Skip to content

fix: SetLocked 使用 readlink(/proc/PID/exe) 精确匹配替代 cmdline 前缀匹配 (CWE-290) #242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mhduiy wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

fix: SetLocked 使用 readlink(/proc/PID/exe) 精确匹配替代 cmdline 前缀匹配 (CWE-290) #242

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions src/dde-session/impl/sessionmanager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
#include <QTimer>

#include <unistd.h>
#include <climits>
#include <xcb/xcb.h>

using namespace Dtk::Core;
Expand Down Expand Up @@ -487,17 +488,18 @@ void SessionManager::RequestSuspend()

void SessionManager::SetLocked(bool lock)
{
// 仅允许dde-lock进程调用
QString cmdLine = QString("/proc/%1/cmdline").arg(connection().interface()->servicePid(message().service()).value());
QFile file(cmdLine);

// NOTE: 如果以deepin-turbo进行加速启动，这里是不准确的，可能需要判断desktop文件的全路径，不过deepin-turbo后续应该会放弃支持
if (!file.open(QIODevice::ReadOnly)) {
qWarning() << "SetLocked: failed to read caller cmdline:" << cmdLine;
// 仅允许dde-lock进程调用，通过 /proc/PID/exe readlink 精确匹配可执行路径
// 修复 CWE-290：/proc/PID/cmdline 可被同用户进程伪造，改用 readlink(/proc/PID/exe) 精确匹配
pid_t callerPid = connection().interface()->servicePid(message().service()).value();
QString exePath = QString("/proc/%1/exe").arg(callerPid);
char buf[PATH_MAX] = {0};
ssize_t len = readlink(exePath.toUtf8().constData(), buf, sizeof(buf) - 1);
if (len <= 0) {
qWarning() << "SetLocked: failed to readlink caller exe:" << exePath;
return;
}
const QString caller = QString::fromUtf8(file.readAll());
if (!caller.startsWith("/usr/bin/dde-lock") && !caller.startsWith("/usr/libexec/deepin/dde-lock")) {
const QString caller = QString::fromUtf8(buf, len);
if (caller != "/usr/bin/dde-lock" && caller != "/usr/libexec/deepin/dde-lock") {
qWarning() << "SetLocked: illegal caller:" << caller;
return;
}
Expand Down
Loading