Skip to content

Commit 383914f

Browse files
fly602fly602
committed
chore: 安全整改, 修改使用GetConnPID来获取用户的环境变量,改成使用GetConnUID
使用GetConnUID替代GetConnPID来获取调用者的运行环境 Log: 使用GetConnUID替代GetConnPID来获取调用者的运行环境 PMS: TASK-381283 Influence: security
1 parent 8c10a4a commit 383914f

10 files changed

Lines changed: 180 additions & 224 deletions

File tree

‎accounts1/manager_ifc.go‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ import (
2020
"github.com/linuxdeepin/dde-daemon/accounts1/users"
2121
login1 "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.login1"
2222
"github.com/linuxdeepin/go-lib/dbusutil"
23-
"github.com/linuxdeepin/go-lib/gettext"
24-
"github.com/linuxdeepin/go-lib/procfs"
2523
"github.com/linuxdeepin/go-lib/users/passwd"
2624
dutils "github.com/linuxdeepin/go-lib/utils"
2725
)
@@ -303,19 +301,6 @@ func (m *Manager) IsUsernameValid(sender dbus.Sender, name string) (valid bool,
303301
busErr = dbusutil.ToError(err)
304302
}()
305303

306-
pid, err := m.service.GetConnPID(string(sender))
307-
if err != nil {
308-
return
309-
}
310-
311-
p := procfs.Process(pid)
312-
environ, err := p.Environ()
313-
if err != nil {
314-
return
315-
}
316-
317-
locale := environ.Get("LANG")
318-
319304
// 如果新建用户使用的用户名和域用户名一致，提示用户该用户已经存在
320305
if m.isDomainUserExist(name) {
321306
info = checkers.ErrCodeExist.Error()
@@ -328,11 +313,6 @@ func (m *Manager) IsUsernameValid(sender dbus.Sender, name string) (valid bool,
328313
}
329314

330315
msg = info.Error.Error()
331-
logger.Debug("locale:", locale)
332-
if locale != "" {
333-
gettext.SetLocale(gettext.LcAll, locale)
334-
msg = gettext.Tr(msg)
335-
}
336316
code = int32(info.Code)
337317
return
338318
}

‎accounts1/user.go‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ import (
2222
glib "github.com/linuxdeepin/go-gir/glib-2.0"
2323
"github.com/linuxdeepin/go-lib/dbusutil"
2424
"github.com/linuxdeepin/go-lib/gdkpixbuf"
25-
"github.com/linuxdeepin/go-lib/procfs"
2625
"github.com/linuxdeepin/go-lib/strv"
2726
dutils "github.com/linuxdeepin/go-lib/utils"
2827
)
@@ -276,22 +275,6 @@ func getUserGreeterBackground(kf *glib.KeyFile) (string, bool) {
276275
return greeterBg, true
277276
}
278277

279-
func (u *User) getSenderDBus(sender dbus.Sender) string {
280-
pid, err := u.service.GetConnPID(string(sender))
281-
if err != nil {
282-
logger.Warning(err)
283-
return ""
284-
}
285-
proc := procfs.Process(pid)
286-
exe, err := proc.Exe()
287-
if err != nil {
288-
logger.Warning(err)
289-
return ""
290-
}
291-
logger.Debug(" [getSenderDBus] sender exe : ", exe)
292-
return exe
293-
}
294-
295278
func (u *User) updateIconList() {
296279
u.IconList = u.getAllIcons()
297280
_ = u.emitPropChangedIconList(u.IconList)

‎accounts1/user_ifc.go‎

Lines changed: 11 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1250,27 +1250,25 @@ func (u *User) SetSecretQuestions(sender dbus.Sender, list map[int][]byte) *dbus
12501250
}
12511251

12521252
func (u *User) SetSecretKey(sender dbus.Sender, secretKey string) *dbus.Error {
1253-
senderName := u.getSenderDBus(sender)
1254-
logger.Debugf("[SetSecretKey] sender : %s, senderName : %s, UserName : %s : ", sender, senderName, u.UserName)
1255-
if !strings.Contains(senderName, controlCenter) {
1256-
return dbusutil.ToError(errors.New("invalid sender"))
1253+
err := u.checkAuth(sender, true, polkitActionUserAdministration)
1254+
if err != nil {
1255+
return dbusutil.ToError(err)
12571256
}
12581257

12591258
if u.uadpInterface == nil {
12601259
return nil
12611260
}
1262-
err := u.uadpInterface.Set(0, u.UserName, []uint8(secretKey))
1261+
err = u.uadpInterface.Set(0, u.UserName, []uint8(secretKey))
12631262
if err != nil {
12641263
return dbusutil.ToError(err)
12651264
}
12661265
return nil
12671266
}
12681267

12691268
func (u *User) GetSecretKey(sender dbus.Sender, username string) (string, *dbus.Error) {
1270-
senderName := u.getSenderDBus(sender)
1271-
logger.Debugf("[GetSecretKey] sender : %s, senderName : %s, UserName : %s : ", sender, senderName, username)
1272-
if !(strings.Contains(senderName, resetPasswordDia) || strings.Contains(senderName, controlCenter)) {
1273-
return "", dbusutil.ToError(errors.New("invalid sender"))
1269+
err := u.checkAuth(sender, true, polkitActionUserAdministration)
1270+
if err != nil {
1271+
return "", dbusutil.ToError(err)
12741272
}
12751273
if u.uadpInterface == nil {
12761274
return "", nil
@@ -1283,16 +1281,15 @@ func (u *User) GetSecretKey(sender dbus.Sender, username string) (string, *dbus.
12831281
}
12841282

12851283
func (u *User) DeleteSecretKey(sender dbus.Sender) *dbus.Error {
1286-
senderName := u.getSenderDBus(sender)
1287-
logger.Debugf("[DeleteSecretKey] sender : %s, senderName : %s, UserName : %s : ", sender, senderName, u.UserName)
1288-
if !strings.Contains(senderName, controlCenter) {
1289-
return dbusutil.ToError(errors.New("invalid sender"))
1284+
err := u.checkAuth(sender, true, polkitActionUserAdministration)
1285+
if err != nil {
1286+
return dbusutil.ToError(err)
12901287
}
12911288

12921289
if u.uadpInterface == nil {
12931290
return nil
12941291
}
1295-
err := u.uadpInterface.Delete(0, u.UserName)
1292+
err = u.uadpInterface.Delete(0, u.UserName)
12961293
if err != nil {
12971294
return dbusutil.ToError(err)
12981295
}

‎dbus/dbus.go‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,9 @@ package dbus
66

77
import (
88
"github.com/godbus/dbus/v5"
9+
login1 "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.login1"
910
"github.com/linuxdeepin/go-lib"
11+
"github.com/linuxdeepin/go-lib/dbusutil"
1012
)
1113

1214
// IsSessionBusActivated check the special session bus name whether activated
@@ -36,3 +38,54 @@ func releaseDBusName(bus *dbus.Conn, name string) {
3638
_, _ = bus.ReleaseName(name)
3739
}
3840
}
41+
42+
// GetSessionType 通过 UID 从 login1 获取 session type，比使用 PID 更安全
43+
// 返回 session type: "x11", "wayland", "tty" 等
44+
func GetSessionType(service *dbusutil.Service, sender dbus.Sender) (string, error) {
45+
// 使用 GetConnUID 替代 GetConnPID，更安全
46+
uid, err := service.GetConnUID(string(sender))
47+
if err != nil {
48+
return "", err
49+
}
50+
51+
// 获取系统总线连接
52+
systemConn, err := dbus.SystemBus()
53+
if err != nil {
54+
return "", err
55+
}
56+
57+
// 创建 login1 Manager
58+
loginManager := login1.NewManager(systemConn)
59+
60+
// 通过 UID 获取用户对象路径
61+
userPath, err := loginManager.GetUser(0, uid)
62+
if err != nil {
63+
return "", err
64+
}
65+
66+
// 创建 User 对象
67+
user, err := login1.NewUser(systemConn, userPath)
68+
if err != nil {
69+
return "", err
70+
}
71+
72+
// 获取用户的 Display session（主要的图形会话）
73+
sessionInfo, err := user.Display().Get(0)
74+
if err != nil {
75+
return "", err
76+
}
77+
78+
// 创建 Session 对象
79+
session, err := login1.NewSession(systemConn, sessionInfo.Path)
80+
if err != nil {
81+
return "", err
82+
}
83+
84+
// 获取 session type (x11, wayland, tty 等)
85+
sessionType, err := session.Type().Get(0)
86+
if err != nil {
87+
return "", err
88+
}
89+
90+
return sessionType, nil
91+
}

‎grub2/grub2.go‎

Lines changed: 41 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818

1919
dbus "github.com/godbus/dbus/v5"
2020
"github.com/linuxdeepin/dde-daemon/grub_common"
21+
accounts "github.com/linuxdeepin/go-dbus-factory/system/org.deepin.dde.accounts1"
2122
ofdbus "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.dbus"
2223
"github.com/linuxdeepin/go-lib/dbusutil"
2324
"github.com/linuxdeepin/go-lib/log"
@@ -520,18 +521,21 @@ func (g *Grub2) addModifyTask(task modifyTask) {
520521
}
521522

522523
func (g *Grub2) getSenderLang(sender dbus.Sender) (string, error) {
523-
pid, err := g.service.GetConnPID(string(sender))
524+
// 使用 GetConnUID 获取用户 UID
525+
uid, err := g.service.GetConnUID(string(sender))
524526
if err != nil {
525527
return "", err
526528
}
527529

528-
p := procfs.Process(pid)
529-
environ, err := p.Environ()
530+
// 从 Accounts1 获取用户的 Locale 属性
531+
locale, err := getUserLocaleFromAccounts(uid)
530532
if err != nil {
531-
return "", err
533+
logger.Debug("failed to get user locale from Accounts1:", err)
534+
// 回退到系统默认 locale
535+
return os.Getenv("LANG"), nil
532536
}
533537

534-
return environ.Get("LANG"), nil
538+
return locale, nil
535539
}
536540

537541
func getXEnvWithSender(service *dbusutil.Service, sender dbus.Sender) (map[string]string, error) {
@@ -689,3 +693,35 @@ func setFstartState(state bool) error {
689693
}
690694
return nil
691695
}
696+
697+
// getUserLocaleFromAccounts 从 Accounts1 服务获取用户的 Locale 属性
698+
func getUserLocaleFromAccounts(uid uint32) (string, error) {
699+
systemConn, err := dbus.SystemBus()
700+
if err != nil {
701+
return "", err
702+
}
703+
704+
// 创建 Accounts Manager 对象
705+
accountsManager := accounts.NewAccounts(systemConn)
706+
707+
// 调用 FindUserById 方法获取用户对象路径
708+
// 注意：FindUserById 接受 string 类型的 UID
709+
userPathStr, err := accountsManager.FindUserById(0, strconv.FormatUint(uint64(uid), 10))
710+
if err != nil {
711+
return "", err
712+
}
713+
714+
// 创建 User 对象
715+
user, err := accounts.NewUser(systemConn, dbus.ObjectPath(userPathStr))
716+
if err != nil {
717+
return "", err
718+
}
719+
720+
// 获取 Locale 属性
721+
locale, err := user.Locale().Get(0)
722+
if err != nil {
723+
return "", err
724+
}
725+
726+
return locale, nil
727+
}

‎grub2/grub2_ifc.go‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ import (
1010
"strings"
1111

1212
dbus "github.com/godbus/dbus/v5"
13+
ddedbus "github.com/linuxdeepin/dde-daemon/dbus"
1314
"github.com/linuxdeepin/dde-daemon/grub_common"
1415
"github.com/linuxdeepin/go-lib/dbusutil"
15-
"github.com/linuxdeepin/go-lib/procfs"
1616
)
1717

1818
const (
@@ -53,22 +53,16 @@ func (grub *Grub2) GetSimpleEntryTitles(sender dbus.Sender) (titles []string, bu
5353

5454
func (g *Grub2) GetAvailableGfxmodes(sender dbus.Sender) (gfxModes []string, busErr *dbus.Error) {
5555
// 只读操作，无需鉴权
56-
pid, err := g.service.GetConnPID(string(sender))
56+
sessionType, err := ddedbus.GetSessionType(g.service, sender)
5757
if err != nil {
58+
logger.Warning("failed to get session type:", err)
5859
return nil, dbusutil.ToError(err)
5960
}
6061

61-
p := procfs.Process(pid)
62-
envVars, err := p.Environ()
63-
if err != nil {
64-
return nil, dbusutil.ToError(err)
65-
}
66-
67-
sessionType := envVars.Get("XDG_SESSION_TYPE")
68-
69-
if sessionType == "wayland" {
62+
switch sessionType {
63+
case "wayland":
7064
logger.Debug("wayland desktop environment, can not acquire output info")
71-
} else if sessionType == "x11" {
65+
case "x11":
7266
g.service.DelayAutoQuit()
7367
modes, err := g.getAvailableGfxmodes(sender)
7468
if err != nil {
@@ -80,8 +74,8 @@ func (g *Grub2) GetAvailableGfxmodes(sender dbus.Sender) (gfxModes []string, bus
8074
for idx, m := range modes {
8175
gfxModes[idx] = m.String()
8276
}
83-
} else {
84-
logger.Debug("unkown session type, can not acquire output info")
77+
default:
78+
logger.Debug("unknown session type, can not acquire output info")
8579
}
8680

8781
return gfxModes, nil

0 commit comments

Comments
 (0)