Merge lp:~pitti/lightdm/guest-session-lockdown into lp:lightdm

[Martin Pitt]

When launching a guest session, run it through a wrapper which we can attach an
AppArmor profile to.

=== modified file 'NEWS'
--- NEWS	2011-09-30 05:48:00 +0000
+++ NEWS	2011-09-30 15:22:39 +0000
@@ -16,6 +16,10 @@
     * Start authentication when scrolling through GTK greeter entries
     * Link liblightdm-qt against QtGui
     * Fix liblightdm-qt crashing when face images are installed
+    * Introduce a lightdm-guest-session-wrapper session command which MAC
+      systems like AppArmor and SELinux can use for attaching a restrictive
+      policy to guest sessions.
+    * Provide an AppArmor profile for guest session lockdown.
 
 Overview of changes in lightdm 1.0.0
 

=== modified file 'data/Makefile.am'
--- data/Makefile.am	2011-07-20 08:30:27 +0000
+++ data/Makefile.am	2011-09-30 15:22:39 +0000
@@ -6,6 +6,15 @@
 dbusconfdir = $(sysconfdir)/dbus-1/system.d
 dist_dbusconf_DATA = org.freedesktop.DisplayManager.conf
 
+EXTRA_DIST = guest-session.apparmor
+
+apparmor_profiledir = $(sysconfdir)/apparmor.d
+
+install-data-hook:
+	install -d $(DESTDIR)$(apparmor_profiledir)
+	sed 's!LIBEXECDIR!$(libexecdir)!g' < $(srcdir)/guest-session.apparmor \
+		> $(DESTDIR)$(apparmor_profiledir)/lightdm-guest-session
+
 dist_man1_MANS = lightdm.1
 
 DISTCLEANFILES = \

=== added file 'data/guest-session.apparmor'
--- data/guest-session.apparmor	1970-01-01 00:00:00 +0000
+++ data/guest-session.apparmor	2011-09-30 15:22:39 +0000
@@ -0,0 +1,52 @@
+# vim:syntax=apparmor
+# Profile for restricting lightdm guest session 
+# Author: Martin Pitt <[e-mail]>
+
+#include <tunables/global>
+
+LIBEXECDIR/lightdm-guest-session-wrapper {
+  #include <abstractions/authentication>
+  #include <abstractions/nameservice>
+  #include <abstractions/wutmp>
+  /etc/compizconfig/config rw, # bug in compiz https://launchpad.net/bugs/697678
+ 
+  / r,
+  /bin/ rmix,
+  /bin/** rmix,
+  /cdrom/ rmix,
+  /cdrom/** rmix,
+  /dev/ r,
+  /dev/** rmw, # audio devices etc.
+  owner /dev/shm/** rmw,
+  /etc/ r,
+  /etc/** rmk,
+  /etc/gdm/Xsession ix,
+  /lib/ r,
+  /lib/** rmixk,
+  /lib32/ r,
+  /lib32/** rmixk,
+  /media/ r,
+  /media/** rmwlixk,  # we want access to USB sticks and the like
+  /opt/ r,
+  /opt/** rmixk,
+  @{PROC}/ r,
+  @{PROC}/* rm,
+  @{PROC}/asound rm,
+  @{PROC}/asound/** rm,
+  owner @{PROC}/** rm,
+  /sbin/ r,
+  /sbin/** rmixk,
+  /sys/ r,
+  /sys/** rm,
+  /tmp/ rw,
+  owner /tmp/** rwlkmix,
+  /usr/ r,
+  /usr/** rmixk,
+  /var/ r,
+  /var/** rmixk,
+  /var/guest-data/** rw, # allow to store files permanently
+  /var/tmp/ rw,
+  owner /var/tmp/** rwlkm,
+  /{,var/}run/ r,
+  /{,var/}run/** rmwkix, # necessary for writing to sockets, etc.
+}

=== modified file 'src/Makefile.am'
--- src/Makefile.am	2011-09-27 01:25:05 +0000
+++ src/Makefile.am	2011-09-30 15:22:39 +0000
@@ -79,6 +79,7 @@
 lightdm_CFLAGS = \
 	$(LIGHTDM_CFLAGS) \
 	$(WARN_CFLAGS) \
+	-DLIBEXEC_DIR=\"$(libexecdir)\" \
 	-DPKGLIBEXEC_DIR=\"$(pkglibexecdir)\" \
 	-DSBIN_DIR=\"$(sbindir)\" \
 	-DCONFIG_DIR=\"$(sysconfdir)/lightdm\" \
@@ -92,6 +93,14 @@
 	$(LIGHTDM_LIBS) \
 	-lpam
 
+libexec_PROGRAMS = lightdm-guest-session-wrapper
+
+lightdm_guest_session_wrapper_SOURCES = lightdm-guest-session-wrapper.c
+
+lightdm_guest_session_wrapper_CFLAGS = \
+	$(LIGHTDM_CFLAGS) \
+	$(WARN_CFLAGS)
+
 EXTRA_DIST = ldm-marshal.list \
 	display-manager.xml
 

=== modified file 'src/display.c'
--- src/display.c	2011-09-29 04:40:35 +0000
+++ src/display.c	2011-09-30 15:22:39 +0000
@@ -433,6 +433,15 @@
         }
     }
 
+    /* for a guest session, run command through the wrapper covered by MAC */
+    if (display->priv->autologin_guest)
+    {
+        gchar *t = command;
+        command = g_strdup_printf (LIBEXEC_DIR "/lightdm-guest-session-wrapper %s", command);
+        g_debug("Guest session, running session command through wrapper: %s", command);
+        g_free (t);
+    }
+
     g_signal_emit (display, signals[CREATE_SESSION], 0, &session);
     g_return_val_if_fail (session != NULL, NULL);
 

=== added file 'src/lightdm-guest-session-wrapper.c'
--- src/lightdm-guest-session-wrapper.c	1970-01-01 00:00:00 +0000
+++ src/lightdm-guest-session-wrapper.c	2011-09-30 15:22:39 +0000
@@ -0,0 +1,25 @@
+/* -*- Mode: C; indent-tabs-mode: nil; tab-width: 4 -*-
+ *
+ * Copyright (C) 2011 Canonical Ltd.
+ * Author: Martin Pitt <[e-mail]>
+ * 
+ * This program is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later
+ * version. See http://www.gnu.org/copyleft/gpl.html the full text of the
+ * license.
+ */
+
+/* This is a simple wrapper which just re-execve()'s the program given as its
+ * arguments. This allows MAC systems like AppArmor or SELinux to apply a
+ * policy on this wrapper which applies to guest sessions only. */
+
+#include <unistd.h>
+
+int
+main (int argc, char *argv[], char *envp[])
+{
+    if (argc < 2)
+	return 1;
+    execve (argv[1], argv+1, envp);
+}