Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Dont run browser as root #5058

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Dont run browser as root #5058

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
00c5364
webui: Handle XAUTHORITY and XDG_RUNTIME_DIR
halfline Aug 19, 2023
8420c14
webui: Store browser in array
halfline Aug 20, 2023
28ea45b
webui: Run browser as liveuser instead of root
halfline Aug 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 8 additions & 4 deletions data/liveinst/liveinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,13 +22,17 @@
# unprivileged, restart running as root.
if [ "$(id -u)" -ne 0 ]; then
xhost +si:localuser:root
unset XAUTHORITY
pkexec "$0" "$@"
fi

# pkexec clears DBUS_SESSION_BUS_ADDRESS from environment
if [ -z "$DBUS_SESSION_BUS_ADDRESS" ]; then
export DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${PKEXEC_UID}/bus
# pkexec clears the environment, so get it back
if [ -n "${PKEXEC_UID}" ]; then
INSTALLER_USER=$(id -n -u "${PKEXEC_UID}")
readarray -t user_environment < <(pkexec --user "${INSTALLER_USER}" env XDG_RUNTIME_DIR="/run/user/${PKEXEC_UID}" systemctl --user show-environment)

for variable in "${user_environment[@]}"; do
export "$variable"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shellcheck says:

data/liveinst/liveinst:34:16: warning: This does not export 'variable'. Remove $/${} for that, or use ${var?} to quiet. [SC2163]

If you know what you're doing (you do), alternatively, # shellcheck disable=SC2163

Check warning

Code scanning / shellcheck

This does not export 'variable'. Remove $/${} for that, or use ${var?} to quiet. Warning

This does not export 'variable'. Remove $/${} for that, or use ${var?} to quiet.
done
fi

# Allow running another command in the place of anaconda, but in this same
Expand Down
3 changes: 0 additions & 3 deletions ui/webui/firefox-theme/default/user.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,6 @@ user_pref("browser.startup.page", 0);
user_pref("browser.startup.homepage", "about:blank");
user_pref("browser.startup.homepage_override.once", {});

// Use a window manager titlebar
user_pref("browser.tabs.inTitlebar", 0);

// Hide the bookmarks
user_pref("browser.toolbars.bookmarks.visibility", "never");

Expand Down
23 changes: 18 additions & 5 deletions ui/webui/webui-desktop
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,24 +66,35 @@ esac

# prepare empty firefox profile dir with theme based on the passed profile id
FIREFOX_THEME_DIR="/usr/share/anaconda/firefox-theme"
FIREFOX_PROFILE_PATH="/tmp/anaconda-firefox-profile"

# PKEXEC_UID is the uid for "gnome-initial-setup" or "liveuser"
# depending on how the installer gets started.
#
# It's unset on non-live-images, so we just use the current user then (root)
if [ -n "$PKEXEC_UID" ]; then
INSTALLER_USER=$(id -n -u ${PKEXEC_UID})
else
INSTALLER_USER=$(id -n -u)
fi

FIREFOX_PROFILE_PATH="${XDG_RUNTIME_DIR}/anaconda/firefox-profile"

# make sure the profile directory exists and is empty
if [ -d ${FIREFOX_PROFILE_PATH} ]
then
echo "Cleaning up existing Anaconda Firefox profile directory."
rm -rf ${FIREFOX_PROFILE_PATH}
fi
mkdir -p ${FIREFOX_PROFILE_PATH}
pkexec --user "${INSTALLER_USER}" mkdir -p ${FIREFOX_PROFILE_PATH}

# populate the profile directory with our custom Firefox theme
# - theme id is passed as the second argument of this script
THEME_PATH="${FIREFOX_THEME_DIR}/${THEME_ID}"

cp -a "${THEME_PATH}/." ${FIREFOX_PROFILE_PATH}
pkexec --user "${INSTALLER_USER}" cp -a "${THEME_PATH}/." ${FIREFOX_PROFILE_PATH}

# FIXME: is this hardcoded resolution necessary ?
BROWSER="/usr/bin/firefox --new-instance --window-size 1024,768 --profile ${FIREFOX_PROFILE_PATH}"
BROWSER=(/usr/bin/firefox --new-instance --window-size "1024,768" --profile "${FIREFOX_PROFILE_PATH}")

# start browser in a temporary home dir, so that it does not interfere with your real one
BROWSER_HOME=$(mktemp --directory --tmpdir cockpit.desktop.XXXXXX)
Expand Down Expand Up @@ -122,7 +133,9 @@ else
sleep 3
fi

HOME="$BROWSER_HOME" MOZ_APP_TITLE="" MOZ_APP_REMOTINGNAME="liveinst" XDG_CURRENT_DESKTOP=GNOME MOZ_GTK_TITLEBAR_DECORATION=client $BROWSER http://"$WEBUI_ADDRESS""$URL_PATH" &
readarray -t user_environment < <(pkexec --user "${INSTALLER_USER}" env XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR}" systemctl --user show-environment)

HOME="$BROWSER_HOME" MOZ_APP_TITLE="" MOZ_APP_REMOTINGNAME="liveinst" XDG_CURRENT_DESKTOP=GNOME MOZ_GTK_TITLEBAR_DECORATION=client pkexec --user $INSTALLER_USER env "${user_environment[@]}" "${BROWSER[@]}" http://"$WEBUI_ADDRESS""$URL_PATH" &
B_PID=$!

wait $B_PID