This allows KWin to securely identify the client for a given connection, without relying on the process name. This patch does not do anything meaningful with the application ID other than store it. This first version does not support kwin restarts, it can come afterwards. Testing done: With latest flatpak, running `WAYLAND_DEBUG=1 flatpak run org.telegram.desktop |& grep security` shows that flatpak itself bound the security context, and the client did not see it advertised.wilder/Plasma/6.2
David Edmundson
2 years ago
parent
411953ee37
commit
4f9531ad77
14 changed files with 532 additions and 0 deletions
@ -0,0 +1,207 @@ |
||||
/*
|
||||
KWin - the KDE window manager |
||||
This file is part of the KDE project. |
||||
|
||||
SPDX-FileCopyrightText: 2023 David Edmundson <davidedmundson@kde.org> |
||||
|
||||
SPDX-License-Identifier: GPL-2.0-or-later |
||||
*/ |
||||
#include "kwin_wayland_test.h" |
||||
|
||||
#include "wayland/clientconnection.h" |
||||
#include "wayland/display.h" |
||||
#include "wayland_server.h" |
||||
|
||||
#include <QTemporaryFile> |
||||
|
||||
#include "KWayland/Client/connection_thread.h" |
||||
#include "KWayland/Client/registry.h" |
||||
|
||||
#include <sys/socket.h> |
||||
#include <sys/un.h> |
||||
#include <unistd.h> |
||||
|
||||
namespace KWin |
||||
{ |
||||
|
||||
static const QString s_socketName = QStringLiteral("wayland_test_security_context-0"); |
||||
|
||||
class SecurityContextTest : public QObject |
||||
{ |
||||
Q_OBJECT |
||||
|
||||
private Q_SLOTS: |
||||
void initTestCase(); |
||||
void init(); |
||||
void cleanup(); |
||||
void testSecurityContext(); |
||||
void testClosedCloseFdOnStartup(); |
||||
}; |
||||
|
||||
void SecurityContextTest::initTestCase() |
||||
{ |
||||
QSignalSpy applicationStartedSpy(kwinApp(), &Application::started); |
||||
QVERIFY(waylandServer()->init(s_socketName)); |
||||
kwinApp()->start(); |
||||
QVERIFY(applicationStartedSpy.wait()); |
||||
} |
||||
|
||||
void SecurityContextTest::init() |
||||
{ |
||||
QVERIFY(Test::setupWaylandConnection(Test::AdditionalWaylandInterface::SecurityContextManagerV1)); |
||||
} |
||||
|
||||
void SecurityContextTest::cleanup() |
||||
{ |
||||
Test::destroyWaylandConnection(); |
||||
} |
||||
|
||||
void SecurityContextTest::testSecurityContext() |
||||
{ |
||||
// This tests a mock flatpak server creating a Security Context
|
||||
// connecting a client to the newly created server
|
||||
// and making sure everything is torn down after the closeFd is closed
|
||||
auto securityContextManager = Test::waylandSecurityContextManagerV1(); |
||||
QVERIFY(securityContextManager); |
||||
|
||||
int listenFd = socket(AF_UNIX, SOCK_STREAM, 0); |
||||
QVERIFY(listenFd != 0); |
||||
|
||||
QTemporaryDir tempDir; |
||||
|
||||
sockaddr_un sockaddr; |
||||
sockaddr.sun_family = AF_UNIX; |
||||
snprintf(sockaddr.sun_path, sizeof(sockaddr.sun_path), "%s", tempDir.filePath("socket").toUtf8().constData()); |
||||
qDebug() << "listening socket:" << sockaddr.sun_path; |
||||
QVERIFY(bind(listenFd, (struct sockaddr *)&sockaddr, sizeof(sockaddr)) == 0); |
||||
QVERIFY(listen(listenFd, 0) == 0); |
||||
|
||||
int syncFds[2]; |
||||
QVERIFY(pipe(syncFds) >= 0); |
||||
int closeFdForClientToKeep = syncFds[0]; |
||||
int closeFdToGiveToKwin = syncFds[1]; |
||||
|
||||
auto securityContext = new QtWayland::wp_security_context_v1(securityContextManager->create_listener(listenFd, closeFdToGiveToKwin)); |
||||
close(closeFdToGiveToKwin); |
||||
close(listenFd); |
||||
securityContext->set_instance_id("kde.unitest.instance_id"); |
||||
securityContext->set_app_id("kde.unittest.app_id"); |
||||
securityContext->set_sandbox_engine("test_sandbox_engine"); |
||||
securityContext->commit(); |
||||
securityContext->destroy(); |
||||
delete securityContext; |
||||
|
||||
qputenv("WAYLAND_DISPLAY", tempDir.filePath("socket").toUtf8()); |
||||
QSignalSpy clientConnectedspy(waylandServer()->display(), &Display::clientConnected); |
||||
|
||||
// connect a client using the newly created listening socket
|
||||
KWayland::Client::ConnectionThread restrictedClientConnection; |
||||
QSignalSpy connectedSpy(&restrictedClientConnection, &KWayland::Client::ConnectionThread::connected); |
||||
QThread restictedClientThread; |
||||
auto restictedClientThreadQuitter = qScopeGuard([&restictedClientThread]() { |
||||
restictedClientThread.quit(); |
||||
restictedClientThread.wait(); |
||||
}); |
||||
restrictedClientConnection.moveToThread(&restictedClientThread); |
||||
restictedClientThread.start(); |
||||
restrictedClientConnection.initConnection(); |
||||
QVERIFY(connectedSpy.wait()); |
||||
|
||||
// verify that our new restricted client is seen by kwin with the right security context
|
||||
QVERIFY(clientConnectedspy.count()); |
||||
QCOMPARE(clientConnectedspy.first().first().value<KWin::ClientConnection *>()->securityContextAppId(), "kde.unittest.app_id"); |
||||
|
||||
// verify that the globals for the restricted client does not contain the security context
|
||||
KWayland::Client::Registry registry; |
||||
registry.create(&restrictedClientConnection); |
||||
QSignalSpy interfaceAnnounced(®istry, &KWayland::Client::Registry::interfaceAnnounced); |
||||
QSignalSpy allAnnouncedSpy(®istry, &KWayland::Client::Registry::interfacesAnnounced); |
||||
registry.setup(); |
||||
QVERIFY(allAnnouncedSpy.wait()); |
||||
for (auto interfaceSignal : interfaceAnnounced) { |
||||
QVERIFY(interfaceSignal.first().toString() != "wp_security_context_manager_v1"); |
||||
} |
||||
|
||||
// close the mock flatpak closeFDs
|
||||
close(closeFdForClientToKeep); |
||||
|
||||
// security context properties should have not changed after close-fd is closed
|
||||
QVERIFY(Test::waylandSync()); |
||||
QCOMPARE(clientConnectedspy.first().first().value<KWin::ClientConnection *>()->securityContextAppId(), "kde.unittest.app_id"); |
||||
|
||||
// new clients can't connect anymore
|
||||
KWayland::Client::ConnectionThread restrictedClientConnection2; |
||||
QSignalSpy connectedSpy2(&restrictedClientConnection2, &KWayland::Client::ConnectionThread::connected); |
||||
QSignalSpy failedSpy2(&restrictedClientConnection2, &KWayland::Client::ConnectionThread::failed); |
||||
QThread restictedClientThread2; |
||||
auto restictedClientThreadQuitter2 = qScopeGuard([&restictedClientThread2]() { |
||||
restictedClientThread2.quit(); |
||||
restictedClientThread2.wait(); |
||||
}); |
||||
restrictedClientConnection2.moveToThread(&restictedClientThread2); |
||||
restictedClientThread2.start(); |
||||
restrictedClientConnection2.initConnection(); |
||||
QVERIFY(failedSpy2.wait()); |
||||
QVERIFY(connectedSpy2.isEmpty()); |
||||
} |
||||
|
||||
void SecurityContextTest::testClosedCloseFdOnStartup() |
||||
{ |
||||
// This tests what would happen if the closeFd is already closed when kwin processes the security context
|
||||
auto securityContextManager = Test::waylandSecurityContextManagerV1(); |
||||
QVERIFY(securityContextManager); |
||||
|
||||
int listenFd = socket(AF_UNIX, SOCK_STREAM, 0); |
||||
QVERIFY(listenFd != 0); |
||||
|
||||
QTemporaryDir tempDir; |
||||
|
||||
sockaddr_un sockaddr; |
||||
sockaddr.sun_family = AF_UNIX; |
||||
snprintf(sockaddr.sun_path, sizeof(sockaddr.sun_path), "%s", tempDir.filePath("socket").toUtf8().constData()); |
||||
qDebug() << "listening socket:" << sockaddr.sun_path; |
||||
QVERIFY(bind(listenFd, (struct sockaddr *)&sockaddr, sizeof(sockaddr)) == 0); |
||||
QVERIFY(listen(listenFd, 0) == 0); |
||||
|
||||
int syncFds[2]; |
||||
QVERIFY(pipe(syncFds) >= 0); |
||||
int closeFdForClientToKeep = syncFds[0]; |
||||
int closeFdToGiveToKwin = syncFds[1]; |
||||
|
||||
close(closeFdForClientToKeep); // closes the connection
|
||||
|
||||
auto securityContext = new QtWayland::wp_security_context_v1(securityContextManager->create_listener(listenFd, closeFdToGiveToKwin)); |
||||
close(closeFdToGiveToKwin); |
||||
close(listenFd); |
||||
securityContext->set_instance_id("kde.unitest.instance_id"); |
||||
securityContext->set_app_id("kde.unittest.app_id"); |
||||
securityContext->set_sandbox_engine("test_sandbox_engine"); |
||||
securityContext->commit(); |
||||
securityContext->destroy(); |
||||
delete securityContext; |
||||
|
||||
QVERIFY(Test::waylandSync()); |
||||
|
||||
qputenv("WAYLAND_DISPLAY", tempDir.filePath("socket").toUtf8()); |
||||
QSignalSpy clientConnectedspy(waylandServer()->display(), &Display::clientConnected); |
||||
|
||||
// new clients can't connect anymore
|
||||
KWayland::Client::ConnectionThread restrictedClientConnection; |
||||
QSignalSpy connectedSpy(&restrictedClientConnection, &KWayland::Client::ConnectionThread::connected); |
||||
QSignalSpy failedSpy(&restrictedClientConnection, &KWayland::Client::ConnectionThread::failed); |
||||
QThread restictedClientThread; |
||||
auto restictedClientThreadQuitter = qScopeGuard([&restictedClientThread]() { |
||||
restictedClientThread.quit(); |
||||
restictedClientThread.wait(); |
||||
}); |
||||
restrictedClientConnection.moveToThread(&restictedClientThread); |
||||
restictedClientThread.start(); |
||||
restrictedClientConnection.initConnection(); |
||||
QVERIFY(failedSpy.wait()); |
||||
QVERIFY(connectedSpy.isEmpty()); |
||||
QVERIFY(clientConnectedspy.isEmpty()); |
||||
} |
||||
} |
||||
|
||||
WAYLANDTEST_MAIN(KWin::SecurityContextTest) |
||||
#include "security_context_test.moc" |
||||
@ -0,0 +1,152 @@ |
||||
/*
|
||||
SPDX-FileCopyrightText: 2023 David Edmundson <davidedmundson@kde.org> |
||||
|
||||
SPDX-License-Identifier: LGPL-2.1-only OR LGPL-3.0-only OR LicenseRef-KDE-Accepted-LGPL |
||||
*/ |
||||
#include "securitycontext_v1.h" |
||||
#include "display.h" |
||||
#include "utils/filedescriptor.h" |
||||
#include "wayland/display_p.h" |
||||
|
||||
#include <qwayland-server-security-context-v1.h> |
||||
|
||||
#include <QDebug> |
||||
|
||||
class QSocketNotifier; |
||||
|
||||
namespace KWin |
||||
{ |
||||
static const quint32 s_version = 1; |
||||
|
||||
class SecurityContextManagerV1InterfacePrivate : public QtWaylandServer::wp_security_context_manager_v1 |
||||
{ |
||||
public: |
||||
SecurityContextManagerV1InterfacePrivate(Display *display); |
||||
|
||||
protected: |
||||
void wp_security_context_manager_v1_create_listener(Resource *resource, uint32_t id, int32_t listen_fd, int32_t close_fd); |
||||
|
||||
private: |
||||
Display *m_display; |
||||
}; |
||||
|
||||
class SecurityContextV1Interface : public QtWaylandServer::wp_security_context_v1 |
||||
{ |
||||
public: |
||||
SecurityContextV1Interface(Display *display, int listenFd, int closeFd, wl_resource *resource); |
||||
|
||||
protected: |
||||
void wp_security_context_v1_set_sandbox_engine(Resource *resource, const QString &name) override; |
||||
void wp_security_context_v1_set_app_id(Resource *resource, const QString &app_id) override; |
||||
void wp_security_context_v1_set_instance_id(Resource *resource, const QString &instance_id) override; |
||||
void wp_security_context_v1_commit(Resource *resource) override; |
||||
void wp_security_context_v1_destroy_resource(Resource *resource) override; |
||||
void wp_security_context_v1_destroy(Resource *resource) override; |
||||
|
||||
private: |
||||
Display *m_display; |
||||
FileDescriptor m_listenFd; |
||||
FileDescriptor m_closeFd; |
||||
bool m_committed = false; |
||||
QString m_sandboxEngine; |
||||
QString m_appId; |
||||
QString m_instanceId; |
||||
}; |
||||
|
||||
SecurityContextManagerV1Interface::SecurityContextManagerV1Interface(Display *display, QObject *parent) |
||||
: QObject(parent) |
||||
, d(new SecurityContextManagerV1InterfacePrivate(display)) |
||||
{ |
||||
} |
||||
|
||||
SecurityContextManagerV1Interface::~SecurityContextManagerV1Interface() |
||||
{ |
||||
} |
||||
|
||||
SecurityContextManagerV1InterfacePrivate::SecurityContextManagerV1InterfacePrivate(Display *display) |
||||
: QtWaylandServer::wp_security_context_manager_v1(*display, s_version) |
||||
, m_display(display) |
||||
{ |
||||
} |
||||
|
||||
void SecurityContextManagerV1InterfacePrivate::wp_security_context_manager_v1_create_listener(Resource *resource, uint32_t id, int32_t listen_fd, int32_t close_fd) |
||||
{ |
||||
auto *securityContextResource = wl_resource_create(resource->client(), &wp_security_context_v1_interface, resource->version(), id); |
||||
if (!securityContextResource) { |
||||
wl_resource_post_no_memory(resource->handle); |
||||
return; |
||||
} |
||||
new SecurityContextV1Interface(m_display, listen_fd, close_fd, securityContextResource); |
||||
} |
||||
|
||||
SecurityContextV1Interface::SecurityContextV1Interface(Display *display, int listenFd, int closeFd, wl_resource *resource) |
||||
: QtWaylandServer::wp_security_context_v1(resource) |
||||
, m_display(display) |
||||
, m_listenFd(listenFd) |
||||
, m_closeFd(closeFd) |
||||
{ |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_set_sandbox_engine(Resource *resource, const QString &name) |
||||
{ |
||||
if (m_committed) { |
||||
wl_resource_post_error(resource->handle, error_already_used, "Already committed"); |
||||
return; |
||||
} |
||||
m_sandboxEngine = name; |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_set_app_id(Resource *resource, const QString &app_id) |
||||
{ |
||||
if (m_committed) { |
||||
wl_resource_post_error(resource->handle, error_already_used, "Already committed"); |
||||
return; |
||||
} |
||||
if (app_id.isEmpty()) { |
||||
wl_resource_post_error(resource->handle, error_invalid_metadata, "App ID cannot be empty"); |
||||
return; |
||||
} |
||||
m_appId = app_id; |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_set_instance_id(Resource *resource, const QString &instance_id) |
||||
{ |
||||
if (m_committed) { |
||||
wl_resource_post_error(resource->handle, error_already_used, "Already committed"); |
||||
return; |
||||
} |
||||
m_instanceId = instance_id; |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_commit(Resource *resource) |
||||
{ |
||||
if (m_committed) { |
||||
wl_resource_post_error(resource->handle, error_already_used, "Already committed"); |
||||
return; |
||||
} |
||||
if (m_appId.isEmpty()) { |
||||
wl_resource_post_error(resource->handle, error_invalid_metadata, "App ID cannot be empty"); |
||||
return; |
||||
} |
||||
if (m_sandboxEngine.isEmpty()) { |
||||
wl_resource_post_error(resource->handle, error_invalid_metadata, "Sandbox engine cannot be empty"); |
||||
return; |
||||
} |
||||
|
||||
m_committed = true; |
||||
|
||||
// lifespan is managed by the closeFD's state
|
||||
new SecurityContext(m_display, std::move(m_listenFd), std::move(m_closeFd), m_appId); |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_destroy_resource(Resource *resource) |
||||
{ |
||||
delete this; |
||||
} |
||||
|
||||
void SecurityContextV1Interface::wp_security_context_v1_destroy(Resource *resource) |
||||
{ |
||||
wl_resource_destroy(resource->handle); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,25 @@ |
||||
/*
|
||||
SPDX-FileCopyrightText: 2023 David Edmundson <davidedmundson@kde.org> |
||||
|
||||
SPDX-License-Identifier: LGPL-2.1-only OR LGPL-3.0-only OR LicenseRef-KDE-Accepted-LGPL |
||||
*/ |
||||
#include <QObject> |
||||
|
||||
namespace KWin |
||||
{ |
||||
|
||||
class SecurityContextManagerV1InterfacePrivate; |
||||
class SecurityContextManagerV1Interface; |
||||
class Display; |
||||
|
||||
class SecurityContextManagerV1Interface : public QObject |
||||
{ |
||||
Q_OBJECT |
||||
public: |
||||
SecurityContextManagerV1Interface(Display *display, QObject *parent = nullptr); |
||||
~SecurityContextManagerV1Interface() override; |
||||
|
||||
private: |
||||
std::unique_ptr<SecurityContextManagerV1InterfacePrivate> d; |
||||
}; |
||||
} |
||||
Loading…
Reference in new issue