From 08e686bcc7cae532194a525a2cf899cf6a3b71cb Mon Sep 17 00:00:00 2001 From: zhangkun2 Date: Fri, 30 Oct 2026 12:49:48 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20SetLocked=20=E4=BD=BF=E7=94=A8=20readlin?= =?UTF-8?q?k(/proc/PID/exe)=20=E7=B2=BE=E7=A1=AE=E5=8C=B9=E9=85=8D?= =?UTF-8?q?=E6=9B=BF=E4=BB=A3=20cmdline=20=E5=89=8D=E7=BC=80=E5=8C=B9?= =?UTF-8?q?=E9=85=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 修复 CWE-290 认证绕过漏洞：/proc/PID/cmdline 可被同用户进程伪造， 导致任意进程可通过伪装可执行名绕过 SetLocked 鉴权。 - 将鉴权方式从读取 /proc/PID/cmdline + startsWith 前缀匹配 改为 readlink(/proc/PID/exe) + 精确 != 比较 - 新增 #include （PATH_MAX） - 仅允许 /usr/bin/dde-lock 和 /usr/libexec/deepin/dde-lock 精确匹配 Issue: DDE-518 --- src/dde-session/impl/sessionmanager.cpp | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/dde-session/impl/sessionmanager.cpp b/src/dde-session/impl/sessionmanager.cpp index cd69dfe..f7ba6c0 100644 --- a/src/dde-session/impl/sessionmanager.cpp +++ b/src/dde-session/impl/sessionmanager.cpp @@ -22,6 +22,7 @@ #include #include +#include #include using namespace Dtk::Core; @@ -487,17 +488,18 @@ void SessionManager::RequestSuspend() void SessionManager::SetLocked(bool lock) { - // 仅允许dde-lock进程调用 - QString cmdLine = QString("/proc/%1/cmdline").arg(connection().interface()->servicePid(message().service()).value()); - QFile file(cmdLine); - - // NOTE: 如果以deepin-turbo进行加速启动，这里是不准确的，可能需要判断desktop文件的全路径，不过deepin-turbo后续应该会放弃支持 - if (!file.open(QIODevice::ReadOnly)) { - qWarning() << "SetLocked: failed to read caller cmdline:" << cmdLine; + // 仅允许dde-lock进程调用，通过 /proc/PID/exe readlink 精确匹配可执行路径 + // 修复 CWE-290：/proc/PID/cmdline 可被同用户进程伪造，改用 readlink(/proc/PID/exe) 精确匹配 + pid_t callerPid = connection().interface()->servicePid(message().service()).value(); + QString exePath = QString("/proc/%1/exe").arg(callerPid); + char buf[PATH_MAX] = {0}; + ssize_t len = readlink(exePath.toUtf8().constData(), buf, sizeof(buf) - 1); + if (len <= 0) { + qWarning() << "SetLocked: failed to readlink caller exe:" << exePath; return; } - const QString caller = QString::fromUtf8(file.readAll()); - if (!caller.startsWith("/usr/bin/dde-lock") && !caller.startsWith("/usr/libexec/deepin/dde-lock")) { + const QString caller = QString::fromUtf8(buf, len); + if (caller != "/usr/bin/dde-lock" && caller != "/usr/libexec/deepin/dde-lock") { qWarning() << "SetLocked: illegal caller:" << caller; return; }