From 76cab04b4d7828f3c4f607c49e1e6ad78aa6e3da Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Thu, 1 Dec 2016 21:36:43 -0500 Subject: [PATCH] Implement permit and reject commands --- config.d/{security => security.in} | 8 +-- config => config.in | 8 +-- include/security.h | 9 --- include/sway/commands.h | 2 + include/sway/security.h | 6 +- sway/commands.c | 2 + sway/commands/permit.c | 95 ++++++++++++++++++++++++++++++ sway/security.c | 7 +++ 8 files changed, 115 insertions(+), 22 deletions(-) rename config.d/{security => security.in} (88%) rename config => config.in (98%) delete mode 100644 include/security.h create mode 100644 sway/commands/permit.c diff --git a/config.d/security b/config.d/security.in similarity index 88% rename from config.d/security rename to config.d/security.in index fe75d8ea5..f59b2980d 100644 --- a/config.d/security +++ b/config.d/security.in @@ -6,10 +6,10 @@ # installation. # Configures which programs are allowed to use which sway features -permit $PREFIX/swaylock lock -permit $PREFIX/swaybar panel -permit $PREFIX/swaybg background -permit $PREFIX/swaygrab screenshot +permit __PREFIX__/swaylock lock +permit __PREFIX__/swaybar panel +permit __PREFIX__/swaybg background +permit __PREFIX__/swaygrab screenshot permit * fullscreen keyboard mouse diff --git a/config b/config.in similarity index 98% rename from config rename to config.in index 47bf1e4fd..ddd0fec5c 100644 --- a/config +++ b/config.in @@ -195,10 +195,4 @@ bar { } } -# You may want this: -# -# include ~/.config/sway/conf.d/* -# -# Protip: -# -# include ~/.config/sway/`hostname`/* +include __SYSCONFDIR__/etc/sway/config.d/* diff --git a/include/security.h b/include/security.h deleted file mode 100644 index 3a5dbca07..000000000 --- a/include/security.h +++ /dev/null @@ -1,9 +0,0 @@ -#ifndef _SWAY_SECURITY_H -#define _SWAY_SECURITY_H -#include -#include "sway/config.h" - -enum secure_features get_feature_policy(pid_t pid); -enum command_context get_command_policy(const char *cmd); - -#endif diff --git a/include/sway/commands.h b/include/sway/commands.h index db5e94d9b..1d5d56ac0 100644 --- a/include/sway/commands.h +++ b/include/sway/commands.h @@ -122,6 +122,8 @@ sway_cmd cmd_new_float; sway_cmd cmd_new_window; sway_cmd cmd_orientation; sway_cmd cmd_output; +sway_cmd cmd_permit; +sway_cmd cmd_reject; sway_cmd cmd_reload; sway_cmd cmd_resize; sway_cmd cmd_scratchpad; diff --git a/include/sway/security.h b/include/sway/security.h index efc25ce66..ae2de0d80 100644 --- a/include/sway/security.h +++ b/include/sway/security.h @@ -3,7 +3,9 @@ #include #include "sway/config.h" -const struct feature_permissions *get_permissions(pid_t pid); -enum command_context get_command_context(const char *cmd); +enum secure_feature get_feature_policy(pid_t pid); +enum command_context get_command_policy(const char *cmd); + +struct feature_policy *alloc_feature_policy(const char *program); #endif diff --git a/sway/commands.c b/sway/commands.c index de29a7af5..e2bafcb2d 100644 --- a/sway/commands.c +++ b/sway/commands.c @@ -187,6 +187,8 @@ static struct cmd_handler handlers[] = { { "new_float", cmd_new_float }, { "new_window", cmd_new_window }, { "output", cmd_output }, + { "permit", cmd_permit }, + { "reject", cmd_reject }, { "reload", cmd_reload }, { "resize", cmd_resize }, { "scratchpad", cmd_scratchpad }, diff --git a/sway/commands/permit.c b/sway/commands/permit.c new file mode 100644 index 000000000..8a7bb98cc --- /dev/null +++ b/sway/commands/permit.c @@ -0,0 +1,95 @@ +#include +#include "sway/commands.h" +#include "sway/config.h" +#include "sway/security.h" +#include "log.h" + +static enum secure_feature get_features(int argc, char **argv, + struct cmd_results **error) { + enum secure_feature features = 0; + + struct { + char *name; + enum secure_feature feature; + } feature_names[] = { + { "lock", FEATURE_LOCK }, + { "panel", FEATURE_PANEL }, + { "background", FEATURE_BACKGROUND }, + { "screenshot", FEATURE_SCREENSHOT }, + { "fullscreen", FEATURE_FULLSCREEN }, + { "keyboard", FEATURE_KEYBOARD }, + { "mouse", FEATURE_MOUSE }, + }; + size_t names_len = sizeof(feature_names) / + (sizeof(char *) + sizeof(enum secure_feature)); + + for (int i = 1; i < argc; ++i) { + size_t j; + for (j = 0; j < names_len; ++j) { + if (strcmp(feature_names[j].name, argv[i]) == 0) { + break; + } + } + if (j == names_len) { + *error = cmd_results_new(CMD_INVALID, + "permit", "Invalid feature grant %s", argv[i]); + return 0; + } + features |= feature_names[j].feature; + } + return features; +} + +static struct feature_policy *get_policy(const char *name) { + struct feature_policy *policy = NULL; + for (int i = 0; i < config->feature_policies->length; ++i) { + struct feature_policy *p = config->feature_policies->items[i]; + if (strcmp(p->program, name) == 0) { + policy = p; + break; + } + } + if (!policy) { + policy = alloc_feature_policy(name); + list_add(config->feature_policies, policy); + } + return policy; +} + +struct cmd_results *cmd_permit(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "permit", EXPECTED_MORE_THAN, 1))) { + return error; + } + + struct feature_policy *policy = get_policy(argv[0]); + policy->features |= get_features(argc, argv, &error); + + if (error) { + return error; + } + + sway_log(L_DEBUG, "Permissions granted to %s for features %d", + policy->program, policy->features); + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} + +struct cmd_results *cmd_reject(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "reject", EXPECTED_MORE_THAN, 1))) { + return error; + } + + struct feature_policy *policy = get_policy(argv[0]); + policy->features &= ~get_features(argc, argv, &error); + + if (error) { + return error; + } + + sway_log(L_DEBUG, "Permissions granted to %s for features %d", + policy->program, policy->features); + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} diff --git a/sway/security.c b/sway/security.c index 00e5e8d78..776bd5279 100644 --- a/sway/security.c +++ b/sway/security.c @@ -4,6 +4,13 @@ #include "sway/security.h" #include "log.h" +struct feature_policy *alloc_feature_policy(const char *program) { + struct feature_policy *policy = malloc(sizeof(struct feature_policy)); + policy->program = strdup(program); + policy->features = FEATURE_FULLSCREEN | FEATURE_KEYBOARD | FEATURE_MOUSE; + return policy; +} + enum secure_feature get_feature_policy(pid_t pid) { const char *fmt = "/proc/%d/exe"; int pathlen = snprintf(NULL, 0, fmt, pid);