From 924b71fb656fec0925726174f65676ef6a8a9329 Mon Sep 17 00:00:00 2001 From: Denys Dmytriyenko Date: Mon, 3 Oct 2022 17:33:19 +0000 Subject: meta-app-framework: applaunchd: run under a separate user Since applaunchd needs to start/stop systemd units, the user is granted elevated systemd unit-management permissions via PolKit policy. If applaunchd and all the apps run under the same agl-driver user, all the apps have these elevated systemd permissions too. Separating them into different users allows removing elevated systemd unit-management permission from individual apps, but leaving such permission for applaunchd, which enhances overall security of the system. - add new applaunchd user and group - switch applaunchd (gRPC) service to be started under new user - since HTML5 apps haven't migrated to gRPC yet and still use D-Bus API, applaunchd-dbus gets activated by agl-session and runs under agl-driver - temporarily add agl-driver user into the applaunchd group and switch PolKit policy to check for applaunchd group, instead of the user - once D-Bus API is completely deprecated, agl-driver user can be removed from applaunchd group Bug-AGL: SPEC-4579 Signed-off-by: Denys Dmytriyenko Change-Id: I75384177578bba6cb458a81df6a9dc1738c972e0 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28039 Tested-by: Jenkins Job builder account ci-image-build: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account Reviewed-by: Jan-Simon Moeller --- meta-agl-core/files/group | 1 + meta-agl-core/files/passwd | 1 + meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb | 6 +++++- .../recipes-config/polkit-rule-agl-app/files/50-agl-app.rules | 2 +- .../recipes-core/applaunchd/applaunchd/applaunchd.service | 2 +- 5 files changed, 9 insertions(+), 3 deletions(-) diff --git a/meta-agl-core/files/group b/meta-agl-core/files/group index 10cec784e..4496112d6 100644 --- a/meta-agl-core/files/group +++ b/meta-agl-core/files/group @@ -89,6 +89,7 @@ wayland::201: display::202: agl-driver::1001: agl-passenger::1002: +applaunchd::1003: systemd-network::1005: systemd-resolve::1006: mosquitto::1007: diff --git a/meta-agl-core/files/passwd b/meta-agl-core/files/passwd index b97bf3b47..1b24d2760 100644 --- a/meta-agl-core/files/passwd +++ b/meta-agl-core/files/passwd @@ -23,6 +23,7 @@ sshd::996:996::: systemd-bus-proxy::995:995::: agl-driver::1001:1001::: agl-passenger::1002:1002::: +applaunchd::1003:1003::: messagebus::994:994::: afm::992:992::: systemd-timesync::988:988::: diff --git a/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb b/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb index ecad1615d..067f2a6e4 100644 --- a/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb +++ b/meta-app-framework/recipes-config/agl-session/agl-session_0.1.bb @@ -17,9 +17,13 @@ GROUPADD_PARAM:${PN} = "\ --system video ; \ --system pipewire ; \ -g 1001 agl-driver ; \ + -g 1003 applaunchd ; \ " +# agl-driver user needs to be part of applaunchd group for D-Bus activation to still work +# should be removed after everything is converted to gRPC for enhanced security USERADD_PARAM:${PN} = "\ - -g 1001 -u 1001 -G video,display,pipewire -o -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \ + -g 1001 -u 1001 -G video,display,pipewire,applaunchd -o -d /home/agl-driver -m -K PASS_MAX_DAYS=-1 agl-driver ; \ + -g 1003 -u 1003 -o -d / -K PASS_MAX_DAYS=-1 applaunchd ; \ " SYSTEMD_PACKAGES = "${PN}" diff --git a/meta-app-framework/recipes-config/polkit-rule-agl-app/files/50-agl-app.rules b/meta-app-framework/recipes-config/polkit-rule-agl-app/files/50-agl-app.rules index dd4b6940d..35b9559c5 100644 --- a/meta-app-framework/recipes-config/polkit-rule-agl-app/files/50-agl-app.rules +++ b/meta-app-framework/recipes-config/polkit-rule-agl-app/files/50-agl-app.rules @@ -1,7 +1,7 @@ polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.systemd1.manage-units" && action.lookup("unit").indexOf("agl-app") == 0 && - subject.user == "agl-driver") { + subject.isInGroup("applaunchd")) { return polkit.Result.YES; } }); diff --git a/meta-app-framework/recipes-core/applaunchd/applaunchd/applaunchd.service b/meta-app-framework/recipes-core/applaunchd/applaunchd/applaunchd.service index 95673e962..a5a2df53a 100644 --- a/meta-app-framework/recipes-core/applaunchd/applaunchd/applaunchd.service +++ b/meta-app-framework/recipes-core/applaunchd/applaunchd/applaunchd.service @@ -3,7 +3,7 @@ Wants=network.target After=network.target [Service] -User=agl-driver +User=applaunchd Environment=XDG_DATA_DIRS=/usr/share ExecStart=/usr/bin/applaunchd Restart=on-failure -- cgit 1.2.3-korg