Merge lp:~thomas-voss/trust-store/make-process-start-time-verification-configurable into lp:trust-store

[Thomas Voß]

Expose flag for process timestamp verification as command line argument.
Make process-start-time verification configurable.
Adjust test cases to account for new struct member.

Expose flag for process timestamp verification as command line argument.
Make process-start-time verification configurable.
Adjust test cases to account for new struct member.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:111
http://jenkins.qa.ubuntu.com/job/trust-store-ci/91/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-amd64-ci/12
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/12
        deb: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/12/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-i386-ci/12

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/trust-store-ci/91/rebuild

review: Approve (continuous-integration)

[lp:~thomas-voss/trust-store/make-process-start-time-verification-configurable]

112. By Thomas Voß on 2015-08-13

Add some terminal output for debugging purposes.

[PS Jenkins bot (ps-jenkins)]

FAILED: Continuous integration, rev:112
http://jenkins.qa.ubuntu.com/job/trust-store-ci/92/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-amd64-ci/13
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/13
        deb: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/13/artifact/work/output/*zip*/output.zip
    FAILURE: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-i386-ci/13/console

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/trust-store-ci/92/rebuild

review: Needs Fixing (continuous-integration)

[lp:~thomas-voss/trust-store/make-process-start-time-verification-configurable]

113. By Thomas Voß on 2015-08-13

Temporarily enable debugging of the prompt.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:113
http://jenkins.qa.ubuntu.com/job/trust-store-ci/94/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-amd64-ci/15
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/15
        deb: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/15/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-i386-ci/15

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/trust-store-ci/94/rebuild

review: Approve (continuous-integration)

[lp:~thomas-voss/trust-store/make-process-start-time-verification-configurable]

114. By Thomas Voß on 2015-08-14

Remove temporary terminal output.
Make whitelisting agent behavior configurable via a command-line flag 'disable-whitelisting'.

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:114
http://jenkins.qa.ubuntu.com/job/trust-store-ci/95/
Executed test runs:
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-amd64-ci/16
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/16
        deb: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-armhf-ci/16/artifact/work/output/*zip*/output.zip
    SUCCESS: http://jenkins.qa.ubuntu.com/job/trust-store-vivid-i386-ci/16

Click here to trigger a rebuild:
http://s-jenkins.ubuntu-ci:8080/job/trust-store-ci/95/rebuild

review: Approve (continuous-integration)

Unmerged revisions

114. By Thomas Voß on 2015-08-14

Remove temporary terminal output.
Make whitelisting agent behavior configurable via a command-line flag 'disable-whitelisting'.

113. By Thomas Voß on 2015-08-13

Temporarily enable debugging of the prompt.

112. By Thomas Voß on 2015-08-13

Add some terminal output for debugging purposes.

111. By Thomas Voß on 2015-08-13

Expose flag for process timestamp verification as command line argument.
Adjust test cases to account for new struct member.

110. By Thomas Voß on 2015-08-13

Make process-start-time verification configurable.

=== modified file 'src/core/trust/daemon.cpp'
--- src/core/trust/daemon.cpp	2014-10-15 17:53:44 +0000
+++ src/core/trust/daemon.cpp	2015-08-14 09:37:25 +0000
@@ -262,7 +262,8 @@
                     core::trust::remote::helpers::aa_get_task_con_app_id_resolver(),
                     dict.count("description-pattern") > 0 ?
                             dict.at("description-pattern") :
-                            "Application %1% is trying to access " + service_name + "."
+                            "Application %1% is trying to access " + service_name + ".",
+                    dict.count("verify-process-timestamp") > 0
                 };
 
                 return core::trust::remote::posix::Skeleton::create_skeleton_for_configuration(config);
@@ -366,10 +367,10 @@
                     core::trust::CachedAgentGlogReporter::Configuration{})
         });
 
-    auto whitelisting_agent = std::make_shared<core::trust::WhiteListingAgent>([](const core::trust::Agent::RequestParameters& params) -> bool
+    auto whitelisting_agent = std::make_shared<core::trust::WhiteListingAgent>([vm](const core::trust::Agent::RequestParameters& params) -> bool
     {
         static auto unconfined_predicate = core::trust::WhiteListingAgent::always_grant_for_unconfined();
-        return unconfined_predicate(params) || params.application.id == "com.ubuntu.camera_camera";
+        return not (vm.count("disable-whitelisting") > 0) && (unconfined_predicate(params) || params.application.id == "com.ubuntu.camera_camera");
     }, cached_agent);
 
     auto formatting_agent = std::make_shared<core::trust::AppIdFormattingTrustAgent>(whitelisting_agent);

=== modified file 'src/core/trust/mir/prompt_main.cpp'
--- src/core/trust/mir/prompt_main.cpp	2015-02-13 12:07:56 +0000
+++ src/core/trust/mir/prompt_main.cpp	2015-08-14 09:37:25 +0000
@@ -36,6 +36,8 @@
 
 #include <core/posix/this_process.h>
 
+#include <thread>
+
 #include "prompt_config.h"
 #include "prompt_main.h"
 
@@ -99,6 +101,8 @@
 
 int main(int argc, char** argv)
 {
+    std::this_thread::sleep_for(std::chrono::seconds(10));
+
     boost::program_options::options_description options;
     options.add_options()
             (cli::option_server_socket, boost::program_options::value<std::string>(), "Mir server socket to connect to.")

=== modified file 'src/core/trust/remote/posix.cpp'
--- src/core/trust/remote/posix.cpp	2014-07-29 16:06:22 +0000
+++ src/core/trust/remote/posix.cpp	2015-08-14 09:37:25 +0000
@@ -255,6 +255,7 @@
       start_time_resolver{configuration.start_time_resolver},
       app_id_resolver{configuration.app_id_resolver},
       description_pattern{configuration.description_format},
+      verify_process_start_time{configuration.verify_process_start_time},
       endpoint{configuration.endpoint},
       socket{configuration.io_service}
 {
@@ -310,14 +311,15 @@
 core::trust::Request::Answer remote::posix::Skeleton::process_incoming_request(const core::trust::remote::posix::Request& request)
 {
     // We first validate the process start time again.
-    if (start_time_resolver(request.app_pid) != request.app_start_time) throw std::runtime_error
+    if (verify_process_start_time)
     {
-        "Potential spoofing detected on incoming request."
-    };
+        if (start_time_resolver(request.app_pid) != request.app_start_time) throw std::runtime_error
+        {
+            "Potential spoofing detected on incoming request."
+        };
+    }
 
-    // Assemble the description.
     auto app_id = app_id_resolver(request.app_pid);
-    auto description = (boost::format{description_pattern} % app_id).str();
 
     // And reach out to the user.
     // TODO(tvoss): How to handle exceptions here?
@@ -328,6 +330,6 @@
         request.app_pid,
         app_id,
         request.feature,
-        description
+        description_pattern
     });
 }

=== modified file 'src/core/trust/remote/posix.h'
--- src/core/trust/remote/posix.h	2014-08-04 07:57:05 +0000
+++ src/core/trust/remote/posix.h	2015-08-14 09:37:25 +0000
@@ -210,6 +210,10 @@
         // Pattern for assembling the prompt dialog's description given
         // an app id.
         std::string description_format;
+        // If set to true, enforces spoofing-prevention by inspecting and comparing
+        // process start times. This causes issues for the case of crossing the
+        // Android/Ubuntu boundary and we have to make it configurable.
+        bool verify_process_start_time;
     };
 
     static Ptr create_skeleton_for_configuration(const Configuration& configuration);
@@ -239,6 +243,10 @@
     // Pattern for assembling the prompt dialog's description given
     // an app id.
     std::string description_pattern;
+    // If set to true, enforces spoofing-prevention by inspecting and comparing
+    // process start times. This causes issues for the case of crossing the
+    // Android/Ubuntu boundary and we have to make it configurable.
+    bool verify_process_start_time;
     // The endpoint in the filesystem that we are connected with.
     boost::asio::local::stream_protocol::endpoint endpoint;
     // The actual socket for communication with the service.

=== modified file 'tests/remote_agent_test.cpp'
--- tests/remote_agent_test.cpp	2014-08-06 13:42:23 +0000
+++ tests/remote_agent_test.cpp	2015-08-14 09:37:25 +0000
@@ -359,7 +359,8 @@
             boost::asio::local::stream_protocol::endpoint{UnixDomainSocketRemoteAgent::endpoint_for_testing},
             process_start_time_resolver.to_functional(),
             core::trust::remote::helpers::aa_get_task_con_app_id_resolver(),
-            "Just a test for %1%."
+            "Just a test for %1%.",
+            true
         };
 
         auto skeleton = core::trust::remote::posix::Skeleton::create_skeleton_for_configuration(config);
@@ -523,7 +524,8 @@
             boost::asio::local::stream_protocol::endpoint{endpoint_for_acceptance_testing},
             core::trust::remote::helpers::proc_stat_start_time_resolver(),
             core::trust::remote::helpers::aa_get_task_con_app_id_resolver(),
-            "Just a test for %1%."
+            "Just a test for %1%.",
+            true
         };
 
         stub_ready.wait_for_signal_ready_for(std::chrono::milliseconds{1000});
@@ -761,7 +763,8 @@
             boost::asio::local::stream_protocol::endpoint{endpoint_for_acceptance_testing},
             core::trust::remote::helpers::proc_stat_start_time_resolver(),
             core::trust::remote::helpers::aa_get_task_con_app_id_resolver(),
-            "Just a test for %1%."
+            "Just a test for %1%.",
+            true
         };
 
         stub_ready.wait_for_signal_ready_for(std::chrono::milliseconds{1000});