gib/Panama
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Own user accounts and sharing

Browse Source 
Two of the panels this desktop still handed to GNOME Settings.

Users manages the account through accountsservice -- the same daemon
GNOME's panel drives, so a name or picture set here is what the login
screen and lock screen read. Name, picture, account type, password,
automatic login, and adding or removing other accounts. Every change is
authorized by polkit through the agent this session already runs; a
dismissed prompt is a normal outcome and says so.

A new password is read from the helper's stdin, hashed by openssl
reading its own stdin, and handed over D-Bus from inside that process.
It is never an argument: argv is world-readable through /proc, so a
password passed that way is published to every process on the machine.
Removing an account takes two presses and says it destroys their files;
the last administrator cannot be removed or demoted, because a machine
nobody can administer is not a state to offer.

Sharing reports what is actually true, including "the software for this
is not installed" -- the honest answer for Samba here, and the case the
panel it replaces shows as a switch that does nothing. Password sign-in
is reported from sshd's configuration rather than assumed: claiming
"keys only" when the file is silent would state a security property that
cannot be backed up.

The Control Center now draws the account's real picture and name. A
generic glyph sat there while a real avatar was already set, which made
the desktop look like it did not know whose it was.

Also here: the KDE Connect contract no longer requires a phone to be
awake. kdeconnectd drops its device objects for a phone it has not seen
recently while the pairing survives in its config, so demanding one
failed whenever the phone was off.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L
This commit is contained in:
Gabriel Brown
2026-08-19 13:05:13 -04:00
parent e0c0e53ae0
commit a23b42841a
22 changed files with 1817 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/quickshell/kdeconnect-helper-contract.sh
+16 -4
View File
@@ -13,13 +13,25 @@ helper="$project_root/config/dot/quickshell/scripts/panama-kdeconnect"
[[ -x "$helper" ]] || fail 'helper is missing or not executable'
status="$($helper status)"
# The shape is checked whenever a device is present, but a device being present
# is not itself required. kdeconnectd drops its device objects for a phone it
# has not seen recently -- the pairing survives in its config, the D-Bus object
# does not -- so demanding one makes this fail whenever the phone is off, out of
# range, or simply has not opened the app today. That is the machine's state,
# not a defect in the helper.
jq -e '.available == true and (.devices | type == "array")' <<<"$status" >/dev/null \
|| fail 'live status is not a readable device list'
if [[ "$(jq -r '.devices | length' <<<"$status")" == "0" ]]; then
printf 'KDE Connect helper contract: PASS (no device visible to the daemon right now; shape checks skipped)\n'
exit 0
fi
jq -e '
.available == true and
(.devices | type == "array" and length >= 1) and
([.devices[] | (keys | sort) == (["actions", "id", "name", "paired", "reachable", "type"] | sort)] | all) and
([.devices[] | (.id | test("^[A-Fa-f0-9]{32,64}$"))] | all) and
([.devices[].actions[] | . == "clipboard" or . == "ping" or . == "ring" or . == "share"] | all) and
([.devices[] | select(.paired)] | length >= 1)
([.devices[].actions[] | . == "clipboard" or . == "ping" or . == "ring" or . == "share"] | all)
' <<<"$status" >/dev/null || fail 'live status shape is invalid'
paired_count="$(jq '[.devices[] | select(.paired)] | length' <<<"$status")"
tests/quickshell/sharing-contract.sh
Executable
+98
View File
@@ -0,0 +1,98 @@
#!/usr/bin/env bash
# The Sharing page must report what is true, and never claim a security
# property it cannot back up.
#
# The two failures worth a test:
#
# A service that is not installed shown as a switch. That is what the panel
# this replaces does, and the switch does nothing.
#
# "Keys only" claimed for SSH when the configuration is silent. OpenSSH's
# default accepts passwords, so stating the stronger thing without evidence
# would tell someone their machine is safer than it is.
#
# Read-only: this reads service state and never enables or disables anything.
set -uo pipefail
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
helper="$repo_dir/config/dot/quickshell/scripts/panama-sharing"
service="$repo_dir/config/dot/quickshell/services/Sharing.qml"
page="$repo_dir/config/dot/quickshell/modules/settings/SharingPage.qml"
fail() {
printf 'sharing contract: %s\n' "$1" >&2
exit 1
}
for path in "$helper" "$service" "$page"; do
[[ -r "$path" ]] || fail "missing $path"
done
[[ -x "$helper" ]] || fail 'panama-sharing is not executable'
# ── The password-authentication claim is evidence-based ─────────────────────
summary="$(sed -n '/function passwordLoginSummary/,/^ }/p' "$service")"
[[ -n "$summary" ]] || fail 'the service does not summarize password sign-in'
grep -q 'stated === ""' <<<"$summary" \
|| fail 'the summary does not distinguish "configured" from "silent"'
grep -qE 'system default' <<<"$summary" \
|| fail 'a silent configuration is not reported as the system default'
# "Keys only" may only be said when the file actually says no.
keys_line="$(grep -n 'keys only' <<<"$summary" | head -1)"
[[ -n "$keys_line" ]] || fail 'the summary never reports keys-only'
grep -q 'toLowerCase() === "no"' <<<"$summary" \
|| fail 'keys-only is claimed without checking what the configuration says'
# ── Absent software is reported, not offered ────────────────────────────────
grep -q 'is not installed' "$page" \
|| fail 'the page does not say when the software for a row is missing'
# A switch for a service that is not installed must be disabled.
grep -q 'Sharing.remoteLogin?.installed === true' "$page" \
|| fail 'the remote login switch is enabled regardless of whether SSH is installed'
grep -q 'Sharing.remoteDesktop?.available === true' "$page" \
|| fail 'the remote desktop switch is enabled regardless of whether it is available'
# Turning on remote desktop without credentials would start a service nobody
# can connect to; the page must require them first.
grep -q 'hasCredentials === true' "$page" \
|| fail 'remote desktop can be enabled with no credentials set'
grep -q 'hasCredentials' "$helper" \
|| fail 'the helper does not know whether credentials exist'
grep -qiE 'grdctl.*(password|username)[^)]*\)' "$helper" \
&& fail 'the helper passes remote desktop credentials on a command line'
# ── Privilege boundaries ────────────────────────────────────────────────────
# Remote login is system-wide and must go through a prompt; remote desktop is a
# user service and must not ask for one.
login_body="$(sed -n '/^def set_remote_login/,/^def /p' "$helper")"
grep -q 'pkexec' <<<"$login_body" \
|| fail 'changing a system-wide service does not ask for authorization'
desktop_body="$(sed -n '/^def set_remote_desktop/,/^def /p' "$helper")"
grep -q 'pkexec' <<<"$desktop_body" \
&& fail 'a user service asks for administrator rights it does not need'
grep -q '"--user"' <<<"$desktop_body" \
|| fail 'remote desktop is not managed as a user service'
# ── The snapshot reflects the machine ───────────────────────────────────────
command -v jq >/dev/null 2>&1 || { printf 'sharing contract: SKIP (no jq)\n'; exit 0; }
snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'
jq -e '.hostname | length > 0' <<<"$snapshot" >/dev/null || fail 'no hostname reported'
jq -e '.remoteLogin | has("installed") and has("active") and has("enabled")' <<<"$snapshot" >/dev/null \
|| fail 'remote login state is incomplete'
jq -e '.remoteDesktop | has("available") and has("hasCredentials")' <<<"$snapshot" >/dev/null \
|| fail 'remote desktop state is incomplete'
# Installed-ness must match what is actually on this machine, not a guess.
expected_samba=$(command -v smbd >/dev/null 2>&1 && echo true || echo false)
actual_samba="$(jq -r '.fileSharing.installed' <<<"$snapshot")"
[[ "$expected_samba" == "$actual_samba" ]] \
|| fail "file sharing reports installed=$actual_samba but smbd presence is $expected_samba"
# No credential may appear in the snapshot.
offenders="$(jq -r '[paths | map(tostring) | join(".")] | map(select(test("(password|secret|credential)$";"i"))) | join(", ")' <<<"$snapshot")"
[[ -z "$offenders" ]] || fail "the snapshot carries credential-shaped fields: $offenders"
printf 'sharing contract: PASS (remote login %s, remote desktop %s)\n' \
"$(jq -r 'if .remoteLogin.active then "on" else "off" end' <<<"$snapshot")" \
"$(jq -r 'if .remoteDesktop.active then "on" else "off" end' <<<"$snapshot")"
tests/quickshell/user-accounts-contract.sh
Executable
+94
View File
@@ -0,0 +1,94 @@
#!/usr/bin/env bash
# Managing a LOCAL user account (see online-accounts for the other kind).
#
# Managing an account must not leak the credential it sets, and must not let
# someone lock themselves out of their own machine.
#
# Nothing here creates, deletes, or modifies a real account. It reads the
# account state, which is safe, and exercises the refusals, which are the part
# that has to hold.
set -uo pipefail
repo_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
helper="$repo_dir/config/dot/quickshell/scripts/panama-users"
service="$repo_dir/config/dot/quickshell/services/UserAccounts.qml"
page="$repo_dir/config/dot/quickshell/modules/settings/UsersPage.qml"
fail() {
printf 'user accounts contract: %s\n' "$1" >&2
exit 1
}
for path in "$helper" "$service" "$page"; do
[[ -r "$path" ]] || fail "missing $path"
done
[[ -x "$helper" ]] || fail 'panama-users is not executable'
# ── A new password never reaches a command line ─────────────────────────────
# argv is world-readable through /proc, so a password passed as an argument is
# published to every process on the machine. It is read from stdin, and the
# hashing step reads ITS stdin too, so the cleartext exists only inside these
# two processes.
password_body="$(sed -n '/^def set_password/,/^def /p' "$helper")"
[[ -n "$password_body" ]] || fail 'set_password is missing'
grep -q 'sys.stdin.buffer.read()' <<<"$password_body" \
|| fail 'the new password is not read from stdin'
grep -q 'input=secret' <<<"$password_body" \
|| fail 'the password is not handed to the hashing tool on stdin'
grep -qE '"openssl", "passwd"[^]]*secret' <<<"$password_body" \
&& fail 'the password appears in the hashing command line'
grep -qE '^\s*print\((secret|hashed)' <<<"$password_body" \
&& fail 'the password or its hash is printed'
# The service must not hold one either, beyond the moment it hands it over.
grep -q 'stdinEnabled' "$service" \
|| fail 'the service does not write the password over stdin'
grep -qE 'command:.*set-password.*password' "$service" \
&& fail 'the service puts the password in the command line'
grep -q 'root.pendingPassword = ""' "$service" \
|| fail 'the service never clears the password it was holding'
# ── Refusals that keep a machine administrable ──────────────────────────────
delete_body="$(sed -n '/^def delete_user/,/^def /p' "$helper")"
grep -q 'You cannot delete the account you are signed in to' <<<"$delete_body" \
|| fail 'the helper would delete the account running it'
grep -q 'only administrator' <<<"$delete_body" \
|| fail 'the helper would remove the last administrator, leaving nobody able to administer the machine'
# The page must not offer to change the type of the only administrator either.
grep -q 'administratorCount <= 1' "$page" \
|| fail 'the page offers to demote the only administrator'
# ── Deleting is confirmed, and says what it destroys ────────────────────────
grep -q 'confirmingRemoval' "$page" \
|| fail 'the page deletes an account without a confirmation step'
grep -q 'This cannot be undone' "$page" \
|| fail 'the page does not say that deleting an account destroys their files'
# ── The snapshot is real, and reports no secrets ────────────────────────────
command -v jq >/dev/null 2>&1 || { printf 'user accounts contract: SKIP (no jq)\n'; exit 0; }
snapshot="$("$helper" snapshot 2>/dev/null)" || fail 'snapshot failed'
jq -e '.users | type == "array" and length > 0' <<<"$snapshot" >/dev/null \
|| fail 'no accounts were reported'
jq -e '[.users[] | (.userName | length > 0)] | all' <<<"$snapshot" >/dev/null \
|| fail 'an account has no user name'
jq -e '.currentUser | length > 0' <<<"$snapshot" >/dev/null \
|| fail 'the snapshot does not say which account is signed in'
offenders="$(jq -r '[paths | map(tostring) | join(".")] | map(select(test("(password|secret|hash)$";"i"))) | join(", ")' <<<"$snapshot")"
[[ -z "$offenders" ]] || fail "the snapshot carries credential-shaped fields: $offenders"
# System accounts are not people and must not be offered for management.
jq -e '[.users[] | .uid >= 1000] | all' <<<"$snapshot" >/dev/null \
|| fail 'a system account is listed as a manageable user'
# ── Input validation ────────────────────────────────────────────────────────
for bad in "root; rm -rf /" "../escape" "UPPER" ""; do
result="$("$helper" set-real-name "$bad" "Test" 2>/dev/null | jq -r '.error // ""')"
[[ -n "$result" ]] || fail "the helper accepted \"$bad\" as a user name"
done
printf 'user accounts contract: PASS (%d account(s), credentials never on a command line)\n' \
"$(jq '.users | length' <<<"$snapshot")"