128 lines
4.3 KiB
Diff
128 lines
4.3 KiB
Diff
From da843d3fdb143ed44094c8e6246cfb8305f6f09f Mon Sep 17 00:00:00 2001
|
|
From: David Edmundson <kde@davidedmundson.co.uk>
|
|
Date: Sat, 13 Apr 2024 23:07:19 +0100
|
|
Subject: [PATCH] Authenticate local clients
|
|
|
|
ksmserver currently authenticates remote clients, but allows local
|
|
connections through.
|
|
|
|
This is a security risk that can allow another user on the same system
|
|
to access the user's session management session without authentication.
|
|
|
|
Co-authored-by: Fabian Vogt <fabian@ritter-vogt.de>
|
|
---
|
|
ksmserver/server.cpp | 57 ++++----------------------------------------
|
|
1 file changed, 5 insertions(+), 52 deletions(-)
|
|
|
|
diff --git a/ksmserver/server.cpp b/ksmserver/server.cpp
|
|
index 8a408cf73b..62bb8fb74d 100644
|
|
--- a/ksmserver/server.cpp
|
|
+++ b/ksmserver/server.cpp
|
|
@@ -158,15 +158,6 @@ static QTemporaryFile *remTempFile = nullptr;
|
|
|
|
static IceListenObj *listenObjs = nullptr;
|
|
int numTransports = 0;
|
|
-static bool only_local = 0;
|
|
-
|
|
-static Bool HostBasedAuthProc(char * /*hostname*/)
|
|
-{
|
|
- if (only_local)
|
|
- return true;
|
|
- else
|
|
- return false;
|
|
-}
|
|
|
|
Status KSMRegisterClientProc(SmsConn /* smsConn */, SmPointer managerData, char *previousId)
|
|
{
|
|
@@ -311,33 +302,6 @@ static void write_iceauth(FILE *addfp, FILE *removefp, IceAuthDataEntry *entry)
|
|
|
|
#define MAGIC_COOKIE_LEN 16
|
|
|
|
-Status SetAuthentication_local(int count, IceListenObj *listenObjs)
|
|
-{
|
|
- int i;
|
|
- for (i = 0; i < count; i++) {
|
|
- char *prot = IceGetListenConnectionString(listenObjs[i]);
|
|
- if (!prot)
|
|
- continue;
|
|
- char *host = strchr(prot, '/');
|
|
- char *sock = nullptr;
|
|
- if (host) {
|
|
- *host = 0;
|
|
- host++;
|
|
- sock = strchr(host, ':');
|
|
- if (sock) {
|
|
- *sock = 0;
|
|
- sock++;
|
|
- }
|
|
- }
|
|
- qCDebug(KSMSERVER) << "KSMServer: SetAProc_loc: conn " << (unsigned)i << ", prot=" << prot << ", file=" << sock;
|
|
- if (sock && !strcmp(prot, "local")) {
|
|
- chmod(sock, 0700);
|
|
- }
|
|
- IceSetHostBasedAuthProc(listenObjs[i], HostBasedAuthProc);
|
|
- free(prot);
|
|
- }
|
|
- return 1;
|
|
-}
|
|
|
|
Status SetAuthentication(int count, IceListenObj *listenObjs, IceAuthDataEntry **authDataEntries)
|
|
{
|
|
@@ -372,8 +336,6 @@ Status SetAuthentication(int count, IceListenObj *listenObjs, IceAuthDataEntry *
|
|
write_iceauth(addAuthFile, remAuthFile, &(*authDataEntries)[i + 1]);
|
|
|
|
IceSetPaAuthData(2, &(*authDataEntries)[i]);
|
|
-
|
|
- IceSetHostBasedAuthProc(listenObjs[i / 2], HostBasedAuthProc);
|
|
}
|
|
fclose(addAuthFile);
|
|
fclose(remAuthFile);
|
|
@@ -397,9 +359,6 @@ Status SetAuthentication(int count, IceListenObj *listenObjs, IceAuthDataEntry *
|
|
void FreeAuthenticationData(int count, IceAuthDataEntry *authDataEntries)
|
|
{
|
|
/* Each transport has entries for ICE and XSMP */
|
|
- if (only_local)
|
|
- return;
|
|
-
|
|
for (int i = 0; i < count * 2; i++) {
|
|
free(authDataEntries[i].network_id);
|
|
free(authDataEntries[i].auth_data);
|
|
@@ -542,16 +501,14 @@ KSMServer::KSMServer(InitFlags flags)
|
|
clientInteracting = nullptr;
|
|
xonCommand = config.readEntry("xonCommand", "xon");
|
|
|
|
- only_local = flags.testFlag(InitFlag::OnlyLocal);
|
|
#ifdef HAVE__ICETRANSNOLISTEN
|
|
- if (only_local)
|
|
+ if (flags.testFlag(InitFlag::OnlyLocal)) {
|
|
_IceTransNoListen("tcp");
|
|
-#else
|
|
- only_local = false;
|
|
+ }
|
|
#endif
|
|
|
|
char errormsg[256];
|
|
- if (!SmsInitialize((char *)KSMVendorString, (char *)KSMReleaseString, KSMNewClientProc, (SmPointer)this, HostBasedAuthProc, 256, errormsg)) {
|
|
+ if (!SmsInitialize((char *)KSMVendorString, (char *)KSMReleaseString, KSMNewClientProc, (SmPointer)this, nullptr, 256, errormsg)) {
|
|
qCWarning(KSMSERVER, "KSMServer: could not register XSM protocol");
|
|
}
|
|
|
|
@@ -594,12 +551,8 @@ KSMServer::KSMServer(InitFlags flags)
|
|
free(session_manager);
|
|
}
|
|
|
|
- if (only_local) {
|
|
- if (!SetAuthentication_local(numTransports, listenObjs))
|
|
- qFatal("KSMSERVER: authentication setup failed.");
|
|
- } else {
|
|
- if (!SetAuthentication(numTransports, listenObjs, &authDataEntries))
|
|
- qFatal("KSMSERVER: authentication setup failed.");
|
|
+ if (!SetAuthentication(numTransports, listenObjs, &authDataEntries)) {
|
|
+ qFatal("KSMSERVER: authentication setup failed.");
|
|
}
|
|
|
|
IceAddConnectionWatch(KSMWatchProc, (IcePointer)this);
|
|
--
|
|
GitLab
|
|
|