aboutsummaryrefslogtreecommitdiff
path: root/sway/security.c
blob: 41a3b94b631659e2159c8e09f158a1709612728d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
#include <unistd.h>
#include <stdio.h>
#include "sway/config.h"
#include "sway/security.h"
#include "log.h"

struct feature_policy *alloc_feature_policy(const char *program) {
	uint32_t default_policy = 0;
	for (int i = 0; i < config->feature_policies->length; ++i) {
		struct feature_policy *policy = config->feature_policies->items[i];
		if (strcmp(policy->program, "*") == 0) {
			default_policy = policy->features;
			break;
		}
	}

	struct feature_policy *policy = malloc(sizeof(struct feature_policy));
	if (!policy) {
		return NULL;
	}
	policy->program = strdup(program);
	if (!policy->program) {
		free(policy);
		return NULL;
	}
	policy->features = default_policy;
	return policy;
}

struct command_policy *alloc_command_policy(const char *command) {
	struct command_policy *policy = malloc(sizeof(struct command_policy));
	if (!policy) {
		return NULL;
	}
	policy->command = strdup(command);
	if (!policy->command) {
		free(policy);
		return NULL;
	}
	policy->context = 0;
	return policy;
}

enum secure_feature get_feature_policy(pid_t pid) {
#ifdef __FreeBSD__
	const char *fmt = "/proc/%d/file";
#else
	const char *fmt = "/proc/%d/exe";
#endif
	int pathlen = snprintf(NULL, 0, fmt, pid);
	char *path = malloc(pathlen + 1);
	if (path) {
		snprintf(path, pathlen + 1, fmt, pid);
	}
	static char link[2048];

	uint32_t default_policy = 0;

	ssize_t len = !path ? -1 : readlink(path, link, sizeof(link));
	if (len < 0) {
		sway_log(L_INFO,
			"WARNING: unable to read %s for security check. Using default policy.",
			path);
		strcpy(link, "*");
	} else {
		link[len] = '\0';
	}
	free(path);

	for (int i = 0; i < config->feature_policies->length; ++i) {
		struct feature_policy *policy = config->feature_policies->items[i];
		if (strcmp(policy->program, "*") == 0) {
			default_policy = policy->features;
		}
		if (strcmp(policy->program, link) == 0) {
			return policy->features;
		}
	}

	return default_policy;
}

enum command_context get_command_policy(const char *cmd) {
	uint32_t default_policy = 0;

	for (int i = 0; i < config->command_policies->length; ++i) {
		struct command_policy *policy = config->command_policies->items[i];
		if (strcmp(policy->command, "*") == 0) {
			default_policy = policy->context;
		}
		if (strcmp(policy->command, cmd) == 0) {
			return policy->context;
		}
	}

	return default_policy;
}

const char *command_policy_str(enum command_context context) {
	switch (context) {
		case CONTEXT_ALL:
			return "all";
		case CONTEXT_CONFIG:
			return "config";
		case CONTEXT_BINDING:
			return "binding";
		case CONTEXT_IPC:
			return "IPC";
		case CONTEXT_CRITERIA:
			return "criteria";
		default:
			return "unknown";
	}
}