refactor(naming): A1 — ente→arje, vista→revista, pluma→fana
Rename batch de la Fase A del PLAN_MACRO: - 25 crates ente-* → arje-* (protocol/init/runtime/compat). El linaje arje (init Linux) queda con prefijo coherente. - vista → revista (revista-core + revista-web). - pluma → fana (fana-md + fana-md-reader-web). fana absorbe el linaje markdown de pluma; será el writer DAG editor (prioridad alta). Cambios: - git mv de 29 crate dirs + 2 SDDs - package/lib/bin names + path refs + imports .rs reescritos - workspace Cargo.toml + comentarios de sección - SDDs de init/runtime/compat/protocol actualizados a arje- - SDD de revista + SDD de fana (reescrito: writer DAG editor) - docs/STATUS.md, ROADMAP.md, PLAN_MACRO.md, arje-boot.md, arje-replace-systemd.md actualizados - docs/changelog/akasha.md → chasqui.md scripts/rename-fase-a.py idempotente (--dry-run soportado). cargo check --workspace verde. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
sergio
@@ -0,0 +1,221 @@
|
||||
//! ente-policy-provider: Ente que arbitra autorizaciones de Polkit.
|
||||
//!
|
||||
//! Se anuncia como proveedor de `POLKIT_DECISION_IFACE` en el bus interno.
|
||||
//! Cuando `ente-polkit-compat` recibe `CheckAuthorization` D-Bus, forwarda
|
||||
//! a este Ente vía Invoke. Aquí decidimos sí/no según política configurada.
|
||||
//!
|
||||
//! Wire format del blob de entrada: `pid_be_u32 | uid_be_u32 | action_id_utf8`.
|
||||
//! Respuesta: `[decision_byte]` — 1 = allow, 0 = deny.
|
||||
//!
|
||||
//! Política se carga de `/etc/ente/policy.json` (o ruta override por env
|
||||
//! `ENTE_POLICY_FILE`). Formato:
|
||||
//! ```json
|
||||
//! {
|
||||
//! "default": "allow",
|
||||
//! "rules": [
|
||||
//! { "match": "org.freedesktop.hostname1.*", "decision": "allow" },
|
||||
//! { "match": "org.freedesktop.login1.power-off", "require_uid": 0 },
|
||||
//! { "match": "*.set-*", "decision": "deny", "audit": true }
|
||||
//! ]
|
||||
//! }
|
||||
//! ```
|
||||
|
||||
use arje_bus::{BusResponse, BusServer, InvokeHandler, POLKIT_DECISION_IFACE};
|
||||
use arje_card::Capability;
|
||||
use serde::Deserialize;
|
||||
use std::sync::Arc;
|
||||
use tokio::signal::unix::{signal, SignalKind};
|
||||
use tracing::{info, warn};
|
||||
use tracing_subscriber::EnvFilter;
|
||||
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
struct PolicyConfig {
|
||||
#[serde(default = "default_decision")]
|
||||
default: Decision,
|
||||
#[serde(default)]
|
||||
rules: Vec<Rule>,
|
||||
}
|
||||
|
||||
fn default_decision() -> Decision { Decision::Allow }
|
||||
|
||||
#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)]
|
||||
#[serde(rename_all = "lowercase")]
|
||||
enum Decision { Allow, Deny }
|
||||
|
||||
#[derive(Debug, Clone, Deserialize)]
|
||||
struct Rule {
|
||||
/// Glob simple: `*` = wildcard. `org.freedesktop.hostname1.*` matchea
|
||||
/// cualquier action_id con ese prefijo.
|
||||
r#match: String,
|
||||
#[serde(default)]
|
||||
decision: Option<Decision>,
|
||||
/// Si presente, sólo este uid pasa. Otros se denegen.
|
||||
#[serde(default)]
|
||||
require_uid: Option<u32>,
|
||||
/// Si presente, sólo este pid pasa.
|
||||
#[serde(default)]
|
||||
require_pid: Option<u32>,
|
||||
#[serde(default)]
|
||||
audit: bool,
|
||||
}
|
||||
|
||||
impl Default for PolicyConfig {
|
||||
fn default() -> Self {
|
||||
// Default sensato: caps escaladas requieren uid 0; el resto allow.
|
||||
Self {
|
||||
default: Decision::Allow,
|
||||
rules: vec![
|
||||
// Power management: cualquiera puede pedir el reboot,
|
||||
// pero la decisión final está en el holder de Capability::Spawn.
|
||||
Rule {
|
||||
r#match: "org.freedesktop.login1.set-wall-message".into(),
|
||||
decision: Some(Decision::Allow), require_uid: None, require_pid: None, audit: true,
|
||||
},
|
||||
// hostname/timezone/locale: requieren root.
|
||||
Rule {
|
||||
r#match: "org.freedesktop.hostname1.*".into(),
|
||||
decision: None, require_uid: Some(0), require_pid: None, audit: true,
|
||||
},
|
||||
Rule {
|
||||
r#match: "org.freedesktop.timedate1.*".into(),
|
||||
decision: None, require_uid: Some(0), require_pid: None, audit: true,
|
||||
},
|
||||
Rule {
|
||||
r#match: "org.freedesktop.locale1.*".into(),
|
||||
decision: None, require_uid: Some(0), require_pid: None, audit: true,
|
||||
},
|
||||
],
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
async fn main() -> anyhow::Result<()> {
|
||||
init_tracing();
|
||||
info!("ente-policy-provider: arrancando");
|
||||
|
||||
let policy = load_policy();
|
||||
info!(rules = policy.rules.len(), default = ?policy.default, "policy cargada");
|
||||
|
||||
let handler = PolicyHandler { policy: Arc::new(policy) };
|
||||
|
||||
tokio::spawn(async {
|
||||
let mut term = signal(SignalKind::terminate()).unwrap();
|
||||
let mut int_ = signal(SignalKind::interrupt()).unwrap();
|
||||
tokio::select! {
|
||||
_ = term.recv() => info!("SIGTERM"),
|
||||
_ = int_.recv() => info!("SIGINT"),
|
||||
}
|
||||
std::process::exit(0);
|
||||
});
|
||||
|
||||
// Una única conexión: announce + serve. Bidirectional bajo el hood.
|
||||
let mut server = BusServer::from_env().await?;
|
||||
server.announce(vec![Capability::Endpoint {
|
||||
interface: POLKIT_DECISION_IFACE,
|
||||
version: 1,
|
||||
}]).await?;
|
||||
info!("Announce OK; sirviendo invokes de policy decision");
|
||||
server.serve(handler).await?;
|
||||
Ok(())
|
||||
}
|
||||
|
||||
struct PolicyHandler {
|
||||
policy: Arc<PolicyConfig>,
|
||||
}
|
||||
|
||||
impl InvokeHandler for PolicyHandler {
|
||||
fn handle(&mut self, cap: Capability, blob: Vec<u8>) -> BusResponse {
|
||||
// Validar cap (defensa contra forwarding a interface incorrecto).
|
||||
if !matches!(&cap, Capability::Endpoint { interface, .. } if *interface == POLKIT_DECISION_IFACE) {
|
||||
return BusResponse::Error(format!("policy-provider: cap inesperado {cap:?}"));
|
||||
}
|
||||
// Decodificar blob: [pid:4][uid:4][action_id...]
|
||||
if blob.len() < 8 {
|
||||
return BusResponse::Error("blob demasiado corto (esperado pid|uid|action_id)".into());
|
||||
}
|
||||
let pid = u32::from_be_bytes(blob[0..4].try_into().unwrap());
|
||||
let uid = u32::from_be_bytes(blob[4..8].try_into().unwrap());
|
||||
let action_id = match std::str::from_utf8(&blob[8..]) {
|
||||
Ok(s) => s,
|
||||
Err(_) => return BusResponse::Error("action_id no es UTF-8".into()),
|
||||
};
|
||||
|
||||
let decision = decide(&self.policy, action_id, pid, uid);
|
||||
let byte = if decision == Decision::Allow { 1u8 } else { 0u8 };
|
||||
info!(action_id, pid, uid, ?decision, "policy decision");
|
||||
BusResponse::Invoked { result: vec![byte] }
|
||||
}
|
||||
}
|
||||
|
||||
fn decide(policy: &PolicyConfig, action_id: &str, pid: u32, uid: u32) -> Decision {
|
||||
for rule in &policy.rules {
|
||||
if !glob_match(&rule.r#match, action_id) { continue; }
|
||||
if let Some(req_uid) = rule.require_uid {
|
||||
if uid != req_uid {
|
||||
if rule.audit {
|
||||
info!(action_id, uid, req_uid, "AUDIT: deny por uid mismatch");
|
||||
}
|
||||
return Decision::Deny;
|
||||
}
|
||||
}
|
||||
if let Some(req_pid) = rule.require_pid {
|
||||
if pid != req_pid {
|
||||
if rule.audit {
|
||||
info!(action_id, pid, req_pid, "AUDIT: deny por pid mismatch");
|
||||
}
|
||||
return Decision::Deny;
|
||||
}
|
||||
}
|
||||
if let Some(d) = rule.decision {
|
||||
if rule.audit {
|
||||
info!(action_id, ?d, "AUDIT: rule match con decisión explícita");
|
||||
}
|
||||
return d;
|
||||
}
|
||||
// Rule matched pero sin decisión explícita (sólo require_*) y todos
|
||||
// los requires pasaron — caemos al default.
|
||||
if rule.audit {
|
||||
info!(action_id, ?policy.default, "AUDIT: rule match → default");
|
||||
}
|
||||
return policy.default;
|
||||
}
|
||||
policy.default
|
||||
}
|
||||
|
||||
/// Glob simple: `*` matchea cualquier cosa. Soporta prefix (`foo.*`),
|
||||
/// suffix (`*.bar`) y wildcard exacto (`*`). No es PCRE — intencional.
|
||||
fn glob_match(pattern: &str, target: &str) -> bool {
|
||||
if pattern == "*" { return true; }
|
||||
if let Some(prefix) = pattern.strip_suffix(".*") {
|
||||
return target == prefix || target.starts_with(&format!("{prefix}."));
|
||||
}
|
||||
if let Some(suffix) = pattern.strip_prefix("*.") {
|
||||
return target == suffix || target.ends_with(&format!(".{suffix}"));
|
||||
}
|
||||
pattern == target
|
||||
}
|
||||
|
||||
fn load_policy() -> PolicyConfig {
|
||||
let path = std::env::var("ENTE_POLICY_FILE")
|
||||
.unwrap_or_else(|_| "/etc/ente/policy.json".into());
|
||||
match std::fs::read_to_string(&path) {
|
||||
Ok(content) => match serde_json::from_str(&content) {
|
||||
Ok(p) => { info!(path, "policy file cargado"); p }
|
||||
Err(e) => {
|
||||
warn!(?e, path, "policy file inválido, usando defaults");
|
||||
PolicyConfig::default()
|
||||
}
|
||||
},
|
||||
Err(_) => {
|
||||
info!(path, "policy file ausente — usando defaults conservadores");
|
||||
PolicyConfig::default()
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn init_tracing() {
|
||||
let filter = EnvFilter::try_from_default_env()
|
||||
.unwrap_or_else(|_| EnvFilter::new("arje_policy_provider=info"));
|
||||
tracing_subscriber::fmt().with_env_filter(filter).with_target(true).init();
|
||||
}
|
||||
Reference in New Issue
Block a user