1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
package shim
import (
"encoding/gob"
"errors"
"net"
"syscall"
"git.ophivana.moe/security/fortify/acl"
"git.ophivana.moe/security/fortify/internal/fmsg"
)
// called in the parent process
func ServeConfig(socket string, abort chan error, killShim func(), uid int, payload *Payload, wl *Wayland) error {
if payload.WL {
if f, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: wl.Path, Net: "unix"}); err != nil {
return err
} else {
fmsg.VPrintf("connected to wayland at %q", wl.Path)
wl.UnixConn = f
}
}
// setup success state accessed by abort
var success bool
if c, err := net.ListenUnix("unix", &net.UnixAddr{Name: socket, Net: "unix"}); err != nil {
return err
} else {
c.SetUnlinkOnClose(true)
go func() {
err1 := <-abort
if !success {
fmsg.VPrintln("aborting shim setup, reason:", err1)
if err1 = c.Close(); err1 != nil {
fmsg.Println("cannot abort shim setup:", err1)
}
}
close(abort)
}()
fmsg.VPrintf("configuring shim on socket %q", socket)
if err = acl.UpdatePerm(socket, uid, acl.Read, acl.Write, acl.Execute); err != nil {
fmsg.Println("cannot change permissions of shim setup socket:", err)
}
go func() {
var conn *net.UnixConn
if conn, err = c.AcceptUnix(); err != nil {
if errors.Is(err, net.ErrClosed) {
fmsg.VPrintln("accept failed due to shim setup abort")
} else {
fmsg.Println("cannot accept connection from shim:", err)
}
} else {
if err = gob.NewEncoder(conn).Encode(*payload); err != nil {
fmsg.Println("cannot stream shim payload:", err)
killShim()
return
}
if payload.WL {
// get raw connection
var rc syscall.RawConn
if rc, err = wl.SyscallConn(); err != nil {
fmsg.Println("cannot obtain raw wayland connection:", err)
killShim()
return
} else {
go func() {
// pass wayland socket fd
if err = rc.Control(func(fd uintptr) {
if _, _, err = conn.WriteMsgUnix(nil, syscall.UnixRights(int(fd)), nil); err != nil {
fmsg.Println("cannot pass wayland connection to shim:", err)
killShim()
return
}
_ = conn.Close()
// block until shim exits
<-wl.done
fmsg.VPrintln("releasing wayland connection")
}); err != nil {
fmsg.Println("cannot obtain wayland connection fd:", err)
}
}()
}
} else {
_ = conn.Close()
}
}
success = true
if err = c.Close(); err != nil {
if errors.Is(err, net.ErrClosed) {
fmsg.VPrintln("close failed due to shim setup abort")
} else {
fmsg.Println("cannot close shim socket:", err)
}
}
}()
return nil
}
}
|
