Compare commits

..

No commits in common. "112d514f59f61d02b19f48653ee97e7cf4e740f1" and "8cb7721e392b1673ad0c5aef37a44a42f63ccfa0" have entirely different histories.

3 changed files with 22 additions and 103 deletions

View File

@ -16,7 +16,7 @@ gboolean is_permanent = false;
GtkEntryBuffer *entry_buffer = NULL; GtkEntryBuffer *entry_buffer = NULL;
GtkWidget *checkbox = NULL; GtkWidget *checkbox = NULL;
static void positive_response(GtkWindow *window) { static void negative_response(GtkWindow *window) {
fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer)); fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer));
exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox))) exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox)))
? YES | PERM ? YES | PERM
@ -24,7 +24,7 @@ static void positive_response(GtkWindow *window) {
gtk_window_close(window); gtk_window_close(window);
} }
static void negative_response(GtkWindow *window) { static void positive_response(GtkWindow *window) {
fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer)); fprintf(stdout, "%s", gtk_entry_buffer_get_text(entry_buffer));
exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox))) exit_code = (gtk_check_button_get_active(GTK_CHECK_BUTTON(checkbox)))
? NO | PERM ? NO | PERM

View File

@ -14,10 +14,8 @@
#include "cc.h" #include "cc.h"
#include "perm_permissions_table.h" #include "perm_permissions_table.h"
#include "real_filename.h" #include "real_filename.h"
#include "sourcefs.h"
#include "temp_permissions_table.h" #include "temp_permissions_table.h"
#include "ui-socket.h" #include "ui-socket.h"
#include <assert.h>
#include <pthread.h> #include <pthread.h>
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
@ -30,11 +28,6 @@
#define ZENITY_NO 1 #define ZENITY_NO 1
#define ZENITY_PERM 2 #define ZENITY_PERM 2
struct dialogue_response {
access_t decision;
char *filename;
};
int init_ui_socket(const char *perm_permissions_db_filename) { int init_ui_socket(const char *perm_permissions_db_filename) {
FILE *fp = NULL; FILE *fp = NULL;
@ -73,16 +66,11 @@ void destroy_ui_socket(void) {
* @return: access status - ALLOW, DENY or ALLOW_TEMP * @return: access status - ALLOW, DENY or ALLOW_TEMP
* allowed for the runtime of the process * allowed for the runtime of the process
*/ */
struct dialogue_response ask_access(const char *filename, access_t ask_access(const char *filename, struct process_info proc_info) {
struct process_info proc_info) {
FILE *fp = NULL; FILE *fp = NULL;
char *command = NULL; char *command = NULL;
int ret = asprintf(&command, "zenity \"%d\" \"%s\" \"%s\" \"%s\"", int ret = asprintf(&command, "zenity \"%d\" \"%s\" \"%s\" \"%s\"",
proc_info.PID, proc_info.name, get_mountpoint(), filename); proc_info.PID, proc_info.name, filename, get_mountpoint());
struct dialogue_response response;
response.decision = DENY;
response.filename = NULL;
if (ret < 0) { if (ret < 0) {
// If asprintf fails, the contents of command are undefined (see man // If asprintf fails, the contents of command are undefined (see man
@ -91,11 +79,7 @@ struct dialogue_response ask_access(const char *filename,
// justify preparing for this. // justify preparing for this.
fprintf(stderr, "Could not create query on rule insertion"); fprintf(stderr, "Could not create query on rule insertion");
perror(""); perror("");
response.decision = DENY; return 1;
response.filename = malloc(2);
response.filename[0] = '.';
response.filename[1] = 0;
return response;
} }
// Zenity Question Message Popup // Zenity Question Message Popup
@ -104,20 +88,18 @@ struct dialogue_response ask_access(const char *filename,
if (fp == NULL) { if (fp == NULL) {
perror("Pipe returned a error"); perror("Pipe returned a error");
response.decision = DENY; return DENY;
response.filename = malloc(2);
response.filename[0] = '.';
response.filename[1] = 0;
return response;
} }
str(char) zenity_output; str(char) zenity_output;
init(&zenity_output); init(&zenity_output);
size_t total_read = 0;
char line[1024]; // Buffer to read individual lines char line[1024]; // Buffer to read individual lines
// Read the command output line by line // Read the command output line by line
while (fgets(line, sizeof(line), fp)) { while (fgets(line, sizeof(line), fp)) {
size_t line_len = strlen(line);
push_fmt(&zenity_output, line); push_fmt(&zenity_output, line);
} }
@ -125,28 +107,16 @@ struct dialogue_response ask_access(const char *filename,
fprintf(stderr, "zenity wrote out %s\n", first(&zenity_output)); fprintf(stderr, "zenity wrote out %s\n", first(&zenity_output));
fprintf(stderr, "zenity returned %d\n", zenity_exit_code); fprintf(stderr, "zenity returned %d\n", zenity_exit_code);
// if (size(&zenity_output) == 0) {
// push(&zenity_output, '.');
// }
assert(strlen(first(&zenity_output)) == size(&zenity_output));
response.filename = malloc(size(&zenity_output) + 1);
strcpy(response.filename, first(&zenity_output));
// response.filename[size(&zenity_output)] = 0;
// assert(0 == strcmp(response.filename, first(&zenity_output)));
cleanup(&zenity_output); cleanup(&zenity_output);
if (zenity_exit_code == (ZENITY_YES | ZENITY_PERM)) { if (zenity_exit_code == (ZENITY_YES | ZENITY_PERM)) {
response.decision = ALLOW; return ALLOW;
} else if (zenity_exit_code == ZENITY_YES) { }
response.decision = ALLOW_TEMP; if (zenity_exit_code == ZENITY_YES) {
} else { return ALLOW_TEMP;
response.decision = DENY;
} }
return response; return DENY;
} }
/** /**
@ -166,36 +136,20 @@ int interactive_access(const char *filename, struct process_info proc_info,
access_t access = check_temp_access(real_path, proc_info); access_t access = check_temp_access(real_path, proc_info);
if (access == ALLOW) { if (access == ALLOW) {
fprintf(stderr,
"Permission allowed to %s based on a rule present in the temp "
"permission table.\n",
proc_info.name);
free(real_path); free(real_path);
return 1; return 1;
} }
if (access == DENY) { if (access == DENY) {
fprintf(stderr,
"Permission denied to %s based on a rule present in the temp "
"permission table.\n",
proc_info.name);
free(real_path); free(real_path);
return 0; return 0;
} }
access = check_perm_access(real_path, proc_info); access = check_perm_access(real_path, proc_info);
if (access == ALLOW) { if (access == ALLOW) {
fprintf(stderr,
"Permission allowed to %s based on a rule present in the perm "
"permission table.\n",
proc_info.name);
free(real_path); free(real_path);
return 1; return 1;
} }
if (access == DENY) { if (access == DENY) {
fprintf(stderr,
"Permission denied to %s based on a rule present in the perm "
"permission table.\n",
proc_info.name);
free(real_path); free(real_path);
return 0; return 0;
} }
@ -204,61 +158,30 @@ int interactive_access(const char *filename, struct process_info proc_info,
// permissions are granted // permissions are granted
if (opts & GRANT_PERM) { if (opts & GRANT_PERM) {
fprintf(stderr, "Permission granted permanently to %s.\n", proc_info.name);
give_perm_access(real_path, proc_info); give_perm_access(real_path, proc_info);
free(real_path); free(real_path);
return 1; return 1;
} }
if (opts & GRANT_TEMP) { if (opts & GRANT_TEMP) {
fprintf(stderr, "Permission granted temporarily to %s.\n", proc_info.name);
set_temp_access(real_path, proc_info, SET_ALLOW); set_temp_access(real_path, proc_info, SET_ALLOW);
free(real_path); free(real_path);
return 1; return 1;
} }
struct dialogue_response response = ask_access(filename, proc_info); access_t user_response = ask_access(real_path, proc_info);
// fprintf(stderr, "%s", response.filename); if (user_response == ALLOW) {
// assert(0 != strlen(response.filename));
// the user might specify a different file in the dialogue, so we need to
// check if it is valid
/*
while (source_access(response.filename, F_OK)) {
// if it is invalid, just ask again.
fprintf(stderr, "Filename returned by zenty wasn't correct: %s\n",
response.filename);
free(response.filename);
response = ask_access(filename, proc_info);
}
*/
free(real_path);
real_path = real_filename(response.filename);
free(response.filename);
if (response.decision == ALLOW) {
fprintf(stderr,
"Permission granted permanently to %s based on zenty response.\n",
proc_info.name);
give_perm_access(real_path, proc_info); give_perm_access(real_path, proc_info);
free(real_path); free(real_path);
return 1; return 1;
} }
if (response.decision == ALLOW_TEMP) { if (user_response == ALLOW_TEMP) {
fprintf(stderr,
"Permission granted temporarily to %s based on zenty response.\n",
proc_info.name);
set_temp_access(real_path, proc_info, SET_ALLOW); set_temp_access(real_path, proc_info, SET_ALLOW);
free(real_path); free(real_path);
return 1; return 1;
} }
if (response.decision == DENY) { if (user_response == DENY) {
fprintf(stderr,
"Permission denied temporarily to %s based on zenty response.\n",
proc_info.name);
set_temp_access(real_path, proc_info, SET_DENY); set_temp_access(real_path, proc_info, SET_DENY);
free(real_path); free(real_path);
return 0; return 0;

View File

@ -2,24 +2,20 @@
# fake-zenity: script that mocks the behavior of zenity based on the ./.fake-zenity-response file # fake-zenity: script that mocks the behavior of zenity based on the ./.fake-zenity-response file
ZENITY_YES=0
ZENITY_NO=1
ZENITY_PERM=2
if [[ $1 == "--set-fake-response" ]]; then if [[ $1 == "--set-fake-response" ]]; then
#someone knows we are fake :) #someone knows we are fake :)
echo "$2" >~/.fake_zenity_response echo $2 >~/.fake_zenity_response
else else
if [ -f ~/.fake_zenity_response ]; then if [ -f ~/.fake_zenity_response ]; then
FAKE_ZENITY_RESPONSE=$(cat ~/.fake_zenity_response) FAKE_ZENITY_RESPONSE=$(cat ~/.fake_zenity_response)
printf "%s" "$4"
if [[ $FAKE_ZENITY_RESPONSE == "yes_tmp" ]]; then if [[ $FAKE_ZENITY_RESPONSE == "yes_tmp" ]]; then
exit "$ZENITY_YES" printf "Allow this time\n"
exit 1
elif [[ $FAKE_ZENITY_RESPONSE == "no" ]]; then elif [[ $FAKE_ZENITY_RESPONSE == "no" ]]; then
exit "$ZENITY_NO" exit 1
elif [[ $FAKE_ZENITY_RESPONSE == "yes" ]]; then elif [[ $FAKE_ZENITY_RESPONSE == "yes" ]]; then
exit "$((ZENITY_YES | ZENITY_PERM))" exit 0
fi fi
fi fi
fi fi