Merge lp:~thomas-voss/trust-store/fix-1518883 into lp:trust-store/15.04

[Thomas Voß]

Introduce a trust::PrivilegeEscalationPreventionAgent, filtering out invalid requests. Fixes lp:#1518883.

Introduce a trust::PrivilegeEscalationPreventionAgent, filtering out invalid requests. Fixes lp:#1518883.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:138
http://jenkins.qa.ubuntu.com/job/trust-store-ci/106/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-amd64-ci/27
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/27
        deb: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/27/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-i386-ci/27

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/trust-store-ci/106/rebuild

review: Approve (continuous-integration)

[lp:~thomas-voss/trust-store/fix-1518883]

139. By Thomas Voß on 2015-11-27

Remove obsolote check in mir::Agent.

[Alberto Mardegan (mardy)]

LGTM!

review: Approve

=== modified file 'po/de.po'
--- po/de.po	2015-09-03 05:40:47 +0000
+++ po/de.po	2015-11-27 12:18:10 +0000
@@ -6,20 +6,20 @@
 "Project-Id-Version: trust-store\n"
 "Report-Msgid-Bugs-To: \n"
 "POT-Creation-Date: 2015-08-20 13:41-0400\n"
-"PO-Revision-Date: 2015-09-02 16:46+0000\n"
-"Last-Translator: Tobias Bannert <Unknown>\n"
+"PO-Revision-Date: 2015-11-07 21:39+0000\n"
+"Last-Translator: Niklas Wenzel <[e-mail]>\n"
 "Language-Team: \n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2015-09-03 05:40+0000\n"
-"X-Generator: Launchpad (build 17706)\n"
+"X-Launchpad-Export-Date: 2015-11-08 05:46+0000\n"
+"X-Generator: Launchpad (build 17838)\n"
 "Language: de\n"
 
 #: /tmp/trust-store-i18n/src/core/trust/daemon.cpp:265
 #, boost-format
 msgid "Application %1% is trying to access"
-msgstr "Anwendung %1% versucht zugreifen"
+msgstr "Anwendung »%1%« versucht, zuzugreifen auf"
 
 #: /tmp/trust-store-i18n/src/core/trust/mir/prompt_main.qml:42
 msgid "Deny"
 
=== added file 'po/ne.po'
--- po/ne.po	1970-01-01 00:00:00 +0000
+++ po/ne.po	2015-11-27 12:18:10 +0000
@@ -0,0 +1,31 @@
+# Nepali translation for trust-store
+# Copyright (c) 2015 Rosetta Contributors and Canonical Ltd 2015
+# This file is distributed under the same license as the trust-store package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, 2015.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: trust-store\n"
+"Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
+"POT-Creation-Date: 2015-08-20 13:41-0400\n"
+"PO-Revision-Date: 2015-11-04 15:47+0000\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: Nepali <[e-mail]>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Launchpad-Export-Date: 2015-11-05 05:46+0000\n"
+"X-Generator: Launchpad (build 17838)\n"
+
+#: /tmp/trust-store-i18n/src/core/trust/daemon.cpp:265
+#, boost-format
+msgid "Application %1% is trying to access"
+msgstr ""
+
+#: /tmp/trust-store-i18n/src/core/trust/mir/prompt_main.qml:42
+msgid "Deny"
+msgstr ""
+
+#: /tmp/trust-store-i18n/src/core/trust/mir/prompt_main.qml:49
+msgid "Allow"
+msgstr ""
 
=== modified file 'po/sr.po'
--- po/sr.po	2015-08-22 05:53:55 +0000
+++ po/sr.po	2015-11-27 12:18:10 +0000
@@ -8,19 +8,19 @@
 "Project-Id-Version: trust-store\n"
 "Report-Msgid-Bugs-To: FULL NAME <EMAIL@ADDRESS>\n"
 "POT-Creation-Date: 2015-08-20 13:41-0400\n"
-"PO-Revision-Date: 2014-11-07 04:09+0000\n"
-"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"PO-Revision-Date: 2015-10-26 21:49+0000\n"
+"Last-Translator: Данило Шеган <Unknown>\n"
 "Language-Team: Serbian <[e-mail]>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"X-Launchpad-Export-Date: 2015-08-22 05:53+0000\n"
-"X-Generator: Launchpad (build 17690)\n"
+"X-Launchpad-Export-Date: 2015-10-28 05:56+0000\n"
+"X-Generator: Launchpad (build 17833)\n"
 
 #: /tmp/trust-store-i18n/src/core/trust/daemon.cpp:265
 #, boost-format
 msgid "Application %1% is trying to access"
-msgstr ""
+msgstr "Програм %1% покушава да приступи"
 
 #: /tmp/trust-store-i18n/src/core/trust/mir/prompt_main.qml:42
 msgid "Deny"
 
=== modified file 'src/CMakeLists.txt'
--- src/CMakeLists.txt	2015-08-31 13:16:20 +0000
+++ src/CMakeLists.txt	2015-11-27 12:18:10 +0000
@@ -43,6 +43,9 @@
   core/trust/app_id_formatting_trust_agent.h
   core/trust/app_id_formatting_trust_agent.cpp
 
+  # An agent implementation preventing privilege escalation attacks.
+  core/trust/privilege_escalation_prevention_agent.cpp
+
   # An agent-implementation that allows for selectively whitelisting app ids
   core/trust/white_listing_agent.cpp
   # An agent-implementation using a store instance to cache user replies.
 
=== modified file 'src/core/trust/daemon.cpp'
--- src/core/trust/daemon.cpp	2015-08-31 14:00:41 +0000
+++ src/core/trust/daemon.cpp	2015-11-27 12:18:10 +0000
@@ -22,6 +22,7 @@
 #include <core/trust/cached_agent.h>
 #include <core/trust/expose.h>
 #include <core/trust/i18n.h>
+#include <core/trust/privilege_escalation_prevention_agent.h>
 #include <core/trust/store.h>
 #include <core/trust/white_listing_agent.h>
 
@@ -375,6 +376,10 @@
     }, cached_agent);
 
     auto formatting_agent = std::make_shared<core::trust::AppIdFormattingTrustAgent>(whitelisting_agent);
+    
+    auto privilege_escalation_prevention_agent = std::make_shared<core::trust::PrivilegeEscalationPreventionAgent>(
+        core::trust::PrivilegeEscalationPreventionAgent::default_user_id_functor(),
+        formatting_agent);
 
     auto remote_agent = remote_agent_factory(service_name, formatting_agent, dict);
 
@@ -382,7 +387,7 @@
     {
         service_name,
         bus_from_name(vm[Parameters::StoreBus::name].as<std::string>()),
-        {local_store, formatting_agent},
+        {local_store, privilege_escalation_prevention_agent},
         {remote_agent}
     };
 }
 
=== modified file 'src/core/trust/mir/agent.cpp'
--- src/core/trust/mir/agent.cpp	2015-08-31 13:16:20 +0000
+++ src/core/trust/mir/agent.cpp	2015-11-27 12:18:10 +0000
@@ -236,13 +236,6 @@
 // From core::trust::Agent:
 core::trust::Request::Answer mir::Agent::authenticate_request_with_parameters(const core::trust::Agent::RequestParameters& parameters)
 {
-    // We assume that the agent implementation runs under the same user id as
-    // the requesting app to prevent from cross-user attacks.
-    if (core::trust::Uid{::getuid()} != parameters.application.uid) throw std::logic_error
-    {
-        "mir::Agent::prompt_user_for_request: current user id does not match requesting app's user id"
-    };
-
     // We initialize our callback context with an invalid child-process for setup
     // purposes. Later on, once we have acquired a pre-authenticated fd for the
     // prompt provider, we exec the actual provider in a child process and replace the
 
=== added file 'src/core/trust/privilege_escalation_prevention_agent.cpp'
--- src/core/trust/privilege_escalation_prevention_agent.cpp	1970-01-01 00:00:00 +0000
+++ src/core/trust/privilege_escalation_prevention_agent.cpp	2015-11-27 12:18:10 +0000
@@ -0,0 +1,52 @@
+/*
+ * Copyright © 2015 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authored by: Thomas Voß <[e-mail]>
+ */
+
+#include <core/trust/privilege_escalation_prevention_agent.h>
+
+#include <unistd.h>
+#include <sys/types.h>
+
+core::trust::PrivilegeEscalationPreventionAgent::Error::Error() : std::runtime_error{"Potential privilege escalation attack detected."}
+{
+}
+
+core::trust::PrivilegeEscalationPreventionAgent::UserIdFunctor core::trust::PrivilegeEscalationPreventionAgent::default_user_id_functor()
+{
+    return []()
+    {
+        return core::trust::Uid{::getuid()};
+    };
+}
+
+core::trust::PrivilegeEscalationPreventionAgent::PrivilegeEscalationPreventionAgent(
+        const UserIdFunctor& uid_functor,
+        const std::shared_ptr<core::trust::Agent>& impl)
+    : uid_functor{uid_functor},
+      impl{impl}
+{
+    if (not impl) throw std::runtime_error
+    {
+        "Missing agent implementation."
+    };
+}
+
+core::trust::Request::Answer core::trust::PrivilegeEscalationPreventionAgent::authenticate_request_with_parameters(const core::trust::Agent::RequestParameters& parameters)
+{
+    if (uid_functor() != parameters.application.uid) throw Error{};
+    return impl->authenticate_request_with_parameters(parameters);
+}
 
=== added file 'src/core/trust/privilege_escalation_prevention_agent.h'
--- src/core/trust/privilege_escalation_prevention_agent.h	1970-01-01 00:00:00 +0000
+++ src/core/trust/privilege_escalation_prevention_agent.h	2015-11-27 12:18:10 +0000
@@ -0,0 +1,63 @@
+/*
+ * Copyright © 2015 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authored by: Thomas Voß <[e-mail]>
+ */
+
+#ifndef CORE_TRUST_PRIVILEGE_ESCALATION_PREVENTION_AGENT_H_
+#define CORE_TRUST_PRIVILEGE_ESCALATION_PREVENTION_AGENT_H_
+
+#include <core/trust/agent.h>
+
+#include <stdexcept>
+
+namespace core
+{
+namespace trust
+{
+// A PrivilegeEscalationPreventionAgent ensures that requests originating from an application
+// running under a different user than the current one are rejected immediately, thereby preventing
+// from privilege escalation issues.
+class CORE_TRUST_DLL_PUBLIC PrivilegeEscalationPreventionAgent : public core::trust::Agent
+{
+public:
+    // An Error is thrown if a potential privilege escalation attack has been detected.
+    struct Error : public std::runtime_error
+    {
+        // Error creates an instance, providing details about the escalation issue.
+        Error();
+    };
+
+    // A UserIdFunctor queries the user id under which the current process runs.
+    typedef std::function<Uid()> UserIdFunctor;
+
+    // default_user_id_functor returns a UserIdFunctor querying the current user id from the system.
+    static UserIdFunctor default_user_id_functor();
+
+    // PrivilegeEscalationPreventionAgent creates a new instance that queries the current user,
+    // forwarding valid requests to impl.
+    PrivilegeEscalationPreventionAgent(const UserIdFunctor& uid_functor, const std::shared_ptr<Agent>& impl);
+
+    // From core::trust::Agent
+    Request::Answer authenticate_request_with_parameters(const RequestParameters& parameters) override;
+
+private:
+    UserIdFunctor uid_functor;
+    std::shared_ptr<Agent> impl;
+};
+}
+}
+
+#endif // CORE_TRUST_PRIVILEGE_ESCALATION_PREVENTION_AGENT_H_
 
=== modified file 'tests/CMakeLists.txt'
--- tests/CMakeLists.txt	2014-11-14 12:17:24 +0000
+++ tests/CMakeLists.txt	2015-11-27 12:18:10 +0000
@@ -59,6 +59,11 @@
 )
 
 add_executable(
+  privilege_escalation_prevention_agent_test
+  privilege_escalation_prevention_agent_test.cpp
+)
+
+add_executable(
   cached_agent_test
   cached_agent_test.cpp
 )
@@ -166,6 +171,20 @@
 )
 
 target_link_libraries(
+  privilege_escalation_prevention_agent_test
+
+  trust-store
+
+  gmock
+
+  gtest
+  gtest_main
+
+  ${PROCESS_CPP_LIBRARIES}
+)
+
+
+target_link_libraries(
   cached_agent_test
 
   trust-store
@@ -226,6 +245,7 @@
 add_test(app_id_formatting_trust_agent_test ${CMAKE_CURRENT_BINARY_DIR}/app_id_formatting_trust_agent_test)
 add_test(cached_agent_test ${CMAKE_CURRENT_BINARY_DIR}/cached_agent_test)
 add_test(white_listing_agent_test ${CMAKE_CURRENT_BINARY_DIR}/white_listing_agent_test)
+add_test(privilege_escalation_prevention_agent_test ${CMAKE_CURRENT_BINARY_DIR}/privilege_escalation_prevention_agent_test)
 # TODO(tvoss) Re-enable daemon tests once CI issues are resolved.
 # add_test(daemon_test ${CMAKE_CURRENT_BINARY_DIR}/daemon_test)
 add_test(dbus_test ${CMAKE_CURRENT_BINARY_DIR}/dbus_test)
 
=== added file 'tests/privilege_escalation_prevention_agent_test.cpp'
--- tests/privilege_escalation_prevention_agent_test.cpp	1970-01-01 00:00:00 +0000
+++ tests/privilege_escalation_prevention_agent_test.cpp	2015-11-27 12:18:10 +0000
@@ -0,0 +1,106 @@
+/*
+ * Copyright © 2015 Canonical Ltd.
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Authored by: Thomas Voß <[e-mail]>
+ */
+
+#include <core/trust/privilege_escalation_prevention_agent.h>
+
+#include "mock_agent.h"
+#include "the.h"
+
+#include <gmock/gmock.h>
+
+namespace
+{
+std::shared_ptr<testing::NiceMock<MockAgent>> a_mocked_agent()
+{
+    return std::make_shared<testing::NiceMock<MockAgent>>();
+}
+
+struct MockUserIdFunctor
+{
+    core::trust::PrivilegeEscalationPreventionAgent::UserIdFunctor to_functional()
+    {
+        return [this]()
+        {
+            return get_uid();
+        };
+    }
+
+    MOCK_METHOD0(get_uid, core::trust::Uid());
+};
+}
+
+TEST(PrivilegeEscalationPreventionAgent, ctor_throws_for_null_agent)
+{
+    EXPECT_ANY_THROW(core::trust::PrivilegeEscalationPreventionAgent
+    (
+        core::trust::PrivilegeEscalationPreventionAgent::default_user_id_functor(),
+        std::shared_ptr<core::trust::Agent>()
+    ));
+}
+
+TEST(PrivilegeEscalationPreventionAgent, queries_user_id_for_incoming_request_and_dispatches_to_impl_if_no_privilege_escalation_detected)
+{
+    using namespace ::testing;
+
+    auto mock_agent = a_mocked_agent();
+
+    auto params = the::default_request_parameters_for_testing();
+    params.application.id = params.application.id + std::string{"_app"} + std::string{"_1.2.3"};
+
+    MockUserIdFunctor uif;
+    EXPECT_CALL(uif, get_uid())
+            .Times(1)
+            .WillRepeatedly(Return(params.application.uid));
+
+    EXPECT_CALL(*mock_agent, authenticate_request_with_parameters(params))
+            .Times(1)
+            .WillRepeatedly(Return(core::trust::Request::Answer::denied));
+
+    core::trust::PrivilegeEscalationPreventionAgent agent{uif.to_functional(), mock_agent};
+
+    EXPECT_EQ(core::trust::Request::Answer::denied,
+              agent.authenticate_request_with_parameters(params));
+}
+
+TEST(PrivilegeEscalationPreventionAgent, invokes_user_id_functor_for_incoming_request_and_throws_if_privilege_escalation_detected)
+{
+    using namespace ::testing;
+
+    auto mock_agent = a_mocked_agent();
+
+    auto params = the::default_request_parameters_for_testing();
+    params.application.id = params.application.id + std::string{"_app"} + std::string{"_1.2.3"};
+
+    MockUserIdFunctor uif;
+    EXPECT_CALL(uif, get_uid())
+            .Times(1)
+            .WillRepeatedly(Return(core::trust::Uid{12}));
+
+    EXPECT_CALL(*mock_agent, authenticate_request_with_parameters(params))
+            .Times(0);
+
+    core::trust::PrivilegeEscalationPreventionAgent agent{uif.to_functional(), mock_agent};
+
+    EXPECT_THROW(agent.authenticate_request_with_parameters(params), core::trust::PrivilegeEscalationPreventionAgent::Error);
+}
+
+TEST(PrivilegeEscalationPreventionAgentDefaultUserIdFunctor, returns_current_user_id)
+{
+    auto f = core::trust::PrivilegeEscalationPreventionAgent::default_user_id_functor();
+    EXPECT_EQ(core::trust::Uid(::getuid()), f());
+}