Turn the rows that only reported things into controls
Autostart entries showed "Enabled" or "Disabled" as plain text. The row did toggle on click the whole time, so this is an affordance rather than a missing capability -- but a control that reads as static text is one nobody knows they have. It is a switch now, with removal alongside it behind a confirmation: disabling writes Hidden=true and can be undone, deleting the file cannot. remove-autostart is confined to files the autostart directory owns. It resolves the path and compares the parent, so a name like "../../.bashrc" cannot escape, and it refuses symlinks rather than following them -- deleting through one would remove whatever it points at, which is somewhere else and not ours. Each refusal was tested against a fixture directory, including a symlink aimed at /etc/hostname, which survived. Sharing says who is signed in from another machine: user, origin and since when. An empty list on this machine proves nothing, so the parser was checked against sample `who` output -- it picks out remote sessions and leaves out local seats and the :0 display, which would otherwise report the person at the keyboard as a remote login. Media sharing was "Available" and nothing else: rygel installed, rygel.service disabled, no way to change that from here. It is a switch now, and it says what it does before you touch it rather than afterwards -- turning it on publishes media folders to every device on the network with no password in front of them. Per-application camera and microphone permissions come from the portal's permission store, which is where an application that asked through the portal has its answer recorded. The page states the limit plainly instead of implying a protection that does not exist: a program installed outside the portal opens the device directly and nothing here stands in its way. Anything that is not an explicit "yes" is treated as withheld, because guessing generously about a camera is the wrong way to be wrong. The first version of the write silently did nothing -- SetPermission takes an array of strings and was being handed one string -- and the test did not notice, because it discarded the helper's output and only checked that state was unchanged afterwards, which was trivially true. The contract now requires the value to move, and was proven to fail by putting that exact bug back. Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L
This commit is contained in:
Gabriel Brown
@@ -352,6 +352,38 @@ def update_hidden(path: Path, *, hidden: bool) -> None:
|
||||
write_atomic(path, with_hidden(original, hidden=hidden), mode=mode)
|
||||
|
||||
|
||||
def remove_autostart(desktop_id: str) -> None:
|
||||
"""Delete a user autostart entry.
|
||||
|
||||
Disabling writes Hidden=true and is reversible; this is not, so it is
|
||||
confined to files this directory owns. A symlink is refused rather than
|
||||
followed, because deleting through one would remove whatever it points at --
|
||||
which is somewhere else entirely, and not ours.
|
||||
"""
|
||||
if not DESKTOP_ID.fullmatch(desktop_id):
|
||||
raise BoundaryError("That is not an autostart entry name.")
|
||||
|
||||
directory = autostart_directory()
|
||||
target = directory / desktop_id
|
||||
|
||||
# Resolved and compared, so a name like "../../.bashrc" cannot escape.
|
||||
try:
|
||||
resolved = target.resolve(strict=True)
|
||||
except OSError as error:
|
||||
raise BoundaryError("That autostart entry no longer exists.") from error
|
||||
if resolved.parent != directory.resolve(strict=False):
|
||||
raise BoundaryError("That autostart entry is not in the autostart directory.")
|
||||
if target.is_symlink() or not target.is_file():
|
||||
raise BoundaryError("That autostart entry is not a file this can remove.")
|
||||
if target.suffix != ".desktop":
|
||||
raise BoundaryError("That autostart entry is not a desktop file.")
|
||||
|
||||
try:
|
||||
target.unlink()
|
||||
except OSError as error:
|
||||
raise BoundaryError("That autostart entry could not be removed.") from error
|
||||
|
||||
|
||||
def add_autostart(desktop_id: str) -> None:
|
||||
desktop_files = discovered_desktop_files()
|
||||
require_desktop_id(desktop_id, discovered=set(desktop_files))
|
||||
@@ -406,6 +438,8 @@ def main(arguments: list[str]) -> int:
|
||||
set_default(arguments[1], arguments[2])
|
||||
elif len(arguments) == 3 and arguments[0] == "set-autostart":
|
||||
set_autostart(arguments[1], arguments[2])
|
||||
elif len(arguments) == 2 and arguments[0] == "remove-autostart":
|
||||
remove_autostart(arguments[1])
|
||||
elif len(arguments) == 2 and arguments[0] == "add-autostart":
|
||||
add_autostart(arguments[1])
|
||||
else:
|
||||
|
||||
+186
@@ -0,0 +1,186 @@
|
||||
#!/usr/bin/env python3
|
||||
|
||||
"""Which applications may use the camera and microphone.
|
||||
|
||||
Read from xdg-desktop-portal's permission store, which is where an application
|
||||
that asks through the portal has its answer recorded. That is the whole of what
|
||||
this can control, and the limit is worth stating plainly rather than implying a
|
||||
protection that does not exist: a native binary opens /dev/video0 directly and
|
||||
no desktop setting stands in its way. What this covers is Flatpaks and anything
|
||||
else that goes through the portal -- which on this machine is most of what would
|
||||
ever ask.
|
||||
|
||||
Devices with no recorded application are reported as empty rather than omitted,
|
||||
so the page can say "nothing has asked" instead of showing nothing at all.
|
||||
|
||||
panama-permissions snapshot
|
||||
panama-permissions set DEVICE APP_ID allow|deny
|
||||
panama-permissions forget DEVICE APP_ID
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
TABLE = "devices"
|
||||
|
||||
# The devices the portal arbitrates. Listed rather than discovered so a device
|
||||
# nothing has asked for still appears, which is the difference between "no
|
||||
# application uses your microphone" and a page that silently omits it.
|
||||
DEVICES = (
|
||||
("camera", "Camera"),
|
||||
("microphone", "Microphone"),
|
||||
("speakers", "Speakers"),
|
||||
)
|
||||
|
||||
APP_ID = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$")
|
||||
DEVICE_ID = re.compile(r"^[a-z]+$")
|
||||
|
||||
ALLOWED = "yes"
|
||||
DENIED = "no"
|
||||
|
||||
|
||||
class BoundaryError(RuntimeError):
|
||||
"""A user-visible validation or permission-store failure."""
|
||||
|
||||
|
||||
def run(command: list[str], timeout: float = 15.0) -> subprocess.CompletedProcess:
|
||||
try:
|
||||
return subprocess.run(command, capture_output=True, text=True, timeout=timeout)
|
||||
except FileNotFoundError as error:
|
||||
raise BoundaryError("busctl is not available.") from error
|
||||
except subprocess.TimeoutExpired as error:
|
||||
raise BoundaryError("The permission store did not respond.") from error
|
||||
|
||||
|
||||
def portal_call(method: str, signature: str, *arguments: str) -> dict | None:
|
||||
"""One call to the permission store, as JSON.
|
||||
|
||||
--json=short rather than busctl's text output, which escapes non-ASCII into
|
||||
octal and would mangle an application name.
|
||||
"""
|
||||
result = run([
|
||||
"busctl", "--user", "--json=short", "call",
|
||||
"org.freedesktop.impl.portal.PermissionStore",
|
||||
"/org/freedesktop/impl/portal/PermissionStore",
|
||||
"org.freedesktop.impl.portal.PermissionStore",
|
||||
method, signature, *arguments,
|
||||
])
|
||||
if result.returncode != 0:
|
||||
detail = (result.stderr or "").strip()
|
||||
# A device nothing has ever asked for has no row at all, and the store
|
||||
# says so as "No entry for camera". Matched on the store's actual words
|
||||
# rather than a guess at them.
|
||||
lowered = detail.lower()
|
||||
if "no entry" in lowered or "not found" in lowered:
|
||||
return None
|
||||
raise BoundaryError(detail.splitlines()[-1] if detail else "The permission store refused that.")
|
||||
try:
|
||||
return json.loads(result.stdout or "null")
|
||||
except json.JSONDecodeError as error:
|
||||
raise BoundaryError("The permission store returned something unreadable.") from error
|
||||
|
||||
|
||||
def available() -> bool:
|
||||
result = run(["busctl", "--user", "list"])
|
||||
return "org.freedesktop.impl.portal.PermissionStore" in (result.stdout or "")
|
||||
|
||||
|
||||
def entries_for(device: str) -> list[dict]:
|
||||
payload = portal_call("Lookup", "ss", TABLE, device)
|
||||
if not payload:
|
||||
return []
|
||||
data = payload.get("data") or []
|
||||
if not data or not isinstance(data[0], dict):
|
||||
return []
|
||||
|
||||
found = []
|
||||
for app_id, permissions in data[0].items():
|
||||
values = [str(value) for value in (permissions or [])]
|
||||
found.append({
|
||||
"app": app_id,
|
||||
# Anything that is not an explicit "yes" is treated as withheld:
|
||||
# guessing generously about a camera is the wrong way to be wrong.
|
||||
"allowed": ALLOWED in values,
|
||||
"raw": ",".join(values),
|
||||
})
|
||||
found.sort(key=lambda entry: entry["app"].casefold())
|
||||
return found
|
||||
|
||||
|
||||
def snapshot() -> dict:
|
||||
if not available():
|
||||
return {
|
||||
"available": False,
|
||||
"devices": [],
|
||||
"error": "The desktop portal's permission store is not running.",
|
||||
}
|
||||
|
||||
devices = []
|
||||
for device_id, label in DEVICES:
|
||||
devices.append({
|
||||
"id": device_id,
|
||||
"label": label,
|
||||
"applications": entries_for(device_id),
|
||||
})
|
||||
return {"available": True, "devices": devices, "error": ""}
|
||||
|
||||
|
||||
def require(pattern: re.Pattern[str], value: str, message: str) -> str:
|
||||
if not pattern.match(value or ""):
|
||||
raise BoundaryError(message)
|
||||
return value
|
||||
|
||||
|
||||
def set_permission(device: str, app: str, allowed: bool) -> None:
|
||||
require(DEVICE_ID, device, "That is not a device.")
|
||||
require(APP_ID, app, "That is not an application.")
|
||||
if not any(device == known for known, _ in DEVICES):
|
||||
raise BoundaryError("That is not a device this manages.")
|
||||
# Permissions are an array of strings, so busctl needs the element count
|
||||
# before the element -- "1 yes", not "yes".
|
||||
portal_call("SetPermission", "sbssas", TABLE, "true", device, app,
|
||||
"1", ALLOWED if allowed else DENIED)
|
||||
|
||||
|
||||
def forget(device: str, app: str) -> None:
|
||||
"""Drop the recorded answer, so the application is asked again next time."""
|
||||
require(DEVICE_ID, device, "That is not a device.")
|
||||
require(APP_ID, app, "That is not an application.")
|
||||
portal_call("DeletePermission", "sss", TABLE, device, app)
|
||||
|
||||
|
||||
def main(arguments: list[str]) -> int:
|
||||
try:
|
||||
if arguments == ["snapshot"]:
|
||||
print(json.dumps(snapshot(), separators=(",", ":")))
|
||||
return 0
|
||||
|
||||
if len(arguments) == 4 and arguments[0] == "set":
|
||||
if arguments[3] not in ("allow", "deny"):
|
||||
raise BoundaryError("That is not allow or deny.")
|
||||
set_permission(arguments[1], arguments[2], arguments[3] == "allow")
|
||||
elif len(arguments) == 3 and arguments[0] == "forget":
|
||||
forget(arguments[1], arguments[2])
|
||||
else:
|
||||
raise BoundaryError(
|
||||
"Usage: panama-permissions snapshot | set DEVICE APP allow|deny | "
|
||||
"forget DEVICE APP")
|
||||
except BoundaryError as error:
|
||||
try:
|
||||
state = snapshot()
|
||||
except BoundaryError:
|
||||
state = {"available": False, "devices": []}
|
||||
state["error"] = str(error)
|
||||
print(json.dumps(state, separators=(",", ":")))
|
||||
return 0
|
||||
|
||||
print(json.dumps(snapshot(), separators=(",", ":")))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main(sys.argv[1:]))
|
||||
@@ -98,6 +98,62 @@ def remote_desktop() -> dict:
|
||||
return state
|
||||
|
||||
|
||||
def active_logins() -> list[dict[str, str]]:
|
||||
"""Who is signed in from another machine right now.
|
||||
|
||||
Read from `who`, which names the user, when they arrived, and where from.
|
||||
Only sessions with an origin are reported: a local seat has none, and
|
||||
listing the person sitting at the keyboard as a remote login would be
|
||||
alarming and wrong.
|
||||
"""
|
||||
result = run(["who"])
|
||||
if result.returncode != 0:
|
||||
return []
|
||||
|
||||
sessions: list[dict[str, str]] = []
|
||||
for line in result.stdout.splitlines():
|
||||
match = re.match(r"^(\S+)\s+(\S+)\s+(.+?)\s+\((.+)\)\s*$", line)
|
||||
if not match:
|
||||
continue
|
||||
user, line_name, when, origin = match.groups()
|
||||
# X displays appear in the same parenthesised field as a hostname.
|
||||
if origin.startswith(":") or origin in ("localhost", ""):
|
||||
continue
|
||||
sessions.append({
|
||||
"user": user,
|
||||
"line": line_name,
|
||||
"since": when.strip(),
|
||||
"from": origin,
|
||||
})
|
||||
return sessions
|
||||
|
||||
|
||||
def media_sharing() -> dict:
|
||||
"""Rygel, which serves media to devices on the network over DLNA.
|
||||
|
||||
Reported as a running state rather than just "installed", because installed
|
||||
and off is the normal case and is not the same thing as sharing. Turning it
|
||||
on publishes media directories to every device on the network, which is why
|
||||
the page says so next to the switch.
|
||||
"""
|
||||
if not shutil.which("rygel"):
|
||||
return {"installed": False, "active": False, "enabled": False, "package": "rygel"}
|
||||
state = unit_state("rygel.service", user=True)
|
||||
state["installed"] = True
|
||||
state["package"] = "rygel"
|
||||
return state
|
||||
|
||||
|
||||
def set_media_sharing(enabled: bool) -> None:
|
||||
if not shutil.which("rygel"):
|
||||
raise BoundaryError("Rygel is not installed.")
|
||||
verb = "enable" if enabled else "disable"
|
||||
result = run(["systemctl", "--user", verb, "--now", "rygel.service"])
|
||||
if result.returncode != 0:
|
||||
detail = (result.stderr or "").strip().splitlines()
|
||||
raise BoundaryError(detail[-1] if detail else "Media sharing could not be changed.")
|
||||
|
||||
|
||||
def snapshot() -> dict:
|
||||
static_name = run(["hostnamectl", "--static"]).stdout.strip()
|
||||
pretty_name = run(["hostnamectl", "--pretty"]).stdout.strip()
|
||||
@@ -106,6 +162,7 @@ def snapshot() -> dict:
|
||||
login["port"] = ssh_setting("Port") or "22"
|
||||
login["passwordAuthentication"] = ssh_setting("PasswordAuthentication")
|
||||
login["rootLogin"] = ssh_setting("PermitRootLogin")
|
||||
login["sessions"] = active_logins()
|
||||
|
||||
return {
|
||||
"hostname": static_name,
|
||||
@@ -115,7 +172,7 @@ def snapshot() -> dict:
|
||||
# Reported as absent rather than offered as a switch that would do
|
||||
# nothing. Installing software is not this page's job.
|
||||
"fileSharing": {"installed": bool(shutil.which("smbd")), "package": "samba"},
|
||||
"mediaSharing": {"installed": bool(shutil.which("rygel")), "package": "rygel"},
|
||||
"mediaSharing": media_sharing(),
|
||||
"error": "",
|
||||
}
|
||||
|
||||
@@ -187,7 +244,9 @@ def main(arguments: list[str]) -> int:
|
||||
if arguments == ["snapshot"]:
|
||||
print(json.dumps(snapshot(), separators=(",", ":")))
|
||||
return 0
|
||||
if len(arguments) == 2 and arguments[0] == "set-remote-login":
|
||||
if len(arguments) == 2 and arguments[0] == "set-media-sharing":
|
||||
set_media_sharing(arguments[1] == "true")
|
||||
elif len(arguments) == 2 and arguments[0] == "set-remote-login":
|
||||
set_remote_login(arguments[1] == "true")
|
||||
elif len(arguments) == 2 and arguments[0] == "set-remote-desktop":
|
||||
set_remote_desktop(arguments[1] == "true")
|
||||
|
||||
Reference in New Issue
Block a user