`921cd0e`

enforce trusted control peers

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 2 months ago

SHA: 921cd0e939476af41f09b9e5aa3bea0a16b51a1b
Parents: 47f3231
Tree: 8570783

2 changed files

Status	File	+	-
M	`garwarp/src/daemon.rs`	85	6
M	`garwarp/src/error.rs`	6	0

garwarp/src/daemon.rsmodified

      let _dbus_guard = acquire_dbus_name()?;
      let listener = UnixListener::bind(&paths.control_socket)?;
 +    set_control_socket_permissions(&paths.control_socket)?;
      listener.set_nonblocking(true)?;
      logging::info("daemon_starting");
  fn handle_connection(stream: UnixStream, state: &mut DaemonState) -> io::Result<()> {
      let mut reader = BufReader::new(stream);
      let mut line = String::new();
++
 +    let peer_uid = match peer_uid(reader.get_ref()) {
 +        Ok(uid) => uid,
 +        Err(error) => {
 +            let mapping = map_portal_error(&PortalError::InternalFailure);
 +            logging::warn(&format!("peer_identity_error={error}"));
 +            return write_response(
 +                reader.into_inner(),
 +                ControlResponse::Error {
 +                    code: mapping.code as u32,
 +                    reason: mapping.reason.to_string(),
 +                },
 +            );
 +        }
 +    };
 +    if !is_trusted_control_peer(peer_uid) {
 +        let mapping = map_portal_error(&PortalError::UnauthorizedClient);
 +        logging::warn(&format!(
 +            "unauthorized_control_peer uid={} expected_uid={}",
 +            peer_uid,
 +            daemon_uid()
 +        ));
 +        return write_response(
 +            reader.into_inner(),
 +            ControlResponse::Error {
 +                code: mapping.code as u32,
 +                reason: mapping.reason.to_string(),
 +            },
 +        );
 +    }
++
      let bytes_read = {
          let mut limited = reader.by_ref().take((MAX_CONTROL_LINE_BYTES + 1) as u64);
          limited.read_line(&mut line)?
      Ok(Some(quarantined))
+ }
 +fn set_control_socket_permissions(path: &Path) -> io::Result<()> {
 +    #[cfg(unix)]
 +    {
 +        use std::os::unix::fs::PermissionsExt;
 +        fs::set_permissions(path, fs::Permissions::from_mode(0o600))?;
 +    }
 +    Ok(())
 +}
++
  fn trusted_sender(stream: &UnixStream) -> io::Result<String> {
 +    peer_uid(stream).map(canonical_sender_for_uid)
 +}
++
 +fn canonical_sender_for_uid(uid: u32) -> String {
 +    format!(":uid.{uid}")
 +}
++
 +fn is_trusted_control_peer(uid: u32) -> bool {
 +    uid == daemon_uid()
 +}
++
 +fn daemon_uid() -> u32 {
 +    unsafe { libc::geteuid() }
 +}
++
 +fn peer_uid(stream: &UnixStream) -> io::Result<u32> {
      #[cfg(target_os = "linux")]
+     {
          use std::mem;
          if len as usize != mem::size_of::<libc::ucred>() {
              return Err(io::Error::other("invalid peer credential size"));
+         }
 -        return Ok(canonical_sender_for_uid(cred.uid));
 +        return Ok(cred.uid);
+     }
      #[cfg(not(target_os = "linux"))]
+     }
+ }
 -fn canonical_sender_for_uid(uid: u32) -> String {
 -    format!(":uid.{uid}")
 -}
+-
  fn persist_registry_state(path: &std::path::Path, registry: &RequestRegistry) {
      if let Err(error) = request_store::persist_registry(path, registry) {
          logging::warn(&format!("request_store_write_failed error={error}"));
  mod tests {
      use super::{
          DaemonState, MAX_CONTROL_LINE_BYTES, canonical_sender_for_uid, handle_connection,
 -        load_registry_with_fallback, load_registry_with_recovery,
 +        is_trusted_control_peer, load_registry_with_fallback, load_registry_with_recovery,
 +        peer_uid, set_control_socket_permissions,
      };
      use garwarp_ipc::{ControlResponse, HealthStatus};
      use std::fs;
          canonical_sender_for_uid(unsafe { libc::geteuid() })
+     }
 +    #[cfg(target_os = "linux")]
 +    #[test]
 +    fn local_peer_uid_is_trusted() {
 +        let (_client, server) = UnixStream::pair().expect("pair should be created");
 +        let uid = peer_uid(&server).expect("peer uid should be readable");
 +        assert!(is_trusted_control_peer(uid));
 +    }
++
 +    #[cfg(unix)]
 +    #[test]
 +    fn control_socket_permissions_are_private() {
 +        use std::os::unix::fs::PermissionsExt;
++
 +        let path = unique_temp_file();
 +        fs::write(&path, "").expect("socket placeholder should be created");
 +        set_control_socket_permissions(&path).expect("permissions should be set");
 +        let mode = fs::metadata(&path)
 +            .expect("metadata should be readable")
 +            .permissions()
 +            .mode()
 +            & 0o777;
 +        assert_eq!(mode, 0o600);
 +        let _ = fs::remove_file(path);
 +    }
++
      #[test]
      fn status_request_returns_status_response() {
          let (mut client, server) = UnixStream::pair().expect("pair should be created");

garwarp/src/error.rsmodified

  pub enum PortalError {
      CancelledByUser,
      InvalidRequestPayload,
 +    UnauthorizedClient,
      InvalidParentWindow,
      OwnershipMismatch,
      RequestNotFound,
              code: PortalResponseCode::Failed,
              reason: "invalid_request",
          },
 +        PortalError::UnauthorizedClient => ErrorMapping {
 +            code: PortalResponseCode::Failed,
 +            reason: "unauthorized_client",
 +        },
          PortalError::InvalidParentWindow => ErrorMapping {
              code: PortalResponseCode::Failed,
              reason: "invalid_parent_window",
          let errors = [
              PortalError::CancelledByUser,
              PortalError::InvalidRequestPayload,
 +            PortalError::UnauthorizedClient,
              PortalError::InvalidParentWindow,
              PortalError::OwnershipMismatch,
              PortalError::RequestNotFound,