Skip to content
This repository was archived by the owner on May 14, 2025. It is now read-only.

Commit 95b50dd

Browse files
fly602fly602
committed
feat: 修复dde-api-proxy安全漏洞
dde-api-proxy系统级的dbus接口，使用普通用户也可以使用，有安全问题，因此添加了polkit鉴权。 Log: 修复dde-api-proxy安全漏洞 pms: task-371895
1 parent 35402c7 commit 95b50dd

15 files changed

Lines changed: 143 additions & 0 deletions

‎misc/CMakeLists.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,6 @@ install(FILES ${INSTALL_SYSTEMD_SYSTEM} DESTINATION lib/systemd/system/)
1313

1414
file(GLOB_RECURSE INSTALL_SYSTEMD_USER ${CMAKE_CURRENT_SOURCE_DIR}/systemd/user/*.service)
1515
install(FILES ${INSTALL_SYSTEMD_USER} DESTINATION lib/systemd/user/)
16+
17+
file(GLOB_RECURSE INSTALL_POLKIT_1 ${CMAKE_CURRENT_SOURCE_DIR}/polkit-1/actions/*.policy)
18+
install(FILES ${INSTALL_POLKIT_1} DESTINATION share/polkit-1/actions/)

‎misc/polkit-1/actions/org.deepin.dde.api.proxy.policy‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy 1.0//EN"
3+
"http://www.freedesktop.org/standards/PolicyKit/1.0/policykit-policy.dtd">
4+
<policyconfig>
5+
<action id="org.deepin.dde.api.proxy">
6+
<message>Authentication is required to call the system proxy interface</message>
7+
<message xml:lang="zh_CN">调用系统代理接口需要认证</message>
8+
<defaults>
9+
<allow_any>no</allow_any>
10+
<allow_inactive>no</allow_inactive>
11+
<allow_active>auth_admin_keep</allow_active>
12+
</defaults>
13+
<allow_users>
14+
<user>root</user>
15+
</allow_users>
16+
</action>
17+
</policyconfig>

‎src/dbus-proxy/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ find_package(Qt${QT_VERSION_MAJOR} COMPONENTS Core DBus REQUIRED)
1313
find_package(PkgConfig REQUIRED)
1414
find_package(DtkCore REQUIRED)
1515
find_package(DtkTools REQUIRED)
16+
find_package(PolkitQt5-1 REQUIRED)
1617

1718
macro(qt5_add_dbus_proxy_interface_fix srcs xml class file neednamespace)
1819
if(${neednamespace})

‎src/dbus-proxy/common/dbusproxybase.hpp‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
#include <QtCore/QStringList>
2121
#include <QtCore/QVariant>
2222
#include <QtDBus/QtDBus>
23+
#include <PolkitQt1/Authority>
2324

2425
DCORE_USE_NAMESPACE
2526

@@ -89,6 +90,28 @@ class DBusProxyBase : public QDBusVirtualObject {
8990
m_filterMethods = list;
9091
}
9192

93+
// 不设置默认不检验，全部有权限；设置了后list中指定的才有权限
94+
void InitCheckAuthorization(QMap<QString,QString> list) {
95+
m_checkAuthentication = true;
96+
m_methodActions = list;
97+
}
98+
99+
bool checkAuthorization(const QString &actionId, const QString &service,const QDBusConnection &connection) const
100+
{
101+
auto pid = connection.interface()->servicePid(service).value();
102+
auto authority = PolkitQt1::Authority::instance();
103+
auto result = authority->checkAuthorizationSync(actionId,
104+
PolkitQt1::UnixProcessSubject(pid),
105+
PolkitQt1::Authority::AllowUserInteraction);
106+
if (authority->hasError()) {
107+
qWarning() << "checkAuthorizationSync failed:" << authority->lastError()
108+
<< authority->errorDetails();
109+
return false;
110+
}
111+
112+
return result == PolkitQt1::Authority::Result::Yes;
113+
}
114+
92115
virtual bool handleMessage(const QDBusMessage &message, const QDBusConnection &connection)
93116
{
94117
qInfo() << "[statistics]";
@@ -110,6 +133,14 @@ class DBusProxyBase : public QDBusVirtualObject {
110133
connection.send(message.createErrorReply("com.deepin.dde.error.NotAllowed", "is not allowed"));
111134
return true;
112135
}
136+
if (m_checkAuthentication && m_methodActions.contains(message.member())) {
137+
if (!checkAuthorization(m_methodActions[message.member()], message.service(), connection)) {
138+
qInfo() << m_proxyDbusInterface << "method authentication:" << message.member() << "is not allowed.";
139+
connection.send(message.createErrorReply("com.deepin.dde.error.NotAllowed", "is not allowed"));
140+
return true;
141+
}
142+
}
143+
113144
QDBusPendingCall call = m_proxy->asyncCallWithArgumentList(message.member(), message.arguments());
114145
call.waitForFinished();
115146
connection.send(message.createReply(call.reply().arguments()));
@@ -476,6 +507,8 @@ class DBusProxyBase : public QDBusVirtualObject {
476507
QStringList m_filterProperies;
477508
bool m_filterMethodsEnable;
478509
QStringList m_filterMethods;
510+
bool m_checkAuthentication;
511+
QMap<QString, QString> m_methodActions;
479512
// subpath
480513
QMap<QString, DBusProxyBase *> m_pathMap;
481514
QMap<QString, DBusProxySubPathInfo> m_pathInfoMap;

‎src/dbus-proxy/v1/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ target_link_libraries(${PRO_NAME}
7878
Qt${QT_VERSION_MAJOR}::Core
7979
Qt${QT_VERSION_MAJOR}::DBus
8080
${DtkCore_LIBRARIES}
81+
PolkitQt5-1::Core
8182
)
8283
target_include_directories(${PRO_NAME} PUBLIC
8384
${CMAKE_CURRENT_SOURCE_DIR}

‎src/dbus-proxy/v1/system/org_deepin_dde_Accounts1.hpp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,17 @@ class SystemAccounts1Proxy : public DBusProxyBase {
1515
QDBusConnection::BusType dbusType, QObject *parent = nullptr)
1616
: DBusProxyBase(dbusName, dbusPath, dbusInterface, proxyDbusName, proxyDbusPath, proxyDbusInterface, dbusType, parent)
1717
{
18+
QMap<QString, QString> auth;
19+
auth["AllowGuestAccount"] = "org.deepin.dde.api.proxy";
20+
auth["CreateGroup"] = "org.deepin.dde.api.proxy";
21+
auth["CreateGuestAccount"] = "org.deepin.dde.api.proxy";
22+
auth["CreateUser"] = "org.deepin.dde.api.proxy";
23+
auth["DeleteGroup"] = "org.deepin.dde.api.proxy";
24+
auth["DeleteUser"] = "org.deepin.dde.api.proxy";
25+
auth["EnablePasswdChangedHandler"] = "org.deepin.dde.api.proxy";
26+
auth["ModifyGroup"] = "org.deepin.dde.api.proxy";
27+
auth["SetTerminalLocked"] = "org.deepin.dde.api.proxy";
28+
InitCheckAuthorization(auth);
1829
ServiceStart();
1930
}
2031
virtual DDBusExtendedAbstractInterface *initConnect()

‎src/dbus-proxy/v1/system/org_deepin_dde_Accounts1_User.hpp‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,42 @@ class SystemAccounts1UserProxy : public DBusProxyBase {
1313
QDBusConnection::BusType dbusType, QObject *parent = nullptr)
1414
: DBusProxyBase(dbusName, dbusPath, dbusInterface, proxyDbusName, proxyDbusPath, proxyDbusInterface, dbusType, parent)
1515
{
16+
QMap<QString, QString> auth;
17+
auth["AddGroup"] = "org.deepin.dde.api.proxy";
18+
auth["DeleteGroup"] = "org.deepin.dde.api.proxy";
19+
auth["DeleteIconFile"] = "org.deepin.dde.api.proxy";
20+
auth["DeleteSecretKey"] = "org.deepin.dde.api.proxy";
21+
auth["EnableNoPasswdLogin"] = "org.deepin.dde.api.proxy";
22+
auth["EnableWechatAuth"] = "org.deepin.dde.api.proxy";
23+
auth["SetAutomaticLogin"] = "org.deepin.dde.api.proxy";
24+
auth["SetCurrentWorkspace"] = "org.deepin.dde.api.proxy";
25+
auth["SetDesktopBackgrounds"] = "org.deepin.dde.api.proxy";
26+
auth["SetFullName"] = "org.deepin.dde.api.proxy";
27+
auth["SetGreeterBackground"] = "org.deepin.dde.api.proxy";
28+
auth["SetGroups"] = "org.deepin.dde.api.proxy";
29+
auth["SetHistoryLayout"] = "org.deepin.dde.api.proxy";
30+
auth["SetHomeDir"] = "org.deepin.dde.api.proxy";
31+
auth["SetIconFile"] = "org.deepin.dde.api.proxy";
32+
auth["SetLayout"] = "org.deepin.dde.api.proxy";
33+
auth["SetLocale"] = "org.deepin.dde.api.proxy";
34+
auth["SetLocked"] = "org.deepin.dde.api.proxy";
35+
auth["SetLongDateFormat"] = "org.deepin.dde.api.proxy";
36+
auth["SetMaxPasswordAge"] = "org.deepin.dde.api.proxy";
37+
auth["SetPassword"] = "org.deepin.dde.api.proxy";
38+
auth["SetPasswordHint"] = "org.deepin.dde.api.proxy";
39+
auth["SetQuickLogin"] = "org.deepin.dde.api.proxy";
40+
auth["SetSecretKey"] = "org.deepin.dde.api.proxy";
41+
auth["SetSecretQuestions"] = "org.deepin.dde.api.proxy";
42+
auth["SetShell"] = "org.deepin.dde.api.proxy";
43+
auth["SetShortDateFormat"] = "org.deepin.dde.api.proxy";
44+
auth["SetShortTimeFormat"] = "org.deepin.dde.api.proxy";
45+
auth["SetUse24HourFormat"] = "org.deepin.dde.api.proxy";
46+
auth["SetWeekBegins"] = "org.deepin.dde.api.proxy";
47+
auth["SetWeekdayFormat"] = "org.deepin.dde.api.proxy";
48+
auth["UpdateWechatAuthState"] = "org.deepin.dde.api.proxy";
49+
auth["VerifySecretQuestions"] = "org.deepin.dde.api.proxy";
50+
auth["SetLongTimeFormat"] = "org.deepin.dde.api.proxy";
51+
InitCheckAuthorization(auth);
1652
ServiceStart();
1753
}
1854
virtual DDBusExtendedAbstractInterface * initConnect() {

‎src/dbus-proxy/v1/system/org_deepin_dde_AirplaneMode1.hpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,11 @@ class SystemAirplaneMode1Proxy : public DBusProxyBase {
1313
QDBusConnection::BusType dbusType, QObject *parent = nullptr)
1414
: DBusProxyBase(dbusName, dbusPath, dbusInterface, proxyDbusName, proxyDbusPath, proxyDbusInterface, dbusType, parent)
1515
{
16+
QMap<QString, QString> auth;
17+
auth["Enable"] = "org.deepin.dde.api.proxy";
18+
auth["EnableBluetooth"] = "org.deepin.dde.api.proxy";
19+
auth["EnableWifi"] = "org.deepin.dde.api.proxy";
20+
InitCheckAuthorization(auth);
1621
ServiceStart();
1722
}
1823
virtual DDBusExtendedAbstractInterface *initConnect()

‎src/dbus-proxy/v1/system/org_deepin_dde_Display1.hpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ class SystemDisplay1Proxy : public DBusProxyBase {
1515
{
1616
InitFilterProperies(QStringList({}));
1717
InitFilterMethods(QStringList({"GetConfig"}));
18+
QMap<QString, QString> auth;
19+
auth["SetBacklightBrightness"] = "org.deepin.dde.api.proxy";
20+
auth["SetConfig"] = "org.deepin.dde.api.proxy";
21+
InitCheckAuthorization(auth);
1822
ServiceStart();
1923
}
2024
virtual DDBusExtendedAbstractInterface *initConnect()

‎src/dbus-proxy/v1/system/org_deepin_dde_Gesture1.hpp‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@ class SystemGesture1Proxy : public DBusProxyBase {
1515
{
1616
InitFilterProperies(QStringList({}));
1717
InitFilterMethods(QStringList({}));
18+
QMap<QString, QString> auth;
19+
auth["SetEdgeMoveStopDuration"] = "org.deepin.dde.api.proxy";
20+
auth["SetInputIgnore"] = "org.deepin.dde.api.proxy";
21+
auth["SetShortPressDuration"] = "org.deepin.dde.api.proxy";
22+
InitCheckAuthorization(auth);
1823
ServiceStart();
1924
}
2025
virtual DDBusExtendedAbstractInterface *initConnect()

0 commit comments

Comments
 (0)