From 76cab04b4d7828f3c4f607c49e1e6ad78aa6e3da Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Thu, 1 Dec 2016 21:36:43 -0500 Subject: Implement permit and reject commands --- sway/commands/permit.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 sway/commands/permit.c (limited to 'sway/commands') diff --git a/sway/commands/permit.c b/sway/commands/permit.c new file mode 100644 index 00000000..8a7bb98c --- /dev/null +++ b/sway/commands/permit.c @@ -0,0 +1,95 @@ +#include +#include "sway/commands.h" +#include "sway/config.h" +#include "sway/security.h" +#include "log.h" + +static enum secure_feature get_features(int argc, char **argv, + struct cmd_results **error) { + enum secure_feature features = 0; + + struct { + char *name; + enum secure_feature feature; + } feature_names[] = { + { "lock", FEATURE_LOCK }, + { "panel", FEATURE_PANEL }, + { "background", FEATURE_BACKGROUND }, + { "screenshot", FEATURE_SCREENSHOT }, + { "fullscreen", FEATURE_FULLSCREEN }, + { "keyboard", FEATURE_KEYBOARD }, + { "mouse", FEATURE_MOUSE }, + }; + size_t names_len = sizeof(feature_names) / + (sizeof(char *) + sizeof(enum secure_feature)); + + for (int i = 1; i < argc; ++i) { + size_t j; + for (j = 0; j < names_len; ++j) { + if (strcmp(feature_names[j].name, argv[i]) == 0) { + break; + } + } + if (j == names_len) { + *error = cmd_results_new(CMD_INVALID, + "permit", "Invalid feature grant %s", argv[i]); + return 0; + } + features |= feature_names[j].feature; + } + return features; +} + +static struct feature_policy *get_policy(const char *name) { + struct feature_policy *policy = NULL; + for (int i = 0; i < config->feature_policies->length; ++i) { + struct feature_policy *p = config->feature_policies->items[i]; + if (strcmp(p->program, name) == 0) { + policy = p; + break; + } + } + if (!policy) { + policy = alloc_feature_policy(name); + list_add(config->feature_policies, policy); + } + return policy; +} + +struct cmd_results *cmd_permit(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "permit", EXPECTED_MORE_THAN, 1))) { + return error; + } + + struct feature_policy *policy = get_policy(argv[0]); + policy->features |= get_features(argc, argv, &error); + + if (error) { + return error; + } + + sway_log(L_DEBUG, "Permissions granted to %s for features %d", + policy->program, policy->features); + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} + +struct cmd_results *cmd_reject(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "reject", EXPECTED_MORE_THAN, 1))) { + return error; + } + + struct feature_policy *policy = get_policy(argv[0]); + policy->features &= ~get_features(argc, argv, &error); + + if (error) { + return error; + } + + sway_log(L_DEBUG, "Permissions granted to %s for features %d", + policy->program, policy->features); + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} -- cgit v1.2.3 From f23880b1fdd70a21b04317c18208a1f3ce356839 Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Fri, 2 Dec 2016 08:10:03 -0500 Subject: Add support for command policies in config file --- sway/commands/commands.c | 23 +++++++++++++++++++++++ sway/commands/permit.c | 3 +-- 2 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 sway/commands/commands.c (limited to 'sway/commands') diff --git a/sway/commands/commands.c b/sway/commands/commands.c new file mode 100644 index 00000000..5d248e30 --- /dev/null +++ b/sway/commands/commands.c @@ -0,0 +1,23 @@ +#include +#include +#include "sway/commands.h" +#include "sway/config.h" +#include "list.h" +#include "log.h" + +struct cmd_results *cmd_commands(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "commands", EXPECTED_EQUAL_TO, 1))) { + return error; + } + + if (strcmp(argv[0], "{") != 0) { + return cmd_results_new(CMD_FAILURE, "commands", "Expected block declaration"); + } + + if (!config->reading) { + return cmd_results_new(CMD_FAILURE, "commands", "Can only be used in config file."); + } + + return cmd_results_new(CMD_BLOCK_COMMANDS, NULL, NULL); +} diff --git a/sway/commands/permit.c b/sway/commands/permit.c index 8a7bb98c..258ea5b2 100644 --- a/sway/commands/permit.c +++ b/sway/commands/permit.c @@ -20,8 +20,7 @@ static enum secure_feature get_features(int argc, char **argv, { "keyboard", FEATURE_KEYBOARD }, { "mouse", FEATURE_MOUSE }, }; - size_t names_len = sizeof(feature_names) / - (sizeof(char *) + sizeof(enum secure_feature)); + size_t names_len = 7; for (int i = 1; i < argc; ++i) { size_t j; -- cgit v1.2.3 From c8dc4925d1e0f5d5086a4c15415ee9fb0b7e6155 Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Fri, 2 Dec 2016 17:34:26 -0500 Subject: Add IPC security policy command handlers --- sway/commands/ipc.c | 140 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 140 insertions(+) create mode 100644 sway/commands/ipc.c (limited to 'sway/commands') diff --git a/sway/commands/ipc.c b/sway/commands/ipc.c new file mode 100644 index 00000000..e6ae27a4 --- /dev/null +++ b/sway/commands/ipc.c @@ -0,0 +1,140 @@ +#include +#include +#include "sway/commands.h" +#include "sway/config.h" +#include "ipc.h" +#include "log.h" +#include "util.h" + +struct cmd_results *cmd_ipc(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "ipc", EXPECTED_EQUAL_TO, 1))) { + return error; + } + + if (config->reading && strcmp("{", argv[0]) != 0) { + return cmd_results_new(CMD_INVALID, "ipc", + "Expected '{' at start of IPC config definition."); + } + + if (!config->reading) { + return cmd_results_new(CMD_FAILURE, "ipc", "Can only be used in config file."); + } + + return cmd_results_new(CMD_BLOCK_IPC, NULL, NULL); +} + +struct cmd_results *cmd_ipc_events(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "events", EXPECTED_EQUAL_TO, 1))) { + return error; + } + + if (config->reading && strcmp("{", argv[0]) != 0) { + return cmd_results_new(CMD_INVALID, "events", + "Expected '{' at start of IPC event config definition."); + } + + if (!config->reading) { + return cmd_results_new(CMD_FAILURE, "events", "Can only be used in config file."); + } + + return cmd_results_new(CMD_BLOCK_IPC_EVENTS, NULL, NULL); +} + +struct cmd_results *cmd_ipc_cmd(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "ipc", EXPECTED_EQUAL_TO, 1))) { + return error; + } + + bool enabled; + if (strcmp(argv[0], "enabled") == 0) { + enabled = true; + } else if (strcmp(argv[0], "disabled") == 0) { + enabled = false; + } else { + return cmd_results_new(CMD_INVALID, argv[-1], + "Argument must be one of 'enabled' or 'disabled'"); + } + + struct { + char *name; + enum ipc_command_type type; + } types[] = { + { "command", IPC_COMMAND }, + { "workspaces", IPC_GET_WORKSPACES }, + { "outputs", IPC_GET_OUTPUTS }, + { "tree", IPC_GET_TREE }, + { "marks", IPC_GET_MARKS }, + { "bar-config", IPC_GET_BAR_CONFIG }, + { "inputs", IPC_GET_INPUTS }, + }; + + uint32_t type = 0; + + for (size_t i = 0; i < sizeof(types) / sizeof(types[0]); ++i) { + if (strcmp(types[i].name, argv[-1]) == 0) { + type = types[i].type; + break; + } + } + + if (enabled) { + config->ipc_policy |= type; + sway_log(L_DEBUG, "Enabled IPC %s feature", argv[-1]); + } else { + config->ipc_policy &= ~type; + sway_log(L_DEBUG, "Disabled IPC %s feature", argv[-1]); + } + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} + +struct cmd_results *cmd_ipc_event_cmd(int argc, char **argv) { + struct cmd_results *error = NULL; + if ((error = checkarg(argc, "ipc", EXPECTED_EQUAL_TO, 1))) { + return error; + } + + bool enabled; + if (strcmp(argv[0], "enabled") == 0) { + enabled = true; + } else if (strcmp(argv[0], "disabled") == 0) { + enabled = false; + } else { + return cmd_results_new(CMD_INVALID, argv[-1], + "Argument must be one of 'enabled' or 'disabled'"); + } + + struct { + char *name; + enum ipc_command_type type; + } types[] = { + { "workspace", event_mask(IPC_EVENT_WORKSPACE) }, + { "output", event_mask(IPC_EVENT_OUTPUT) }, + { "mode", event_mask(IPC_EVENT_MODE) }, + { "window", event_mask(IPC_EVENT_WINDOW) }, + { "binding", event_mask(IPC_EVENT_BINDING) }, + { "input", event_mask(IPC_EVENT_INPUT) }, + }; + + uint32_t type = 0; + + for (size_t i = 0; i < sizeof(types) / sizeof(types[0]); ++i) { + if (strcmp(types[i].name, argv[-1]) == 0) { + type = types[i].type; + break; + } + } + + if (enabled) { + config->ipc_policy |= type; + sway_log(L_DEBUG, "Enabled IPC %s event", argv[-1]); + } else { + config->ipc_policy &= ~type; + sway_log(L_DEBUG, "Disabled IPC %s event", argv[-1]); + } + + return cmd_results_new(CMD_SUCCESS, NULL, NULL); +} -- cgit v1.2.3 From 62dad7148f7b7b314f0297e191861ae3f03e9e1f Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Fri, 2 Dec 2016 17:55:03 -0500 Subject: Enforce IPC security policy --- sway/commands/ipc.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) (limited to 'sway/commands') diff --git a/sway/commands/ipc.c b/sway/commands/ipc.c index e6ae27a4..f96e9980 100644 --- a/sway/commands/ipc.c +++ b/sway/commands/ipc.c @@ -62,13 +62,13 @@ struct cmd_results *cmd_ipc_cmd(int argc, char **argv) { char *name; enum ipc_command_type type; } types[] = { - { "command", IPC_COMMAND }, - { "workspaces", IPC_GET_WORKSPACES }, - { "outputs", IPC_GET_OUTPUTS }, - { "tree", IPC_GET_TREE }, - { "marks", IPC_GET_MARKS }, - { "bar-config", IPC_GET_BAR_CONFIG }, - { "inputs", IPC_GET_INPUTS }, + { "command", IPC_FEATURE_COMMAND }, + { "workspaces", IPC_FEATURE_GET_WORKSPACES }, + { "outputs", IPC_FEATURE_GET_OUTPUTS }, + { "tree", IPC_FEATURE_GET_TREE }, + { "marks", IPC_FEATURE_GET_MARKS }, + { "bar-config", IPC_FEATURE_GET_BAR_CONFIG }, + { "inputs", IPC_FEATURE_GET_INPUTS }, }; uint32_t type = 0; @@ -111,12 +111,12 @@ struct cmd_results *cmd_ipc_event_cmd(int argc, char **argv) { char *name; enum ipc_command_type type; } types[] = { - { "workspace", event_mask(IPC_EVENT_WORKSPACE) }, - { "output", event_mask(IPC_EVENT_OUTPUT) }, - { "mode", event_mask(IPC_EVENT_MODE) }, - { "window", event_mask(IPC_EVENT_WINDOW) }, - { "binding", event_mask(IPC_EVENT_BINDING) }, - { "input", event_mask(IPC_EVENT_INPUT) }, + { "workspace", IPC_FEATURE_EVENT_WORKSPACE }, + { "output", IPC_FEATURE_EVENT_OUTPUT }, + { "mode", IPC_FEATURE_EVENT_MODE }, + { "window", IPC_FEATURE_EVENT_WINDOW }, + { "binding", IPC_FEATURE_EVENT_BINDING }, + { "input", IPC_FEATURE_EVENT_INPUT }, }; uint32_t type = 0; -- cgit v1.2.3 From d353da248b4653d7bc027ff0dceca946cdd0b22f Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Fri, 2 Dec 2016 18:08:15 -0500 Subject: Add ipc connection feature policy controls --- sway/commands/permit.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sway/commands') diff --git a/sway/commands/permit.c b/sway/commands/permit.c index 258ea5b2..7a25e4ce 100644 --- a/sway/commands/permit.c +++ b/sway/commands/permit.c @@ -19,17 +19,17 @@ static enum secure_feature get_features(int argc, char **argv, { "fullscreen", FEATURE_FULLSCREEN }, { "keyboard", FEATURE_KEYBOARD }, { "mouse", FEATURE_MOUSE }, + { "ipc", FEATURE_IPC }, }; - size_t names_len = 7; for (int i = 1; i < argc; ++i) { size_t j; - for (j = 0; j < names_len; ++j) { + for (j = 0; j < sizeof(feature_names) / sizeof(feature_names[0]); ++j) { if (strcmp(feature_names[j].name, argv[i]) == 0) { break; } } - if (j == names_len) { + if (j == sizeof(feature_names) / sizeof(feature_names[0])) { *error = cmd_results_new(CMD_INVALID, "permit", "Invalid feature grant %s", argv[i]); return 0; -- cgit v1.2.3 From d2d6fcd1ffb496fbd3dfb448865351447474580d Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Fri, 2 Dec 2016 18:38:31 -0500 Subject: Fix clang issues --- sway/commands/ipc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sway/commands') diff --git a/sway/commands/ipc.c b/sway/commands/ipc.c index f96e9980..222be0dd 100644 --- a/sway/commands/ipc.c +++ b/sway/commands/ipc.c @@ -60,7 +60,7 @@ struct cmd_results *cmd_ipc_cmd(int argc, char **argv) { struct { char *name; - enum ipc_command_type type; + enum ipc_feature type; } types[] = { { "command", IPC_FEATURE_COMMAND }, { "workspaces", IPC_FEATURE_GET_WORKSPACES }, @@ -109,7 +109,7 @@ struct cmd_results *cmd_ipc_event_cmd(int argc, char **argv) { struct { char *name; - enum ipc_command_type type; + enum ipc_feature type; } types[] = { { "workspace", IPC_FEATURE_EVENT_WORKSPACE }, { "output", IPC_FEATURE_EVENT_OUTPUT }, -- cgit v1.2.3