ScreenshotEffect: Use Service Property to authorize screenshot without confirmation
ClosedPublic

Authored by meven on May 4 2020, 1:43 PM.

Details

Reviewers
apol
davidedmundson
bport
zzag
Group Reviewers
KWin
Summary

Restrict to process with X-KDE-DBUS-Restricted-Interfaces=org.kde.kwin.Screenshot in their corresponding Service file,
to take screenshots.
Such a program can now take immediate screenshots.

Adds a utility file to group KService related logic.

Needed for D29408

Diff Detail

Repository
R108 KWin
Branch
arcpatch-D29407
Lint
No Linters Available
Unit
No Unit Test Coverage
Build Status
Buildable 27131
Build 27149: arc lint + arc unit
meven created this revision.May 4 2020, 1:43 PM
Restricted Application added a project: KWin. · View Herald TranscriptMay 4 2020, 1:43 PM
Restricted Application added a subscriber: kwin. · View Herald Transcript
meven requested review of this revision.May 4 2020, 1:43 PM
apol added inline comments.May 4 2020, 1:54 PM
effects/screenshot/screenshot.cpp
79

But this is not a wayland interface, is it? :/

meven added inline comments.May 4 2020, 1:56 PM
effects/screenshot/screenshot.cpp
79

I am abusing things here by using the same X-KDE-Wayland-Interfaces for authorized Wayland protocol and DBUS interface.
Do you think it is necessary to separate the two ?
Maybe just this variable name ?

meven edited the summary of this revision. (Show Details)May 4 2020, 2:46 PM
ngraham added a subscriber: ngraham.EditedMay 4 2020, 6:51 PM

Can you provide a bit more explanation on what this is doing?

meven edited the summary of this revision. (Show Details)May 5 2020, 5:36 AM
meven edited the summary of this revision. (Show Details)
meven edited the summary of this revision. (Show Details)May 5 2020, 5:38 AM
meven planned changes to this revision.May 5 2020, 4:19 PM

TODO:
remove X-KDE-Original-Executable
use KApplicationTrader::query instead of KServiceTypeTrader
Probably add support for a X-KDE-DBus-Restricted-Interfaces in services_utils

meven edited the summary of this revision. (Show Details)May 7 2020, 1:16 PM
meven updated this revision to Diff 82199.May 7 2020, 1:28 PM

Use KApplicationTrader instead of KServiceTypeTrader, differentiate DBus and Wayland interface

meven updated this revision to Diff 82222.May 7 2020, 4:33 PM

Improve include

meven added a comment.May 11 2020, 8:50 AM

It has been reminded me that this solution to have some security rest entirely on the guarantees offered by $XDG_DATA_DIRS.
Same can be said about X-KDE-Wayland-Interfaces.

But currently I believe this does not constitutes a strong security model.
A malicious executable could manufacture a fake $XDG_DATA_DIRS, add an application folder in it and a desktop file for its executable, trigger kbuildsyscoca5 and then use any of the restricted interfaces.
We would need further to restrict path for which we would consider the desktop file, for instance, like only root owned path.

meven added a comment.May 13 2020, 5:09 PM

I guess it is for 5.20.

meven added a reviewer: zzag.May 15 2020, 8:59 AM
apol added a comment.May 15 2020, 2:15 PM

Patch looks good to me overall.

service_utils.h
46

move implementations to service_utils.cpp?

67

fetchRequestedWaylandInterfaces?

meven updated this revision to Diff 82953.May 15 2020, 2:55 PM
meven marked an inline comment as done.

Improve naming of fetchRequestedWaylandInterfaces

service_utils.h
46

I tried to do it, but I encountered errors.
Unless I am mistaken it is because this static function is shared with effects and effects are compiled to a separate shared lib.
So I would need to make a new build target for this one file to be able to share it with KWin::Core unless copied in both binaries.

meven added a comment.May 15 2020, 2:58 PM

It has been reminded me that this solution to have some security rest entirely on the guarantees offered by $XDG_DATA_DIRS.
Same can be said about X-KDE-Wayland-Interfaces.

But currently I believe this does not constitutes a strong security model.
A malicious executable could manufacture a fake $XDG_DATA_DIRS, add an application folder in it and a desktop file for its executable, trigger kbuildsyscoca5 and then use any of the restricted interfaces.
We would need further to restrict path for which we would consider the desktop file, for instance, like only root owned path.

And if you have any suggestion regarding this.
In relation to this, wayland_server.cpp has a isTrustedOrigin function that checks using a hash if the executable matches the own in /proc/<pid>/exe

meven marked 2 inline comments as done.May 20 2020, 10:00 AM

So this should be good for merging @apol after spectacle D29408 has been rebased and D29487 has landed

ngraham added inline comments.Jun 1 2020, 4:02 AM
effects/screenshot/screenshot.cpp
505

whitespace

effects/screenshot/screenshot.h
157

whitespace

meven updated this revision to Diff 83246.Jun 8 2020, 7:27 AM
meven marked an inline comment as done.

Remove whitespace & rebase

meven marked an inline comment as done.Jun 8 2020, 7:27 AM
meven added inline comments.Jun 8 2020, 1:43 PM
service_utils.h
49

We might want to tolerate non-absolute path for simplicity provided the exe are first in path.
Pseudo code :

if (!service->exec()->isAbsolute() {
exec = QStandardPaths::findExecutable(service->exec())
meven updated this revision to Diff 83256.Jun 10 2020, 7:59 AM

Fix emails in copyrights

zzag added inline comments.Jun 10 2020, 8:15 AM
effects/screenshot/screenshot.cpp
79

This is not a proper d-bus interface name.

meven added inline comments.Jun 10 2020, 8:24 AM
effects/screenshot/screenshot.cpp
79

I am well-aware.

This is a key that application's desktop file must declare in a X-KDE-DBUS-Restricted-Interfaces field.
Like https://invent.kde.org/graphics/spectacle/-/merge_requests/3/diffs

So I should rename and add some comments, I guess.

meven updated this revision to Diff 83257.Jun 10 2020, 8:29 AM

Add documentation, improve variable naming

meven marked 4 inline comments as done.Jun 10 2020, 8:30 AM
meven updated this revision to Diff 83259.Jun 10 2020, 1:58 PM

Use Real DBus interface name as required value in X-KDE-DBUS-Restricted-Interfaces

meven edited the summary of this revision. (Show Details)Jun 10 2020, 1:58 PM
meven marked an inline comment as done.Jun 11 2020, 8:40 AM
meven marked an inline comment as not done.
zzag added a comment.Jun 11 2020, 9:02 AM

In general, +1. I'm not certain about what a better place to put the new service utilities is, though. Perhaps it's better to move them to libkwineffects or something. Either way, it can be revisited later...

service_utils.h
39

We're going to use wrong logging caterogy if code below is invoked from the screenshot effect.

meven added inline comments.Jun 11 2020, 9:32 AM
service_utils.h
39

I should pass in the log category I guess.

zzag added inline comments.Jun 11 2020, 9:56 AM
service_utils.h
39

or maybe just print the log messages somewhere else.

meven updated this revision to Diff 83262.Jun 11 2020, 3:23 PM

Add a KWIN_UTILS logging category

meven marked 3 inline comments as done.Jun 11 2020, 3:32 PM

This should be ready.

meven added inline comments.Jun 15 2020, 9:42 AM
service_utils.h
43

string should be "kwin_utils" I believe.

meven marked an inline comment as done.Jun 16 2020, 8:11 AM
meven added a comment.Jun 16 2020, 9:16 AM

@zzag I believe I can land now

davidedmundson accepted this revision.Jun 16 2020, 2:54 PM
This revision is now accepted and ready to land.Jun 16 2020, 2:54 PM
meven closed this revision.Jun 16 2020, 5:00 PM