security/hakurei
security/hakurei
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Compare commits

base: security:2ffca6984a03b2daa3bb114f70ea84e71439559a
Branches Tags
security:master
security:develop
security:staging
security:v0.1.1
security:v0.1.0
..
compare: security:f30a439bcd6aa97fac0f99cdd94381ae025aa64d
Branches Tags
security:develop
security:master
security:staging
security:v0.1.1
security:v0.1.0

No commits in common. "2ffca6984a03b2daa3bb114f70ea84e71439559a" and "f30a439bcd6aa97fac0f99cdd94381ae025aa64d" have entirely different histories.
2ffca6984a ... f30a439bcd

7 changed files with 101 additions and 187 deletions
Show Stats Expand all files Collapse all files

60
dbus/config.go
View File

@ -5,7 +5,6 @@ import (
"errors"
"io"
"os"
"strings"
)
// ProxyPair is an upstream dbus address and a downstream socket path.
@ -28,61 +27,6 @@ type Config struct {
Filter bool `json:"filter"`
}
func (c *Config) interfaces(yield func(string) bool) {
for _, iface := range c.See {
if !yield(iface) {
return
}
}
for _, iface := range c.Talk {
if !yield(iface) {
return
}
}
for _, iface := range c.Own {
if !yield(iface) {
return
}
}
for iface := range c.Call {
if !yield(iface) {
return
}
}
for iface := range c.Broadcast {
if !yield(iface) {
return
}
}
}
func (c *Config) checkInterfaces(segment string) error {
for iface := range c.interfaces {
/*
xdg-dbus-proxy fails without output when this condition is not met:
char *dot = strrchr (filter->interface, '.');
if (dot != NULL)
{
*dot = 0;
if (strcmp (dot + 1, "*") != 0)
filter->member = g_strdup (dot + 1);
}
trim ".*" since they are removed before searching for '.':
if (g_str_has_suffix (name, ".*"))
{
name[strlen (name) - 2] = 0;
wildcard = TRUE;
}
*/
if strings.IndexByte(strings.TrimSuffix(iface, ".*"), '.') == -1 {
return &BadInterfaceError{iface, segment}
}
}
return nil
}
func (c *Config) Args(bus ProxyPair) (args []string) {
argc := 2 + len(c.See) + len(c.Talk) + len(c.Own) + len(c.Call) + len(c.Broadcast)
if c.Log {
@ -119,7 +63,9 @@ func (c *Config) Args(bus ProxyPair) (args []string) {
return
}
func (c *Config) Load(r io.Reader) error { return json.NewDecoder(r).Decode(&c) }
func (c *Config) Load(r io.Reader) error {
return json.NewDecoder(r).Decode(&c)
}
// NewConfigFromFile opens the target config file at path and parses its contents into *Config.
func NewConfigFromFile(path string) (*Config, error) {

16
dbus/proxy.go
View File

@ -2,7 +2,6 @@ package dbus
import (
"context"
"fmt"
"io"
"os/exec"
"sync"
@ -15,15 +14,6 @@ import (
// Overriding ProxyName will only affect Proxy instance created after the change.
var ProxyName = "xdg-dbus-proxy"
type BadInterfaceError struct {
Interface string
Segment string
}
func (e *BadInterfaceError) Error() string {
return fmt.Sprintf("bad interface string %q in %s bus configuration", e.Interface, e.Segment)
}
// Proxy holds the state of a xdg-dbus-proxy process, and should never be copied.
type Proxy struct {
helper helper.Helper
@ -76,15 +66,9 @@ func Finalise(sessionBus, systemBus ProxyPair, session, system *Config) (final *
var args []string
if session != nil {
if err = session.checkInterfaces("session"); err != nil {
return
}
args = append(args, session.Args(sessionBus)...)
}
if system != nil {
if err = system.checkInterfaces("system"); err != nil {
return
}
args = append(args, system.Args(systemBus)...)
}

125
nixos.nix
View File

@ -8,10 +8,12 @@ packages:
let
inherit (lib)
lists
mkMerge
mkIf
mapAttrs
mergeAttrsList
imap1
foldr
foldlAttrs
optional
optionals
@ -28,27 +30,6 @@ in
imports = [ (import ./options.nix packages) ];
config = mkIf cfg.enable {
assertions = [
(
let
conflictingApps = foldlAttrs (
acc: id: app:
(
acc
++ foldlAttrs (
acc': id': app':
if id == id' || app.shareUid && app'.shareUid || app.identity != app'.identity then acc' else acc' ++ [ id ]
) [ ] cfg.apps
)
) [ ] cfg.apps;
in
{
assertion = (lists.length conflictingApps) == 0;
message = "the following fortify apps have conflicting identities: " + (builtins.concatStringsSep ", " conflictingApps);
}
)
];
security.wrappers.fsu = {
source = "${cfg.fsuPackage}/bin/fsu";
setuid = true;
@ -68,19 +49,22 @@ in
home-manager =
let
privPackages = mapAttrs (username: fid: {
home.packages = foldlAttrs (
acc: id: app:
[
(
home.packages =
let
# aid 0 is reserved
wrappers = imap1 (
aid: app:
let
extendDBusDefault = id: ext: {
filter = true;
talk = [ "org.freedesktop.Notifications" ] ++ ext.talk;
own = [
own =
(optionals (app.id != null) [
"${id}.*"
"org.mpris.MediaPlayer2.${id}.*"
] ++ ext.own;
])
++ ext.own;
inherit (ext) call broadcast;
};
@ -94,7 +78,7 @@ in
};
in
{
session_bus = if app.dbus.session != null then (app.dbus.session (extendDBusDefault id)) else (extendDBusDefault id default);
session_bus = if app.dbus.session != null then (app.dbus.session (extendDBusDefault app.id)) else (extendDBusDefault app.id default);
system_bus = app.dbus.system;
};
command = if app.command == null then app.name else app.command;
@ -103,6 +87,8 @@ in
isGraphical = if app.gpu != null then app.gpu else app.capability.wayland || app.capability.x11;
conf = {
inherit (app) id;
path =
if app.path == null then
pkgs.writeScript "${app.name}-start" ''
@ -113,15 +99,16 @@ in
app.path;
args = if app.args == null then [ "${app.name}-start" ] else app.args;
inherit id enablements;
inherit enablements;
inherit (dbusConfig) session_bus system_bus;
direct_wayland = app.insecureWayland;
username = getsubname fid app.identity;
data = getsubhome fid app.identity;
username = getsubname fid aid;
data = getsubhome fid aid;
inherit (app) identity groups;
identity = aid;
inherit (app) groups;
container = {
inherit (app)
@ -201,9 +188,10 @@ in
pkgs.writeShellScriptBin app.name ''
exec fortify${if app.verbose then " -v" else ""} app ${pkgs.writeText "fortify-${app.name}.json" (builtins.toJSON conf)} $@
''
)
]
++ (
) cfg.apps;
in
foldr (
app: acc:
let
pkg = if app.share != null then app.share else pkgs.${app.name};
copy = source: "[ -d '${source}' ] && cp -Lrv '${source}' $out/share || true";
@ -223,33 +211,30 @@ in
fi
''
)
)
++ acc
) [ cfg.package ] cfg.apps;
) (wrappers ++ [ cfg.package ]) cfg.apps;
}) cfg.users;
in
{
useUserPackages = false; # prevent users.users entries from being added
users = mkMerge (
foldlAttrs (
users = foldlAttrs (
acc: _: fid:
acc
++ foldlAttrs (
acc': _: app:
acc'
++ [
{
${getsubname fid app.identity} = mkMerge [
mkMerge [
(mergeAttrsList (
# aid 0 is reserved
imap1 (aid: app: {
${getsubname fid aid} = mkMerge [
cfg.extraHomeConfig
app.extraConfig
{ home.packages = app.packages; }
];
}
}) cfg.apps
))
{ ${getsubname fid 0} = cfg.extraHomeConfig; }
acc
]
) [ { ${getsubname fid 0} = cfg.extraHomeConfig; } ] cfg.apps
) [ privPackages ] cfg.users
);
) privPackages cfg.users;
};
users =
@ -265,27 +250,33 @@ in
getgroup = fid: aid: { gid = getsubuid fid aid; };
in
{
users = mkMerge (
foldlAttrs (
users = foldlAttrs (
acc: _: fid:
mkMerge [
(mergeAttrsList (
# aid 0 is reserved
imap1 (aid: _: {
${getsubname fid aid} = getuser fid aid;
}) cfg.apps
))
{ ${getsubname fid 0} = getuser fid 0; }
acc
++ foldlAttrs (
acc': _: app:
acc' ++ [ { ${getsubname fid app.identity} = getuser fid app.identity; } ]
) [ { ${getsubname fid 0} = getuser fid 0; } ] cfg.apps
) [ ] cfg.users
);
]
) { } cfg.users;
groups = mkMerge (
foldlAttrs (
groups = foldlAttrs (
acc: _: fid:
mkMerge [
(mergeAttrsList (
# aid 0 is reserved
imap1 (aid: _: {
${getsubname fid aid} = getgroup fid aid;
}) cfg.apps
))
{ ${getsubname fid 0} = getgroup fid 0; }
acc
++ foldlAttrs (
acc': _: app:
acc' ++ [ { ${getsubname fid app.identity} = getgroup fid app.identity; } ]
) [ { ${getsubname fid 0} = getgroup fid 0; } ] cfg.apps
) [ ] cfg.users
);
]
) { } cfg.users;
};
};
}

13
options.nix
View File

@ -76,7 +76,6 @@ in
type =
let
inherit (types)
ints
str
bool
package
@ -88,7 +87,7 @@ in
functionTo
;
in
attrsOf (submodule {
listOf (submodule {
options = {
name = mkOption {
type = str;
@ -99,13 +98,13 @@ in
verbose = mkEnableOption "launchers with verbose output";
identity = mkOption {
type = ints.between 1 9999;
id = mkOption {
type = nullOr str;
default = null;
description = ''
Application identity. Identity 0 is reserved for system services.
Freedesktop application ID.
'';
};
shareUid = mkEnableOption "sharing identity with another application";
packages = mkOption {
type = listOf package;
@ -274,7 +273,7 @@ in
};
};
});
default = { };
default = [ ];
description = ''
Declaratively configured fortify apps.
'';

33
test/configuration.nix
View File

@ -99,10 +99,9 @@
home.stateVersion = "23.05";
};
apps = {
"cat.gensokyo.extern.foot.noEnablements" = {
apps = [
{
name = "ne-foot";
identity = 1;
verbose = true;
share = pkgs.foot;
packages = with pkgs; [
@ -116,21 +115,17 @@
dbus = false;
pulse = false;
};
};
"cat.gensokyo.extern.foot.pulseaudio" = {
}
{
name = "pa-foot";
identity = 2;
verbose = true;
share = pkgs.foot;
packages = [ pkgs.foot ];
command = "foot";
capability.dbus = false;
};
"cat.gensokyo.extern.Alacritty.x11" = {
}
{
name = "x11-alacritty";
identity = 3;
verbose = true;
share = pkgs.alacritty;
packages = with pkgs; [
@ -147,11 +142,9 @@
dbus = false;
pulse = false;
};
};
"cat.gensokyo.extern.foot.directWayland" = {
}
{
name = "da-foot";
identity = 4;
verbose = true;
insecureWayland = true;
share = pkgs.foot;
@ -166,11 +159,9 @@
dbus = false;
pulse = false;
};
};
"cat.gensokyo.extern.strace.wantFail" = {
}
{
name = "strace-failure";
identity = 5;
verbose = true;
share = pkgs.strace;
command = "strace true";
@ -180,7 +171,7 @@
dbus = false;
pulse = false;
};
};
};
}
];
};
}

13
test/sandbox/case/default.nix
View File

@ -24,7 +24,7 @@ let
};
callTestCase =
path: identity:
path:
let
tc = import path {
inherit
@ -36,7 +36,6 @@ let
in
{
name = "check-sandbox-${tc.name}";
inherit identity;
verbose = true;
inherit (tc)
tty
@ -52,12 +51,10 @@ let
(toString (builtins.toFile "fortify-${tc.name}-want.json" (builtins.toJSON tc.want)))
];
};
testCaseName = name: "cat.gensokyo.fortify.test." + name;
in
{
${testCaseName "preset"} = callTestCase ./preset.nix 1;
${testCaseName "tty"} = callTestCase ./tty.nix 2;
${testCaseName "mapuid"} = callTestCase ./mapuid.nix 3;
${testCaseName "device"} = callTestCase ./device.nix 4;
preset = callTestCase ./preset.nix;
tty = callTestCase ./tty.nix;
mapuid = callTestCase ./mapuid.nix;
device = callTestCase ./device.nix;
}

8
test/sandbox/configuration.nix
View File

@ -6,6 +6,7 @@
}:
let
testProgram = pkgs.callPackage ./tool/package.nix { inherit (config.environment.fortify.package) version; };
testCases = import ./case lib testProgram;
in
{
users.users = {
@ -75,6 +76,11 @@ in
}
];
apps = import ./case lib testProgram;
apps = with testCases; [
preset
tty
mapuid
device
];
};
}