Merge lp:~elementary-apps/switchboard-plug-parental-controls/saving-rewrite into lp:~elementary-pantheon/switchboard-plug-parental-controls/trunk

[Adam Bieńkowski]

* Rework daemon backend

This branch reworks the way backend is set up. The restrictions are now based on abstract Restriction class, they can start, stop, store their targets etc. The behaviour of the daemon should not change in any way. I want to also make some improvements to the AppRestriction and WebRestriction but for now the core code remains the same.

Before approving, please test every feature & if it works how it should.

[lp:~elementary-apps/switchboard-plug-parental-controls/saving-rewrite]

232. By Adam Bieńkowski on 2017-03-17

Resolve conflicts

[Corentin Noël (tintou)]

The code looks good to me, it only requires more testing

review: Approve (code)

=== modified file 'lib/exec-monitor.c'
--- lib/exec-monitor.c	2016-08-30 18:01:00 +0000
+++ lib/exec-monitor.c	2017-03-17 20:20:51 +0000
@@ -74,7 +74,7 @@
 }
 
 void
-exec_monitor_start (ExecMonitor         *self,
+exec_monitor_start_monitor (ExecMonitor         *self,
                     GAsyncReadyCallback callback,
                     gpointer            user_data)
 {
@@ -102,7 +102,7 @@
 }
 
 void
-exec_monitor_stop (ExecMonitor *self)
+exec_monitor_stop_monitor (ExecMonitor *self)
 {
     ExecMonitorInterface *iface;
 

=== modified file 'src/daemon/CMakeLists.txt'
--- src/daemon/CMakeLists.txt	2016-09-10 22:16:01 +0000
+++ src/daemon/CMakeLists.txt	2017-03-17 20:20:51 +0000
@@ -9,15 +9,17 @@
 
 vala_precompile (VALA_C ${DAEMON_EXEC_NAME}
     Daemon.vala
-    ProcessWatcher.vala
     Process.vala
-    IptablesHelper.vala
-    Timer.vala
     SessionManager.vala
     SessionHandler.vala
     Interfaces.vala
     UserConfig.vala
     Server.vala
+    Restriction.vala
+    Restrictions/AppRestriction.vala
+    Restrictions/TimeRestriction.vala
+    Restrictions/WebRestriction.vala
+    RestrictionController.vala
     ${CMAKE_SOURCE_DIR}/src/shared/Constants.vala
     ${CMAKE_SOURCE_DIR}/src/shared/Utils.vala
     ${CMAKE_SOURCE_DIR}/src/shared/PAM/Token.vala
@@ -28,6 +30,7 @@
     accountsservice
     polkit-gobject-1
     gio-2.0
+    gee-0.8
     exec-monitor
 OPTIONS
     --vapidir=${CMAKE_SOURCE_DIR}/vapi/
@@ -42,4 +45,4 @@
 
 # Installation
 install (TARGETS ${DAEMON_EXEC_NAME} RUNTIME DESTINATION bin)
-install (TARGETS ${EXEC_MONITOR_NAME} DESTINATION ${CMAKE_INSTALL_LIBDIR})
\ No newline at end of file
+install (TARGETS ${EXEC_MONITOR_NAME} DESTINATION ${CMAKE_INSTALL_LIBDIR})

=== removed file 'src/daemon/IptablesHelper.vala'
--- src/daemon/IptablesHelper.vala	2016-09-10 22:16:01 +0000
+++ src/daemon/IptablesHelper.vala	1970-01-01 00:00:00 +0000
@@ -1,105 +0,0 @@
-// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
-/*-
- * Copyright (c) 2015 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- * Authored by: Adam Bieńkowski <[e-mail]>
- */
-
- namespace PC.Daemon {
-    public class IptablesHelper : Object {
-        private const string IPTABLES_EXEC = "iptables";
-        private const int DPORT = 80;
-
-        private UserConfig config;
-        private string[] current_urls;
-
-        public static bool get_can_start () {
-            return Environment.find_program_in_path (IPTABLES_EXEC) != null;
-        }
-
-        public IptablesHelper (UserConfig config) {
-            this.config = config;
-        }
-
-        public void start () {
-            this.current_urls = config.get_block_urls ();
-            add_rules ();
-        }
-
-        public void restart () {
-            remove_rules ();
-
-            current_urls = config.get_block_urls ();
-            add_rules ();            
-        }
-
-        public void stop () {
-            remove_rules ();
-        }
-
-        private void add_rules () {
-            foreach (string url in current_urls) {
-                string[] addresses = get_addresses_from_name (url);
-                foreach (string address in addresses) {
-                    process_adress (address, "-A");
-                }
-            }        
-        }
-
-        private string[] get_addresses_from_name (string name) {
-            string[] address_list = {};
-            var resolver = Resolver.get_default ();
-            try {
-                var addresses = resolver.lookup_by_name (name, null);
-                foreach (InetAddress address in addresses) {
-                    if (address.get_family () == SocketFamily.IPV4) {
-                        address_list += address.to_string ();
-                    }
-                }
-            } catch (Error e) {
-                warning (e.message);
-            }
-
-            return address_list;
-        }
-
-        private void process_adress (string address, string option) {
-            try {
-                GLib.Process.spawn_sync ("/",
-                                    { IPTABLES_EXEC, option, "OUTPUT", "-p", "tcp", "-d", address, "--dport", DPORT.to_string (), "-j", "REJECT" },
-                                    Environ.get (),
-                                    SpawnFlags.SEARCH_PATH,
-                                    null,
-                                    null,
-                                    null,
-                                    null);
-            } catch (SpawnError e) {
-                warning ("%s\n", e.message);
-            }
-        }
-
-        private void remove_rules () {
-            foreach (string url in current_urls) {
-                string[] addresses = get_addresses_from_name (url);
-                foreach (string address in addresses) {
-                    process_adress (address, "-D");
-                }
-            }  
-        }
-    }
-}
\ No newline at end of file

=== removed file 'src/daemon/ProcessWatcher.vala'
--- src/daemon/ProcessWatcher.vala	2016-12-09 17:17:31 +0000
+++ src/daemon/ProcessWatcher.vala	1970-01-01 00:00:00 +0000
@@ -1,110 +0,0 @@
-// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
-/*-
- * Copyright (c) 2015 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- * Authored by: Adam Bieńkowski <[e-mail]>
- */
-
-namespace PC.Daemon {
-    public class ProcessWatcher : GLib.Object, ExecMonitor {
-        public UserConfig? config = null;
-        private List<string> allowed_executables;
-        private Polkit.Authority authority;
-
-        public ProcessWatcher () {
-            allowed_executables = new List<string> ();
-
-            try {
-                authority = Polkit.Authority.get_sync ();
-            } catch (Error e) {
-                warning ("%s\n", e.message);
-            }
-        }
-
-        public void set_config (UserConfig? config) {
-            this.config = config;
-            allowed_executables = new List<string> ();
-        }
-
-        private void handle_pid (int pid) {
-            if (config == null || !config.get_active ()) {
-                return;
-            }
-
-            var process = new Process (pid);
-
-            string? command = process.get_command ();
-            if (command == null || command == "") {
-                return;
-            }
-
-            string[]? args = {};
-            try {
-                Shell.parse_argv (command, out args);
-                if (args == null || args.length < 1) {
-                    return;
-                }
-            } catch (ShellError e) {
-                warning ("%s\n", e.message);
-                return;
-            }                
-
-            string executable = args[0];
-
-            if (!executable.has_prefix (Path.DIR_SEPARATOR_S)) {
-                executable = Environment.find_program_in_path (executable);
-            }
-
-            unowned List<string> link = allowed_executables.find_custom (executable, strcmp);
-            if (link != null) {
-                allowed_executables.remove_link (link);
-                return;
-            }
-
-            if (executable != null && executable in config.get_targets ()) {
-                process.kill ();
-
-                var server = Server.get_default ();
-                if (config.get_admin () && authority != null) {
-                    ulong signal_id = 0;
-                    signal_id = server.app_authorization_ended.connect ((client_pid) => {
-                        try {
-                            var unix_user = new Polkit.UnixUser.for_name (config.username);
-                            var result = authority.check_authorization_sync (new Polkit.UnixProcess.for_owner (client_pid, 0, unix_user.get_uid ()),
-                                                                            Constants.PARENTAL_CONTROLS_ACTION_ID,
-                                                                            null,
-                                                                            Polkit.CheckAuthorizationFlags.NONE);
-                            if (result.get_is_authorized ()) {
-                                allowed_executables.append (executable);
-                                server.launch (args);
-                            }
-                        } catch (Error e) {
-                            warning ("%s\n", e.message);
-                        }
-
-                        server.disconnect (signal_id);
-                    });
-
-                    server.app_authorize (config.username, executable, Constants.PARENTAL_CONTROLS_ACTION_ID);
-                } else {
-                    server.show_app_unavailable (executable);
-                }
-            }  
-        }
-    }
-}

=== added file 'src/daemon/Restriction.vala'
--- src/daemon/Restriction.vala	1970-01-01 00:00:00 +0000
+++ src/daemon/Restriction.vala	2017-03-17 20:20:51 +0000
@@ -0,0 +1,60 @@
+/*-
+ * Copyright (c) 2016 elementary LLC (https://elementary.io)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Authored by: Felipe Escoto <[e-mail]>
+ */
+
+namespace PC.Daemon {
+    public abstract class Restriction<T> : Object {
+        public GLib.List<T> targets;
+
+        construct {
+            targets = new GLib.List<T> ();
+        }
+
+        public static bool get_supported () {
+            return true;
+        }
+
+        public abstract void start ();
+        public abstract void stop ();
+
+        public void add_target (T item) {
+            targets.append (item);
+        }
+
+        public void remove_target (T item) {
+            targets.remove (item);
+        }
+
+        public void update_targets (GLib.List<T> new_targets) {
+            stop ();
+            clear_targets ();
+
+            foreach (T target in new_targets) {
+                add_target (target);
+            }    
+
+            start ();        
+        }
+
+        public void clear_targets () {
+            targets.remove (targets.data);
+        }
+    }
+}
\ No newline at end of file

=== added file 'src/daemon/RestrictionController.vala'
--- src/daemon/RestrictionController.vala	1970-01-01 00:00:00 +0000
+++ src/daemon/RestrictionController.vala	2017-03-17 20:20:51 +0000
@@ -0,0 +1,48 @@
+/*-
+ * Copyright (c) 2016 elementary LLC (https://elementary.io)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Authored by: Adam Bieńkowski <[e-mail]>
+ */
+
+namespace PC.Daemon {
+    public class RestrictionController : Object {
+        private Gee.ArrayList<Restriction> restrictions;
+
+        construct {
+            restrictions = new Gee.ArrayList<Restriction> ();
+        }
+
+        public void add_restriction (Restriction restriction) {
+            if (restrictions.contains (restriction)) {
+                return;
+            }
+
+            restrictions.add (restriction);
+            restriction.start ();
+        }
+
+        public void remove_restriction (Restriction restriction) {
+            if (!restrictions.contains (restriction)) {
+                return;
+            }
+
+            restrictions.remove (restriction);
+            restriction.stop ();
+        }
+    }
+}
\ No newline at end of file

=== added directory 'src/daemon/Restrictions'
=== added file 'src/daemon/Restrictions/AppRestriction.vala'
--- src/daemon/Restrictions/AppRestriction.vala	1970-01-01 00:00:00 +0000
+++ src/daemon/Restrictions/AppRestriction.vala	2017-03-17 20:20:51 +0000
@@ -0,0 +1,114 @@
+// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
+/*-
+ * Copyright (c) 2015 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Authored by: Adam Bieńkowski <[e-mail]>
+ */
+
+namespace PC.Daemon {
+    public class AppRestriction : Restriction<string>, ExecMonitor {
+        public string username { get; set; }
+        public bool admin { get; set; }
+
+        private Gee.ArrayList<string> allowed_executables;
+        private Polkit.Authority authority;
+
+        construct {
+            allowed_executables = new Gee.ArrayList<string> ();
+
+            try {
+                authority = Polkit.Authority.get_sync ();
+            } catch (Error e) {
+                warning ("%s\n", e.message);
+            }
+        }
+
+        public override void start () {
+            start_monitor.begin ();
+        }
+
+        public override void stop () {
+            stop_monitor ();
+            allowed_executables.clear ();
+        }
+
+        private void handle_pid (int pid) {
+            var process = new Process (pid);
+
+            string? command = process.get_command ();
+            if (command == null || command == "") {
+                return;
+            }
+
+            string[]? args = {};
+            try {
+                Shell.parse_argv (command, out args);
+                if (args == null || args.length < 1) {
+                    return;
+                }
+            } catch (ShellError e) {
+                warning ("%s\n", e.message);
+                return;
+            }                
+
+            string executable = args[0];
+
+            if (!executable.has_prefix (Path.DIR_SEPARATOR_S)) {
+                executable = Environment.find_program_in_path (executable);
+            }
+
+            if (allowed_executables.contains (executable)) {
+                allowed_executables.remove (executable);
+                return;
+            }
+
+            if (executable == null || targets.find_custom (executable, strcmp) == null) {
+                return;
+            }
+
+            process.kill ();
+
+            var server = Server.get_default ();
+            if (!admin || authority == null) {
+                server.show_app_unavailable (executable);
+                return;
+            }
+
+            ulong signal_id = 0;
+            signal_id = server.app_authorization_ended.connect ((client_pid) => {
+                try {
+                    var unix_user = (Polkit.UnixUser)Polkit.UnixUser.new_for_name (username);
+                    var result = authority.check_authorization_sync (Polkit.UnixProcess.new_for_owner (client_pid, 0, unix_user.get_uid ()),
+                                                                    Constants.PARENTAL_CONTROLS_ACTION_ID,
+                                                                    null,
+                                                                    Polkit.CheckAuthorizationFlags.NONE);
+                    if (result.get_is_authorized ()) {
+                        allowed_executables.add (executable);
+                        server.launch (args);
+                    }
+                } catch (Error e) {
+                    warning ("%s\n", e.message);
+                }
+
+                server.disconnect (signal_id);
+            });
+
+            server.app_authorize (username, executable, Constants.PARENTAL_CONTROLS_ACTION_ID);
+        }
+    }
+}
\ No newline at end of file

=== added file 'src/daemon/Restrictions/TimeRestriction.vala'
--- src/daemon/Restrictions/TimeRestriction.vala	1970-01-01 00:00:00 +0000
+++ src/daemon/Restrictions/TimeRestriction.vala	2017-03-17 20:20:51 +0000
@@ -0,0 +1,118 @@
+// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
+/*-
+ * Copyright (c) 2016 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Authored by: Adam Bieńkowski <[e-mail]>
+ */
+
+namespace PC.Daemon {
+    public class TimeRestriction : Restriction<PAM.Token> {
+        private const int MINUTE_INTERVAL = 60;
+        private const int HOUR_INTERVAL = 3600;
+
+        public signal void terminate ();
+        
+        private uint[] timeout_ids;
+
+        public override void start () {
+            foreach (PAM.Token token in targets) {
+                process_token (token);
+            }
+        }
+
+        private void process_token (PAM.Token token) {
+            var times_info = token.get_times_info ();
+            if (times_info.length () == 0) {
+                return;
+            }
+
+            PAM.TimeInfo? current = null;
+
+            int day_of_week = new DateTime.now_local ().get_day_of_week ();
+            foreach (PAM.TimeInfo info in times_info) {
+                if ((day_of_week < 6 && info.day_type == PAM.DayType.WEEKDAY)
+                    || (day_of_week >= 6 && info.day_type == PAM.DayType.WEEKEND)
+                    || info.day_type == PAM.DayType.ALL) {
+                    current = info;
+                    break;
+                }
+            }
+
+            if (current == null) {
+                return;
+            }
+
+            var span = get_difference_span (current.to);
+            int minutes = ((int)(span / GLib.TimeSpan.MINUTE)).abs ();
+            
+            if (minutes > 0) {
+                start_loop (minutes);
+            } else {
+                terminate ();
+            }  
+
+            timeout_ids += Timeout.add_seconds (HOUR_INTERVAL * 24, () => {
+                stop ();
+                start ();
+                return true;
+            });
+        }
+
+        public override void stop () {
+            foreach (uint timeout_id in timeout_ids) {
+                GLib.Source.remove (timeout_id);
+            }
+        }
+
+        private TimeSpan get_difference_span (string estimated_time_str) {
+            int hour = int.parse (estimated_time_str.slice (0, 2));
+            int minute = int.parse (estimated_time_str.substring (2));
+
+            if (hour == 24) {
+                hour = 0;
+            }
+
+            var current_date = new DateTime.now_local ();
+            var estimated_date = current_date.add_full (0, 0,
+                                                    (hour < current_date.get_hour ()) ? 1 : 0,
+                                                    hour - current_date.get_hour (),
+                                                    minute - current_date.get_minute (),
+                                                    0);
+            return estimated_date.difference (current_date);
+        }
+
+        private void start_loop (int minutes) {
+            Server.get_default ().show_timeout (minutes / MINUTE_INTERVAL, minutes % MINUTE_INTERVAL);
+            timeout_ids += Timeout.add_seconds (MINUTE_INTERVAL, () => {
+                minutes--;
+                if (minutes == MINUTE_INTERVAL ||
+                    minutes == 10 ||
+                    minutes == 5 ||
+                    minutes == 1) {
+                    Server.get_default ().show_timeout (minutes / MINUTE_INTERVAL, minutes % MINUTE_INTERVAL);
+                }
+
+                if (minutes == 0) {
+                    terminate ();
+                }
+
+                return (minutes > 0);
+            });
+        }   
+    }
+}
\ No newline at end of file

=== added file 'src/daemon/Restrictions/WebRestriction.vala'
--- src/daemon/Restrictions/WebRestriction.vala	1970-01-01 00:00:00 +0000
+++ src/daemon/Restrictions/WebRestriction.vala	2017-03-17 20:20:51 +0000
@@ -0,0 +1,82 @@
+// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
+/*-
+ * Copyright (c) 2015 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 3 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ * Authored by: Adam Bieńkowski <[e-mail]>
+ */
+
+ namespace PC.Daemon {
+    public class WebRestriction : Restriction<string> {
+        private const string IPTABLES_EXEC = "iptables";
+        private const int DPORT = 80;
+
+        public new static bool get_supported () {
+            return Environment.find_program_in_path (IPTABLES_EXEC) != null;
+        }
+
+        public override void start () {
+            foreach (string url in targets) {
+                string[] addresses = get_addresses_from_name (url);
+                foreach (string address in addresses) {
+                    process_adress (address, "-A");
+                }
+            }      
+        }
+
+        public override void stop () {
+            foreach (string url in targets) {
+                string[] addresses = get_addresses_from_name (url);
+                foreach (string address in addresses) {
+                    process_adress (address, "-D");
+                }
+            }  
+        }
+
+        private string[] get_addresses_from_name (string name) {
+            string[] address_list = {};
+            var resolver = Resolver.get_default ();
+            try {
+                var addresses = resolver.lookup_by_name (name, null);
+                foreach (InetAddress address in addresses) {
+                    if (address.get_family () == SocketFamily.IPV4) {
+                        address_list += address.to_string ();
+                    }
+                }
+            } catch (Error e) {
+                warning (e.message);
+            }
+
+            return address_list;
+        }
+
+        private void process_adress (string address, string option) {
+            try {
+                GLib.Process.spawn_sync ("/",
+                                    { IPTABLES_EXEC, option, "OUTPUT", "-p", "tcp", "-d", address, "--dport", DPORT.to_string (), "-j", "REJECT" },
+                                    Environ.get (),
+                                    SpawnFlags.SEARCH_PATH,
+                                    null,
+                                    null,
+                                    null,
+                                    null);
+            } catch (SpawnError e) {
+                warning ("%s\n", e.message);
+            }
+        }
+    }
+}
\ No newline at end of file

=== modified file 'src/daemon/SessionHandler.vala'
--- src/daemon/SessionHandler.vala	2016-09-10 22:16:01 +0000
+++ src/daemon/SessionHandler.vala	2017-03-17 20:20:51 +0000
@@ -22,8 +22,11 @@
 
  namespace PC.Daemon {
     public class SessionHandler : Object {
-        private IptablesHelper iptables_helper;
-        private Timer? timer;
+        private RestrictionController controller;
+
+        private AppRestriction app_restriction;
+        private WebRestriction web_restriction;
+        private TimeRestriction time_restriction;
 
         private UserConfig config;
         public ISession session;
@@ -41,19 +44,19 @@
                 return;
             }
 
-            iptables_helper = new IptablesHelper (config);
-
-            var token = PAM.Reader.get_token_for_user (Constants.PAM_TIME_CONF_PATH, session.name);
-            if (token != null) {
-                timer = new Timer (token);
-                timer.terminate.connect (() => {
-                    try {
-                        session.terminate ();
-                    } catch (IOError e) {
-                        warning (e.message);
-                    }                    
-                });
-            }
+            controller = new RestrictionController ();
+
+            app_restriction = new AppRestriction ();
+            web_restriction = new WebRestriction ();
+
+            time_restriction = new TimeRestriction ();
+            time_restriction.terminate.connect (() => {
+                try {
+                    session.terminate ();
+                } catch (IOError e) {
+                    warning (e.message);
+                }                    
+            });
         }
 
         public string get_id () {
@@ -69,35 +72,57 @@
                 return;
             }
 
-            if (IptablesHelper.get_can_start ()) {
-                iptables_helper.start ();
-            }
-
-            if (timer != null) {
-                timer.start ();
-            }
+            app_restriction.username = config.username;
+            app_restriction.admin = config.get_admin ();
+
+            foreach (string target in config.get_targets ()) {
+                app_restriction.add_target (target);
+            }
+
+            controller.add_restriction (app_restriction);
+
+            if (WebRestriction.get_supported ()) {
+                foreach (string url in config.get_block_urls ()) {
+                    web_restriction.add_target (url);
+                }
+
+                controller.add_restriction (web_restriction);
+            }
+
+            var token = PAM.Reader.get_token_for_user (Constants.PAM_TIME_CONF_PATH, session.name);
+            time_restriction.add_target (token);
+
+            controller.add_restriction (time_restriction);
         }
 
         public void update () {
             if (!config.get_active ()) {
-                iptables_helper.stop ();
-                if (timer != null) {
-                    timer.stop ();
-                }
-
+                stop ();
                 return;
             }
 
-            if (IptablesHelper.get_can_start ()) {
-                iptables_helper.restart ();
-            }
+            app_restriction.username = config.username;
+            app_restriction.admin = config.get_admin ();
+
+            var new_targets = new GLib.List<string> ();
+            foreach (string target in config.get_targets ()) {
+                new_targets.append (target);
+            }
+
+            app_restriction.update_targets (new_targets);
+
+            new_targets = new GLib.List<string> ();
+            foreach (string url in config.get_block_urls ()) {
+                new_targets.append (url);
+            }
+
+            web_restriction.update_targets (new_targets);
         }
 
         public void stop () {
-            iptables_helper.stop ();
-            if (timer != null) {
-                timer.stop ();
-            }
+            controller.remove_restriction (app_restriction);
+            controller.remove_restriction (web_restriction);
+            controller.remove_restriction (time_restriction);
         }         
     }
 }
\ No newline at end of file

=== modified file 'src/daemon/SessionManager.vala'
--- src/daemon/SessionManager.vala	2016-09-10 22:16:01 +0000
+++ src/daemon/SessionManager.vala	2017-03-17 20:20:51 +0000
@@ -25,7 +25,6 @@
         public SessionHandler? current_handler = null;
         private IManager? manager = null;
         private DBusConnection? conn = null;
-        private ProcessWatcher pwatcher;
 
         private uint[] signal_ids;
 
@@ -45,9 +44,6 @@
             } catch (IOError e) {
                 warning ("%s\n", e.message);
             }
-
-            pwatcher = new ProcessWatcher ();
-            pwatcher.start.begin ();
         }
 
         public void start () {
@@ -107,13 +103,14 @@
 
             stop_current_handler ();
 
-            if (session != null &&
-                session.name != null &&
-                !(session.name in Constants.DAEMON_IGNORED_USERS)) {
-                current_handler = new SessionHandler (session);
-                current_handler.start ();
-                pwatcher.set_config (current_handler.get_config ());
+            if (session == null ||
+                session.name == null ||
+                session.name in Constants.DAEMON_IGNORED_USERS) {
+                return;
             }
+
+            current_handler = new SessionHandler (session);
+            current_handler.start ();
         }
 
         private void stop_current_handler () {
@@ -121,8 +118,6 @@
                 current_handler.stop ();
                 current_handler = null;
             }
-
-            pwatcher.set_config (null);
         }
     }
 }
\ No newline at end of file

=== removed file 'src/daemon/Timer.vala'
--- src/daemon/Timer.vala	2016-08-30 17:28:55 +0000
+++ src/daemon/Timer.vala	1970-01-01 00:00:00 +0000
@@ -1,116 +0,0 @@
-// -*- Mode: vala; indent-tabs-mode: nil; tab-width: 4 -*-
-/*-
- * Copyright (c) 2016 Adam Bieńkowski (https://launchpad.net/switchboard-plug-parental-controls)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 3 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public
- * License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
- * Boston, MA 02111-1307, USA.
- *
- * Authored by: Adam Bieńkowski <[e-mail]>
- */
-
-namespace PC.Daemon {
-    public class Timer : Object {
-        private const int MINUTE_INTERVAL = 60;
-        private const int HOUR_INTERVAL = 3600;
-
-        public signal void terminate ();
-
-        private PAM.Token token;
-        private uint[] timeout_ids;
-
-        public Timer (PAM.Token token) {
-            this.token = token;
-        }
-
-        public void start () {
-            var times_info = token.get_times_info ();
-            if (times_info.length () == 0) {
-                return;
-            }
-
-            PAM.TimeInfo? current = null;
-
-            int day_of_week = new DateTime.now_local ().get_day_of_week ();
-            foreach (PAM.TimeInfo info in times_info) {
-                if ((day_of_week < 6 && info.day_type == PAM.DayType.WEEKDAY)
-                    || (day_of_week >= 6 && info.day_type == PAM.DayType.WEEKEND)
-                    || info.day_type == PAM.DayType.ALL) {
-                    current = info;
-                    break;
-                }
-            }
-
-            if (current == null) {
-                return;
-            }
-
-            var span = get_difference_span (current.to);
-            int minutes = ((int)(span / GLib.TimeSpan.MINUTE)).abs ();
-            
-            if (minutes > 0) {
-                start_loop (minutes);
-            } else {
-                terminate ();
-            }  
-
-            timeout_ids += Timeout.add_seconds (HOUR_INTERVAL * 24, () => {
-                start ();
-                return true;
-            });
-        }
-
-        public void stop () {
-            foreach (uint timeout_id in timeout_ids) {
-                GLib.Source.remove (timeout_id);
-            }
-        }
-
-        private TimeSpan get_difference_span (string estimated_time_str) {
-            int hour = int.parse (estimated_time_str.slice (0, 2));
-            int minute = int.parse (estimated_time_str.substring (2));
-
-            if (hour == 24) {
-                hour = 0;
-            }
-
-            var current_date = new DateTime.now_local ();
-            var estimated_date = current_date.add_full (0, 0,
-                                                    (hour < current_date.get_hour ()) ? 1 : 0,
-                                                    hour - current_date.get_hour (),
-                                                    minute - current_date.get_minute (),
-                                                    0);
-            return estimated_date.difference (current_date);
-        }
-
-        private void start_loop (int minutes) {
-            Server.get_default ().show_timeout (minutes / MINUTE_INTERVAL, minutes % MINUTE_INTERVAL);
-            timeout_ids += Timeout.add_seconds (MINUTE_INTERVAL, () => {
-                minutes--;
-                if (minutes == MINUTE_INTERVAL ||
-                    minutes == 10 ||
-                    minutes == 5 ||
-                    minutes == 1) {
-                    Server.get_default ().show_timeout (minutes / MINUTE_INTERVAL, minutes % MINUTE_INTERVAL);
-                }
-
-                if (minutes == 0) {
-                    terminate ();
-                }
-
-                return (minutes > 0);
-            });
-        }   
-    }
-}
\ No newline at end of file

=== modified file 'src/daemon/UserConfig.vala'
--- src/daemon/UserConfig.vala	2016-09-10 22:16:01 +0000
+++ src/daemon/UserConfig.vala	2017-03-17 20:20:51 +0000
@@ -22,7 +22,7 @@
 
 namespace PC.Daemon {
     public class UserConfig : Object {
-        public string username;
+        public string username { get; set; }
 
         private static KeyFile key;
         private static List<UserConfig> config_list;
@@ -63,12 +63,7 @@
                 warning (e.message);
             }
             
-            foreach (Act.User user in Utils.get_usermanager ().list_users ()) {
-                string username = user.get_user_name ();
-                if (!key.has_group (username)) {
-                    continue;
-                }
-
+            foreach (string username in key.get_groups ()) {
                 var user_config = new UserConfig (username);
                 config_list.append (user_config);
             }
@@ -77,25 +72,10 @@
         private static bool init_config_file () {
             var file = File.new_for_path (Constants.DAEMON_CONF_FILE);
             if (!file.query_exists ()) {
-                critical ("Could not found daemon config file: %s does not exist".printf (file.get_path ()));
+                critical ("Could not find daemon config file: %s does not exist".printf (file.get_path ()));
                 return false;
             }
 
-            try {
-                var monitor = file.monitor (FileMonitorFlags.NONE, null);
-                monitor.changed.connect ((src, dest, event) => {
-                    if (event == FileMonitorEvent.CHANGES_DONE_HINT) {
-                        foreach (UserConfig config in config_list) {
-                            config.update_key ();
-                        }
-
-                        Server.get_default ().config_changed ();
-                    }
-                });
-            } catch (Error e) {
-                warning (e.message);
-            }
-
             return true;
         }
 
@@ -175,16 +155,6 @@
             return false;
         }
 
-        public void update_key () {
-            try {
-                key.load_from_file (Constants.DAEMON_CONF_FILE, KeyFileFlags.KEEP_COMMENTS | KeyFileFlags.KEEP_TRANSLATIONS);
-            } catch (KeyFileError e) {
-                warning (e.message);
-            } catch (FileError e) {
-                warning (e.message);
-            }
-        }
-
         private void save () {
             try {
                 key.save_to_file (Constants.DAEMON_CONF_FILE);

=== modified file 'vapi/exec-monitor.vapi'
--- vapi/exec-monitor.vapi	2016-02-21 18:52:25 +0000
+++ vapi/exec-monitor.vapi	2017-03-17 20:20:51 +0000
@@ -1,6 +1,6 @@
 [CCode (cheader_filename = "exec-monitor.h", type_id = "exec_monitor_get_type ()")]
 public interface ExecMonitor : GLib.Object {
-    public virtual async void start ();
-    public virtual void stop ();
+    public virtual async void start_monitor ();
+    public virtual void stop_monitor ();
     public abstract void handle_pid (int pid);
 }
\ No newline at end of file