fix: change cross-app accessed dconfig items from private to public - #157
fix: change cross-app accessed dconfig items from private to public#15718202781743 wants to merge 1 commit into
Conversation
- Add AppIdResolver class to resolve caller appId via AM Identify + /proc fallback - Add hasPermissionByVisibility() to enforce private config access control - Add getCallerAppId() for standard appId resolution (separate from getAppid() which returns process path) - Add parseConfigAppId() to extract config owner appId from file path - Insert visibility checks in value(), setValue(), reset(), isDefaultValue() - Return AccessDenied DBus error when non-owner appId accesses private config - Use mutable members to avoid const_cast in const methods - Use RAII for libdbus-1 resource management in identifyByAM() - Connect to user session bus via dbus_connection_open_private for cross-bus AM access PMS: BUG-000000
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @18202781743, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: 18202781743 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Reviewer's GuideImplements appId-aware visibility enforcement for dconfig items by introducing an AppIdResolver, wiring it into the dconfig daemon connection/server, and adding a new visibility-based permission check around all DConfig operations. This allows cross-app public items while restricting private items to their owning appId. Sequence diagram for visibility-based dconfig access controlsequenceDiagram
participant ClientApp
participant DBus
participant DSGConfigConn
participant AppIdResolver
ClientApp->>DBus: call setValue(key, value)
DBus->>DSGConfigConn: setValue(key, value)
DSGConfigConn->>DSGConfigConn: hasPermissionByUid(key)
DSGConfigConn->>DSGConfigConn: hasPermissionByVisibility(key)
alt meta visibility is Public
DSGConfigConn-->>DSGConfigConn: allow access
else meta visibility is Private
DSGConfigConn->>DSGConfigConn: getCallerAppId()
DSGConfigConn->>AppIdResolver: resolveAppId(service, pid, uid)
AppIdResolver-->>DSGConfigConn: callerAppId
alt callerAppId == configAppId
DSGConfigConn-->>DSGConfigConn: allow access
else callerAppId != configAppId
DSGConfigConn-->>DBus: sendErrorReply(AccessDenied,...)
end
end
note over DSGConfigConn: On allow, continues to setValue
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin pr auto review★ 总体评分：40分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 // 修复方案：移除不安全的 fallback，并在 AM 不可用时拒绝 private 访问
// appidresolver.cpp
QString AppIdResolver::resolveAppId(const ConnServiceName &service, uint pid, uint uid)
{
if (m_cache.contains(service)) {
return m_cache.value(service);
}
QString appId;
#ifdef Q_OS_LINUX
appId = identifyByAM(pid, uid);
// 移除 fallbackFromProc 调用，防止伪造
#else
appId = QString();
#endif
if (!appId.isEmpty()) {
m_cache.insert(service, appId);
}
return appId;
}
// dconfigconn.cpp
bool DSGConfigConn::hasPermissionByVisibility(const QString &key) const
{
if (!calledFromDBus())
return true;
if (meta()->visibility(key) == DConfigFile::Public)
return true;
const QString &callerAppId = getCallerAppId();
const QString &configAppId = m_configAppId;
if (configAppId.isEmpty() || configAppId == VirtualInterAppId)
return true;
// 如果 callerAppId 为空，说明 AM 不可用且无安全 fallback，直接拒绝
if (callerAppId.isEmpty()) {
sendErrorReply(QDBusError::AccessDenied, "Cannot resolve caller appId, access denied for private config.");
return false;
}
if (callerAppId == configAppId)
return true;
QString errorMsg = QString("[%1] No permission to access private config item [%2] in [%3], owner appId is [%4].")
.arg(callerAppId).arg(key).arg(m_key).arg(configAppId);
sendErrorReply(QDBusError::AccessDenied, errorMsg);
return false;
}
// dconfigserver.cpp
// 建议增加缓存以优化性能
QString DSGConfigServer::parseConfigAppId(const QString &name, const QString &subpath)
{
static QHash<QString, QString> s_appIdCache;
QString cacheKey = name + "/" + subpath;
if (s_appIdCache.contains(cacheKey)) {
return s_appIdCache.value(cacheKey);
}
const QStringList metaDirs = DConfigMeta::genericMetaDirs(m_localPrefix);
for (const QString &dir : metaDirs) {
QDirIterator it(dir, QStringList() << name + ".json",
QDir::Files | QDir::Readable, QDirIterator::Subdirectories);
while (it.hasNext()) {
QString path = it.next();
ConfigureId configId = getMetaConfigureId(path);
if (configId.resource == name && configId.subpath == subpath) {
if (!configId.appid.isEmpty()) {
s_appIdCache.insert(cacheKey, configId.appid);
return configId.appid;
}
}
}
}
s_appIdCache.insert(cacheKey, QString());
return QString();
} |
|
@18202781743: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
2 participants
fix: change cross-app accessed dconfig items from private to public
变更说明
具体修改的配置项
技术方案简述
关联的其他 PR
Summary by Sourcery
Enforce app ID–based visibility checks for dconfig items and introduce an AppIdResolver utility for resolving caller identities from DBus services, including build wiring.
Enhancements:
Build: