 // Overriding ProxyName will only affect Proxy instance created after the change.
 var ProxyName = "xdg-dbus-proxy"
 
+type BadInterfaceError struct {
+	Interface string
+	Segment   string
+}
+
+func (e *BadInterfaceError) Error() string {
+	return fmt.Sprintf("bad interface string %q in %s bus configuration", e.Interface, e.Segment)
+}
+
 // Proxy holds the state of a xdg-dbus-proxy process, and should never be copied.
 type Proxy struct {
 	helper helper.Helper
@@ -66,9 +76,15 @@ func Finalise(sessionBus, systemBus ProxyPair, session, system *Config) (final *
 
 	var args []string
 	if session != nil {
+		if err = session.checkInterfaces("session"); err != nil {
+			return
+		}
 		args = append(args, session.Args(sessionBus)...)
 	}
 	if system != nil {
+		if err = system.checkInterfaces("system"); err != nil {
+			return
+		}
 		args = append(args, system.Args(systemBus)...)
 	}
 

nixos.nix

@@ -8,12 +8,10 @@ packages:
 
 let
   inherit (lib)
+    lists
     mkMerge
     mkIf
     mapAttrs
-    mergeAttrsList
-    imap1
-    foldr
     foldlAttrs
     optional
     optionals
@@ -30,6 +28,27 @@ in
   imports = [ (import ./options.nix packages) ];
 
   config = mkIf cfg.enable {
+    assertions = [
+      (
+        let
+          conflictingApps = foldlAttrs (
+            acc: id: app:
+            (
+              acc
+              ++ foldlAttrs (
+                acc': id': app':
+                if id == id' || app.shareUid && app'.shareUid || app.identity != app'.identity then acc' else acc' ++ [ id ]
+              ) [ ] cfg.apps
+            )
+          ) [ ] cfg.apps;
+        in
+        {
+          assertion = (lists.length conflictingApps) == 0;
+          message = "the following fortify apps have conflicting identities: " + (builtins.concatStringsSep ", " conflictingApps);
+        }
+      )
+    ];
+
     security.wrappers.fsu = {
       source = "${cfg.fsuPackage}/bin/fsu";
       setuid = true;
@@ -49,22 +68,19 @@ in
     home-manager =
       let
         privPackages = mapAttrs (username: fid: {
-          home.packages =
-            let
-              # aid 0 is reserved
-              wrappers = imap1 (
-                aid: app:
+          home.packages = foldlAttrs (
+            acc: id: app:
+            [
+              (
                 let
                   extendDBusDefault = id: ext: {
                     filter = true;
 
                     talk = [ "org.freedesktop.Notifications" ] ++ ext.talk;
-                    own =
-                      (optionals (app.id != null) [
-                        "${id}.*"
-                        "org.mpris.MediaPlayer2.${id}.*"
-                      ])
-                      ++ ext.own;
+                    own = [
+                      "${id}.*"
+                      "org.mpris.MediaPlayer2.${id}.*"
+                    ] ++ ext.own;
 
                     inherit (ext) call broadcast;
                   };
@@ -78,7 +94,7 @@ in
                       };
                     in
                     {
-                      session_bus = if app.dbus.session != null then (app.dbus.session (extendDBusDefault app.id)) else (extendDBusDefault app.id default);
+                      session_bus = if app.dbus.session != null then (app.dbus.session (extendDBusDefault id)) else (extendDBusDefault id default);
                       system_bus = app.dbus.system;
                     };
                   command = if app.command == null then app.name else app.command;
@@ -87,8 +103,6 @@ in
                   isGraphical = if app.gpu != null then app.gpu else app.capability.wayland || app.capability.x11;
 
                   conf = {
-                    inherit (app) id;
-
                     path =
                       if app.path == null then
                         pkgs.writeScript "${app.name}-start" ''
@@ -99,16 +113,15 @@ in
                         app.path;
                     args = if app.args == null then [ "${app.name}-start" ] else app.args;
 
-                    inherit enablements;
+                    inherit id enablements;
 
                     inherit (dbusConfig) session_bus system_bus;
                     direct_wayland = app.insecureWayland;
 
-                    username = getsubname fid aid;
-                    data = getsubhome fid aid;
+                    username = getsubname fid app.identity;
+                    data = getsubhome fid app.identity;
 
-                    identity = aid;
-                    inherit (app) groups;
+                    inherit (app) identity groups;
 
                     container = {
                       inherit (app)
@@ -188,10 +201,9 @@ in
                 pkgs.writeShellScriptBin app.name ''
                   exec fortify${if app.verbose then " -v" else ""} app ${pkgs.writeText "fortify-${app.name}.json" (builtins.toJSON conf)} $@
                 ''
-              ) cfg.apps;
-            in
-            foldr (
-              app: acc:
+              )
+            ]
+            ++ (
               let
                 pkg = if app.share != null then app.share else pkgs.${app.name};
                 copy = source: "[ -d '${source}' ] && cp -Lrv '${source}' $out/share || true";
@@ -211,30 +223,33 @@ in
                   fi
                 ''
               )
-              ++ acc
-            ) (wrappers ++ [ cfg.package ]) cfg.apps;
+            )
+            ++ acc
+          ) [ cfg.package ] cfg.apps;
         }) cfg.users;
       in
       {
         useUserPackages = false; # prevent users.users entries from being added
 
-        users = foldlAttrs (
-          acc: _: fid:
-          mkMerge [
-            (mergeAttrsList (
-              # aid 0 is reserved
-              imap1 (aid: app: {
-                ${getsubname fid aid} = mkMerge [
-                  cfg.extraHomeConfig
-                  app.extraConfig
-                  { home.packages = app.packages; }
-                ];
-              }) cfg.apps
-            ))
-            { ${getsubname fid 0} = cfg.extraHomeConfig; }
+        users = mkMerge (
+          foldlAttrs (
+            acc: _: fid:
             acc
-          ]
-        ) privPackages cfg.users;
+            ++ foldlAttrs (
+              acc': _: app:
+              acc'
+              ++ [
+                {
+                  ${getsubname fid app.identity} = mkMerge [
+                    cfg.extraHomeConfig
+                    app.extraConfig
+                    { home.packages = app.packages; }
+                  ];
+                }
+              ]
+            ) [ { ${getsubname fid 0} = cfg.extraHomeConfig; } ] cfg.apps
+          ) [ privPackages ] cfg.users
+        );
       };
 
     users =
@@ -250,33 +265,27 @@ in
         getgroup = fid: aid: { gid = getsubuid fid aid; };
       in
       {
-        users = foldlAttrs (
-          acc: _: fid:
-          mkMerge [
-            (mergeAttrsList (
-              # aid 0 is reserved
-              imap1 (aid: _: {
-                ${getsubname fid aid} = getuser fid aid;
-              }) cfg.apps
-            ))
-            { ${getsubname fid 0} = getuser fid 0; }
+        users = mkMerge (
+          foldlAttrs (
+            acc: _: fid:
             acc
-          ]
-        ) { } cfg.users;
+            ++ foldlAttrs (
+              acc': _: app:
+              acc' ++ [ { ${getsubname fid app.identity} = getuser fid app.identity; } ]
+            ) [ { ${getsubname fid 0} = getuser fid 0; } ] cfg.apps
+          ) [ ] cfg.users
+        );
 
-        groups = foldlAttrs (
-          acc: _: fid:
-          mkMerge [
-            (mergeAttrsList (
-              # aid 0 is reserved
-              imap1 (aid: _: {
-                ${getsubname fid aid} = getgroup fid aid;
-              }) cfg.apps
-            ))
-            { ${getsubname fid 0} = getgroup fid 0; }
+        groups = mkMerge (
+          foldlAttrs (
+            acc: _: fid:
             acc
-          ]
-        ) { } cfg.users;
+            ++ foldlAttrs (
+              acc': _: app:
+              acc' ++ [ { ${getsubname fid app.identity} = getgroup fid app.identity; } ]
+            ) [ { ${getsubname fid 0} = getgroup fid 0; } ] cfg.apps
+          ) [ ] cfg.users
+        );
       };
   };
 }

options.nix

@@ -76,6 +76,7 @@ in
         type =
           let
             inherit (types)
+              ints
               str
               bool
               package
@@ -87,7 +88,7 @@ in
               functionTo
               ;
           in
-          listOf (submodule {
+          attrsOf (submodule {
             options = {
               name = mkOption {
                 type = str;
@@ -98,13 +99,13 @@ in
 
               verbose = mkEnableOption "launchers with verbose output";
 
-              id = mkOption {
-                type = nullOr str;
-                default = null;
+              identity = mkOption {
+                type = ints.between 1 9999;
                 description = ''
-                  Freedesktop application ID.
+                  Application identity. Identity 0 is reserved for system services.
                 '';
               };
+              shareUid = mkEnableOption "sharing identity with another application";
 
               packages = mkOption {
                 type = listOf package;
@@ -273,7 +274,7 @@ in
               };
             };
           });
-        default = [ ];
+        default = { };
         description = ''
           Declaratively configured fortify apps.
         '';

test/configuration.nix

@@ -99,9 +99,10 @@
       home.stateVersion = "23.05";
     };
 
-    apps = [
-      {
+    apps = {
+      "cat.gensokyo.extern.foot.noEnablements" = {
         name = "ne-foot";
+        identity = 1;
         verbose = true;
         share = pkgs.foot;
         packages = with pkgs; [
@@ -115,17 +116,21 @@
           dbus = false;
           pulse = false;
         };
-      }
-      {
+      };
+
+      "cat.gensokyo.extern.foot.pulseaudio" = {
         name = "pa-foot";
+        identity = 2;
         verbose = true;
         share = pkgs.foot;
         packages = [ pkgs.foot ];
         command = "foot";
         capability.dbus = false;
-      }
-      {
+      };
+
+      "cat.gensokyo.extern.Alacritty.x11" = {
         name = "x11-alacritty";
+        identity = 3;
         verbose = true;
         share = pkgs.alacritty;
         packages = with pkgs; [
@@ -142,9 +147,11 @@
           dbus = false;
           pulse = false;
         };
-      }
-      {
+      };
+
+      "cat.gensokyo.extern.foot.directWayland" = {
         name = "da-foot";
+        identity = 4;
         verbose = true;
         insecureWayland = true;
         share = pkgs.foot;
@@ -159,9 +166,11 @@
           dbus = false;
           pulse = false;
         };
-      }
-      {
+      };
+
+      "cat.gensokyo.extern.strace.wantFail" = {
         name = "strace-failure";
+        identity = 5;
         verbose = true;
         share = pkgs.strace;
         command = "strace true";
@@ -171,7 +180,7 @@
           dbus = false;
           pulse = false;
         };
-      }
-    ];
+      };
+    };
   };
 }

test/sandbox/case/default.nix

@@ -24,7 +24,7 @@ let
   };
 
   callTestCase =
-    path:
+    path: identity:
     let
       tc = import path {
         inherit
@@ -36,6 +36,7 @@ let
     in
     {
       name = "check-sandbox-${tc.name}";
+      inherit identity;
       verbose = true;
       inherit (tc)
         tty
@@ -51,10 +52,12 @@ let
         (toString (builtins.toFile "fortify-${tc.name}-want.json" (builtins.toJSON tc.want)))
       ];
     };
+
+  testCaseName = name: "cat.gensokyo.fortify.test." + name;
 in
 {
-  preset = callTestCase ./preset.nix;
-  tty = callTestCase ./tty.nix;
-  mapuid = callTestCase ./mapuid.nix;
-  device = callTestCase ./device.nix;
+  ${testCaseName "preset"} = callTestCase ./preset.nix 1;
+  ${testCaseName "tty"} = callTestCase ./tty.nix 2;
+  ${testCaseName "mapuid"} = callTestCase ./mapuid.nix 3;
+  ${testCaseName "device"} = callTestCase ./device.nix 4;
 }

test/sandbox/configuration.nix

@@ -6,7 +6,6 @@
 }:
 let
   testProgram = pkgs.callPackage ./tool/package.nix { inherit (config.environment.fortify.package) version; };
-  testCases = import ./case lib testProgram;
 in
 {
   users.users = {
@@ -76,11 +75,6 @@ in
       }
     ];
 
-    apps = with testCases; [
-      preset
-      tty
-      mapuid
-      device
-    ];
+    apps = import ./case lib testProgram;
   };
 }