mirrors/sway
1
0
Fork 0
mirror of https://github.com/swaywm/sway.git synced 2024-11-25 17:31:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add validate_ipc_target()

Browse source
This commit is contained in:
Jerzi Kaminsky 2017-04-15 18:54:42 +03:00
parent bfb99235e3
commit bcf9338ce7
1 changed files with 46 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
sway/security.c
View file

@ -1,4 +1,6 @@
#define _XOPEN_SOURCE 500 #define _XOPEN_SOURCE 500
#include <sys/types.h>
#include <sys/stat.h>
#include <string.h> #include <string.h>
#include <unistd.h> #include <unistd.h>
#include <stdio.h> #include <stdio.h>
@ -6,8 +8,46 @@
#include "sway/security.h" #include "sway/security.h"
#include "log.h" #include "log.h"
static bool validate_ipc_target(const char *program) {
struct stat sb;
sway_log(L_DEBUG, "Validating IPC target '%s'", program);
if (!strcmp(program, "*")) {
return true;
}
if (lstat(program, &sb) == -1) {
return false;
}
if (!S_ISREG(sb.st_mode)) {
sway_log(L_ERROR,
"IPC target '%s' MUST be/point at an existing regular file",
program);
return false;
}
if (sb.st_uid != 0) {
#ifdef NDEBUG
sway_log(L_ERROR, "IPC target '%s' MUST be owned by root", program);
return false;
#else
sway_log(L_INFO, "IPC target '%s' MUST be owned by root (waived for debug build)", program);
return true;
#endif
}
if (sb.st_mode & S_IWOTH) {
sway_log(L_ERROR, "IPC target '%s' MUST NOT be world writable", program);
return false;
}
return true;
}
struct feature_policy *alloc_feature_policy(const char *program) { struct feature_policy *alloc_feature_policy(const char *program) {
uint32_t default_policy = 0; uint32_t default_policy = 0;
if (!validate_ipc_target(program)) {
return NULL;
}
for (int i = 0; i < config->feature_policies->length; ++i) { for (int i = 0; i < config->feature_policies->length; ++i) {
struct feature_policy *policy = config->feature_policies->items[i]; struct feature_policy *policy = config->feature_policies->items[i];
if (strcmp(policy->program, "*") == 0) { if (strcmp(policy->program, "*") == 0) {
@ -26,11 +66,16 @@ struct feature_policy *alloc_feature_policy(const char *program) {
return NULL; return NULL;
} }
policy->features = default_policy; policy->features = default_policy;
return policy; return policy;
} }
struct ipc_policy *alloc_ipc_policy(const char *program) { struct ipc_policy *alloc_ipc_policy(const char *program) {
uint32_t default_policy = 0; uint32_t default_policy = 0;
if (!validate_ipc_target(program)) {
return NULL;
}
for (int i = 0; i < config->ipc_policies->length; ++i) { for (int i = 0; i < config->ipc_policies->length; ++i) {
struct ipc_policy *policy = config->ipc_policies->items[i]; struct ipc_policy *policy = config->ipc_policies->items[i];
if (strcmp(policy->program, "*") == 0) { if (strcmp(policy->program, "*") == 0) {
@ -49,6 +94,7 @@ struct ipc_policy *alloc_ipc_policy(const char *program) {
return NULL; return NULL;
} }
policy->features = default_policy; policy->features = default_policy;
return policy; return policy;
} }