`1b09a6f`

Harden IPC and secret cleanup

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 1b09a6f9c7626b737d2dc6239aa89fe57e44cc05
Parents: 74f7ad1
Tree: 6931c45

3 changed files

Status	File	+	-
M	`garcard/src/daemon.rs`	34	0
M	`garcard/src/polkit_helper.rs`	27	6
M	`garcard/src/prompt_ui.rs`	8	5

garcard/src/daemon.rsmodified

  use crate::state::{AuthState, RuntimeState};
  use anyhow::{Context, Result};
  use garcard_ipc::{Command, Response};
 +use nix::unistd::Uid;
  use serde_json::json;
  use std::os::unix::fs::PermissionsExt;
  use std::path::{Path, PathBuf};
      state: Arc<RuntimeState>,
      shutdown_tx: mpsc::UnboundedSender<()>,
  ) -> Result<()> {
 +    authorize_ipc_peer(&stream)?;
++
      let (reader, mut writer) = stream.into_split();
      let mut reader = BufReader::new(reader);
      let mut line = String::new();
      Ok(())
+ }
 +fn authorize_ipc_peer(stream: &UnixStream) -> Result<()> {
 +    let peer = stream
 +        .peer_cred()
 +        .context("Failed to read IPC peer credentials")?;
 +    let peer_uid = peer.uid();
 +    let expected_uid = Uid::effective().as_raw();
 +    validate_ipc_peer_uid(peer_uid, expected_uid)
 +}
++
 +fn validate_ipc_peer_uid(peer_uid: u32, expected_uid: u32) -> Result<()> {
 +    if peer_uid != expected_uid {
 +        anyhow::bail!(
 +            "IPC peer uid {} does not match daemon uid {}",
 +            peer_uid,
 +            expected_uid
 +        );
 +    }
 +    Ok(())
 +}
++
  fn dispatch(
      command: Command,
      state: &RuntimeState,
          assert_eq!(unregister_calls.load(Ordering::Relaxed), 1);
          assert_eq!(register_calls.load(Ordering::Relaxed), 1);
+     }
++
 +    #[test]
 +    fn validate_ipc_peer_uid_allows_daemon_owner() {
 +        assert!(validate_ipc_peer_uid(1000, 1000).is_ok());
 +    }
++
 +    #[test]
 +    fn validate_ipc_peer_uid_rejects_other_user() {
 +        let err = validate_ipc_peer_uid(1001, 1000).expect_err("must fail");
 +        assert!(err.to_string().contains("does not match daemon uid"));
 +    }
+ }

garcard/src/polkit_helper.rsmodified

                          .prompt_secret(&prompt)
                          .context("prompt handler failed")?
+                     {
 -                        PromptResponse::Submitted(response) => {
 -                            write_line(&mut stream, &sanitize_response(&response))
 -                                .context("failed to send helper secret response")?
 +                        PromptResponse::Submitted(mut response) => {
 +                            let mut sanitized = sanitize_response(&response);
 +                            write_line(&mut stream, &sanitized)
 +                                .context("failed to send helper secret response")?;
 +                            scrub_string(&mut sanitized);
 +                            scrub_string(&mut response);
+                         }
                          PromptResponse::Canceled => return Ok(HelperOutcome::Canceled),
                          PromptResponse::TimedOut => return Ok(HelperOutcome::Timeout),
                          .prompt_plain(&prompt)
                          .context("prompt handler failed")?
+                     {
 -                        PromptResponse::Submitted(response) => {
 -                            write_line(&mut stream, &sanitize_response(&response))
 -                                .context("failed to send helper visible response")?
 +                        PromptResponse::Submitted(mut response) => {
 +                            let mut sanitized = sanitize_response(&response);
 +                            write_line(&mut stream, &sanitized)
 +                                .context("failed to send helper visible response")?;
 +                            scrub_string(&mut sanitized);
 +                            scrub_string(&mut response);
+                         }
                          PromptResponse::Canceled => return Ok(HelperOutcome::Canceled),
                          PromptResponse::TimedOut => return Ok(HelperOutcome::Timeout),
      raw.lines().collect::<Vec<_>>().join(" ")
+ }
 +fn scrub_string(value: &mut String) {
 +    if value.is_empty() {
 +        return;
 +    }
 +    let mut bytes = std::mem::take(value).into_bytes();
 +    bytes.fill(0);
 +}
++
  pub fn parse_helper_line(raw: &str) -> Result<HelperEvent> {
      let line = raw.trim_end_matches('\n').trim_end_matches('\r');
      if line == "SUCCESS" {
          server.join().expect("server join");
          let _ = std::fs::remove_file(&socket_path);
+     }
++
 +    #[test]
 +    fn scrub_string_clears_input() {
 +        let mut value = "top-secret".to_string();
 +        scrub_string(&mut value);
 +        assert!(value.is_empty());
 +    }
+ }

garcard/src/prompt_ui.rsmodified

      exit: Option<PromptExit>,
      deadline: Option<Instant>,
      remaining_secs: Option<u64>,
 +    backdrop: Color,
      card_background: Color,
      card_border: Color,
      accent: Color,
          let mut theme = Theme::dark();
          theme.font_family = "Sans".to_string();
          theme.font_size = 14.0;
 -        let card_background = Color::from_hex("#111318").expect("valid card color");
 -        let card_border = Color::from_hex("#2c3442").expect("valid border color");
 -        let accent = Color::from_hex("#8ab4f8").expect("valid accent color");
 +        let backdrop = Color::from_hex("#0a0b10").context("invalid prompt backdrop color")?;
 +        let card_background =
 +            Color::from_hex("#111318").context("invalid prompt card background color")?;
 +        let card_border = Color::from_hex("#2c3442").context("invalid prompt card border color")?;
 +        let accent = Color::from_hex("#8ab4f8").context("invalid prompt accent color")?;
          let size = window.size();
          let renderer = Renderer::with_theme(size.width, size.height, theme)?;
              exit: None,
              deadline,
              remaining_secs: None,
 +            backdrop,
              card_background,
              card_border,
              accent,
          let height = size.height as i32;
          let theme = self.renderer.theme().clone();
 -        self.renderer
 -            .clear_color(Color::from_hex("#0a0b10").expect("valid backdrop color"))?;
 +        self.renderer.clear_color(self.backdrop)?;
          let card_rect = Rect::new(
              CARD_PADDING,