arcanis/netctl-gui
1
0
Fork 0
mirror of https://github.com/arcan1s/netctl-gui.git synced 2025-04-24 15:37:23 +00:00
Code Issues Projects Releases Wiki Activity

some fixes including adding double quotes

Browse Source
This commit is contained in:
arcan1s 2014-08-12 22:58:13 +04:00
parent b65f761520
commit 3b1701f8b5
15 changed files with 207 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sources/3rdparty/task/taskadds.cpp vendored
View File

@ -29,12 +29,14 @@ TaskResult runTask(const QString cmd, const bool useSuid)
command.waitForFinished(-1);
r.exitCode = command.exitCode();
r.output = command.readAllStandardOutput();
r.error = command.readAllStandardError();
} else {
QProcess command;
command.start(cmd);
command.waitForFinished(-1);
r.exitCode = command.exitCode();
r.output = command.readAllStandardOutput();
r.error = command.readAllStandardError();
}
return r;

1
sources/3rdparty/task/taskadds.h vendored
View File

@ -38,6 +38,7 @@ protected:
struct TaskResult
{
int exitCode;
QByteArray error;
QByteArray output;
};
TaskResult runTask(const QString cmd, const bool useSuid = true);

6
sources/dataengine/netctl.conf
View File

@ -2,15 +2,15 @@
## Commands
# command
CMD=/usr/bin/netctl
NETCTLCMD=/usr/bin/netctl
# netctl-auto command
NETCTLAUTOCMD=/usr/bin/netctl-auto
## External IP
# external IPv4 check command
EXTIPCMD=curl ip4.telize.com
EXTIP4CMD=curl ip4.telize.com
# 'true' - check external IPv4
EXTIP=false
EXTIP4=false
# external IPv6 check command
EXTIP6CMD=curl ip6.telize.com
# 'true' - check external IPv6

3
sources/gui/docs/CMakeLists.txt
View File

@ -1,9 +1,12 @@
# build pages
file (GLOB SUBPROJECT_DOCS_IN *.html)
file (GLOB SUBPROJECT_IMGS *.png)
foreach (DOC_IN ${SUBPROJECT_DOCS_IN})
file (RELATIVE_PATH ONE_DOC ${CMAKE_SOURCE_DIR} ${DOC_IN})
configure_file (${DOC_IN} ${CMAKE_CURRENT_BINARY_DIR}/${ONE_DOC})
set (SUBPROJECT_DOCS ${SUBPROJECT_DOCS} ${CMAKE_CURRENT_BINARY_DIR}/${ONE_DOC})
endforeach ()
install (FILES ${SUBPROJECT_DOCS} DESTINATION share/doc/${PROJECT_NAME})
install (FILES ${SUBPROJECT_IMGS} DESTINATION share/doc/${PROJECT_NAME})

BIN
sources/gui/docs/architecture.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 40 KiB

57
sources/gui/docs/netctl-gui-security-notes.html
View File

@ -8,11 +8,68 @@
<h1>netctl-gui security notes</h1>
<h3>Project version : @PROJECT_VERSION@</h3>
<ol>
<li><a href="#description">Description</a></li>
<li><a href="#arch">Architecture</a></li>
<li><a href="#kde">KDE components security</a></li>
<li><a href="#kde">Graphical interface security</a></li>
<li><a href="#library">Library security</a></li>
<li><a href="#helper">Helper security</a></li>
<ul><li><a href="#helper-suid">Run helper with SUID bit</a></li></ul>
<li><a href="#links">External links</a></li>
</ol>
</head>
<body>
<h2><a href="#description" class="anchor" name="description"></a>Description</h2>
<p></p>
<h2><a href="#arch" class="anchor" name="arch"></a>Architecture</h2>
<img src="architecture.png" alt="architecture" align="middle">
<h2><a href="#kde" class="anchor" name="kde"></a>KDE components security</h2>
<p>There are two netctl-based commands which are run from the DataEngine</p>
<ul>
<li><code>&lt;cmd&gt; list</code></li>
<li><code>netctl is-enabled &lt;profile&gt;</code></li>
</ul>
<p>Both of them do not require any additional privileges normally. Also DataEngine has two other command which will be run from; they should define external IP. According to the idea that user can set <i>any</i> command to run, this module is not secure. But running commands will not do more than user can do from console himself.</p>
<p>The widget gets information from DataEngine, thus it does not require any additional permissions to show information. But netctl calls with root privileges are used to control netctl. In this case used commands are</p>
<ul>
<li><code>netctl enable &lt;profile&gt;</code></li>
<li><code>netctl disable &lt;profile&gt;</code></li>
<li><code>netctl restart &lt;profile&gt;</code></li>
<li><code>netctl start &lt;profile&gt;</code></li>
<li><code>netctl stop &lt;profile&gt;</code></li>
<li><code>netctl switch-to &lt;profile&gt;</code></li>
<li><code>netctl-auto switch-to &lt;profile&gt;</code></li>
</ul>
<p>All netctl-based commands <i>requires</i> root privileges and <code>sudo</code> (and any other alternatives) is used normally as prefix to the commands. The netctl-auto command does not require additional permissions.</p>
<p>The other way is to use DBus communication with <a href="#helper">the helper</a>. In this case user should have rights to start the helper.</p>
<h2><a href="#gui" class="anchor" name="gui"></a>Graphical interface security</h2>
<p>Graphical interface may interact with netctl over <a href="#helper">DBus (the helper)</a> and over <a href="#library">the library</a>. Please refer to their notes to any additional information. If user uses helper he should have permissions to run it.</p>
<h2><a href="#gui" class="anchor" name="gui"></a>Library security</h2>
<p>According to <a href="#arch">the scheme</a> library gets information from netctl and can control it. Also it provides some additional functions such as a profile creation and removal and access to wpa_supplicant functions. Some function does not require additional permissions, but other ones do it. All dynamic arguments including profile names and paths are in double quotes to avoid white spaces problem. The functions which requires root privileges are:</p>
<ul>
<li>Netctl control module</li>
<ul>
<li><code>netctl start|stop|restart|switch-to|enable|disable &lt;profile&gt;</code>. They are commands which provide a general control to netctl.</li>
<li><code>systemctl start|restart|enable &lt;netctl-auto@service&gt;</code>. They are commands which provide ability to control netctl-auto systemd service.</li>
</ul>
<li>Netctl profiles module</li>
<ul>
<li>Copying of a temporary profile from home directory to netctl profiles directory. <code>cp</code> command is used for it.</li>
<li>Removal of a profile. <code>rm</code> command is used for it.</li>
</ul>
<li>WiFi module</li>
<ul>
<li>This module require root privileges to start wpa_supplicant only. For the futher interaction user must be in <code>CTRL_GROUP</code>.</li>
</ul>
</ul>
<h2><a href="#links" class="anchor" name="links"></a>External links</h2>
<ul>
<li><a href="http://arcanis.name/projects/netctl-gui/">Homepage</a></li>

88
sources/gui/docs/netctl-gui-security-notes.html~ Normal file
View File

@ -0,0 +1,88 @@
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>netctl-gui secutiry notes</title>
<style type="text/css">
</style>
<h1>netctl-gui security notes</h1>
<h3>Project version : @PROJECT_VERSION@</h3>
<ol>
<li><a href="#description">Description</a></li>
<li><a href="#arch">Architecture</a></li>
<li><a href="#kde">KDE components security</a></li>
<li><a href="#kde">Graphical interface security</a></li>
<li><a href="#library">Library security</a></li>
<li><a href="#helper">Helper security</a></li>
<ul><li><a href="#helper-suid">Run helper with SUID bit</a></li></ul>
<li><a href="#links">External links</a></li>
</ol>
</head>
<body>
<h2><a href="#description" class="anchor" name="description"></a>Description</h2>
<p></p>
<h2><a href="#arch" class="anchor" name="arch"></a>Architecture</h2>
<img src="architecture.png" alt="architecture" align="middle">
<h2><a href="#kde" class="anchor" name="kde"></a>KDE components security</h2>
<p>There are two netctl-based commands which are run from the DataEngine</p>
<ul>
<li><code>&lt;cmd&gt; list</code></li>
<li><code>netctl is-enabled &lt;profile&gt;</code></li>
</ul>
<p>Both of them do not require any additional privileges normally. Also DataEngine has two other command which will be run from; they should define external IP. According to the idea that user can set <i>any</i> command to run, this module is not secure. But running commands will not do more than user can do from console himself.</p>
<p>The widget gets information from DataEngine, thus it does not require any additional permissions to show information. But netctl calls with root privileges are used to control netctl. In this case used commands are</p>
<ul>
<li><code>netctl enable &lt;profile&gt;</code></li>
<li><code>netctl disable &lt;profile&gt;</code></li>
<li><code>netctl restart &lt;profile&gt;</code></li>
<li><code>netctl start &lt;profile&gt;</code></li>
<li><code>netctl stop &lt;profile&gt;</code></li>
<li><code>netctl switch-to &lt;profile&gt;</code></li>
<li><code>netctl-auto switch-to &lt;profile&gt;</code></li>
</ul>
<p>All netctl-based commands <i>requires</i> root privileges and <code>sudo</code> (and any other alternatives) is used normally as prefix to the commands. The netctl-auto command does not require additional permissions.</p>
<p>The other way is to use DBus communication with <a href="#helper">the helper</a>. In this case user should have rights to start the helper.</p>
<h2><a href="#gui" class="anchor" name="gui"></a>Graphical interface security</h2>
<p>Graphical interface may interact with netctl over <a href="#helper">DBus (the helper)</a> and over <a href="#library">the library</a>. Please refer to their notes to any additional information. If user uses helper he should have permissions to run it.</p>
<h2><a href="#gui" class="anchor" name="gui"></a>Library security</h2>
<p>According to <a href="#arch">the scheme</a> library gets information from netctl and can control it. Also it provides some additional functions such as a profile creation and removal and access to wpa_supplicant functions. Some function does not require additional permissions, but other ones do it. All dynamic arguments including profile names and paths are in double quotes to avoid white spaces problem. The functions which requires root privileges are:</p>
<ul>
<li>Netctl control module</li>
<ul>
<li><code>netctl start|stop|restart|switch-to|enable|disable &lt;profile&gt;</code>. They are commands which provide a general control to netctl.</li>
<li><code>systemctl start|restart|enable &lt;netctl-auto@service&gt;</code>. They are commands which provide ability to control netctl-auto systemd service.</li>
</ul>
<li>Netctl profiles module</li>
<ul>
<li>Copying of a temporary profile from home directory to netctl profiles directory. <code>cp</code> command is used for it.</li>
<li>Removal of a profile. <code>rm</code> command is used for it.</li>
</ul>
<li>WiFi module</li>
<ul>
<li>This module require root privileges to start wpa_supplicant only. For the futher interaction user must be in <code>CTRL_GROUP</code>.</li>
</ul>
</ul>
<p></p>
<h2><a href="#links" class="anchor" name="links"></a>External links</h2>
<ul>
<li><a href="http://arcanis.name/projects/netctl-gui/">Homepage</a></li>
<li><a href="https://github.com/arcan1s/netctl-gui">Repository</a></li>
<li><a href="https://github.com/arcan1s/netctl-gui/issues">Bugtracker</a></li>
</ul>
<p align="center" style="font-size: 70%">
&copy; 2014-@CURRENT_YEAR@ <a href="mailto:@PROJECT_CONTACT@">@PROJECT_AUTHOR@</a><br>
This software is licensed under @PROJECT_LICENSE@
</p>
</body>
</html>

19
sources/gui/src/mainpublicslots.cpp
View File

@ -137,14 +137,24 @@ bool MainWindow::startProfileSlot(const QString profile)
if (useHelper) {
QList<QVariant> args;
args.append(profile);
sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_CTRL_PATH,
DBUS_HELPER_INTERFACE, QString("Start"),
args, true, debug);
if (sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_LIB_PATH,
DBUS_HELPER_INTERFACE, QString("ActiveProfile"),
QList<QVariant>(), true, debug)[0].toString().isEmpty())
sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_CTRL_PATH,
DBUS_HELPER_INTERFACE, QString("Start"),
args, true, debug);
else
sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_CTRL_PATH,
DBUS_HELPER_INTERFACE, QString("SwitchTo"),
args, true, debug);
current = sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_LIB_PATH,
DBUS_HELPER_INTERFACE, QString("isProfileActive"),
args, true, debug)[0].toBool();
} else {
netctlCommand->startProfile(profile);
if (netctlCommand->getActiveProfile().isEmpty())
netctlCommand->startProfile(profile);
else
netctlCommand->switchToProfile(profile);
current = netctlCommand->isProfileActive(profile);
}
@ -328,7 +338,6 @@ void MainWindow::updateConfiguration(const QMap<QString, QVariant> args)
qApp->installTranslator(translator);
createObjects();
checkHelperStatus();
createActions();
// tray

3
sources/gui/src/mainwindow.cpp
View File

@ -294,6 +294,8 @@ bool MainWindow::checkHelperStatus()
sendDBusRequest(DBUS_HELPER_SERVICE, DBUS_CTRL_PATH,
DBUS_HELPER_INTERFACE, QString("Update"),
QList<QVariant>(), true, debug);
else
configuration[QString("FORCE_SUDO")] = QString("true");
if (isHelperServiceActive())
configuration[QString("CLOSE_HELPER")] = QString("false");
@ -401,6 +403,7 @@ void MainWindow::createObjects()
errorWin->showWindow(19, QString("[MainWindow] : [createObjects]"));
useHelper = false;
}
checkHelperStatus();
netctlCommand = new Netctl(debug, configuration);
netctlProfile = new NetctlProfile(debug, configuration);

1
sources/helper/netctlgui-helper.service
View File

@ -2,6 +2,7 @@
Description=netctlgui-helper daemon
[Service]
Type=forking
ExecStart=/usr/bin/netctlgui-helper
[Install]

1
sources/netctlgui/include/netctlgui/wpasupinteract.h
View File

@ -71,6 +71,7 @@ public:
* @param settings default settings. Needed keys are
* CTRL_DIR (path to ctrl_directory),
* CTRL_GROUP (group which is owner of CTRL_DIR),
* FORCE_SUDO (force to use sudo),
* PID_FILE (wpa_supplicant PID file),
* SUDO_PATH (path to sudo command),
* WPACLI_PATH (path to wpa_cli command),

8
sources/netctlgui/src/netctlinteract.cpp
View File

@ -97,10 +97,12 @@ bool Netctl::cmdCall(const bool sudo, const QString command, const QString comma
cmd = sudoCommand + QString(" ");
cmd += command + QString(" ") + commandLine;
if (argument != 0)
cmd += QString(" ") + argument;
cmd += QString(" \"") + argument + QString("\"");
if (debug) qDebug() << "[Netctl]" << "[cmdCall]" << ":" << "Run cmd" << cmd;
TaskResult process = runTask(cmd, (useSuid && sudo));
if (debug) qDebug() << "[Netctl]" << "[cmdCall]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[Netctl]" << "[cmdCall]" << ":" << "Error" << process.error;
if (process.exitCode == 0)
return true;
@ -128,10 +130,12 @@ QString Netctl::getCmdOutput(const bool sudo, const QString command, const QStri
cmd = sudoCommand + QString(" ");
cmd += command + QString(" ") + commandLine;
if (argument != 0)
cmd += QString(" ") + argument;
cmd += QString(" \"") + argument + QString("\"");
if (debug) qDebug() << "[Netctl]" << "[getCmdOutput]" << ":" << "Run cmd" << cmd;
TaskResult process = runTask(cmd, (useSuid && sudo));
if (debug) qDebug() << "[Netctl]" << "[getCmdOutput]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[Netctl]" << "[getCmdOutput]" << ":" << "Error" << process.error;
return process.output;
}

40
sources/netctlgui/src/netctlprofile.cpp
View File

@ -80,10 +80,12 @@ bool NetctlProfile::copyProfile(const QString oldPath)
}
QString newPath = profileDirectory->absolutePath() + QDir::separator() + QFileInfo(oldPath).fileName();
QString cmd = sudoCommand + QString(" /usr/bin/mv ") + oldPath + QString(" ") + newPath;
QString cmd = sudoCommand + QString(" /usr/bin/mv \"") + oldPath + QString("\" \"") + newPath + QString("\"");
if (debug) qDebug() << "[NetctlProfile]" << "[copyProfile]" << ":" << "Run cmd" << cmd;
TaskResult process = runTask(cmd, useSuid);
if (debug) qDebug() << "[NetctlProfile]" << "[copyProfile]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[NetctlProfile]" << "[copyProfile]" << ":" << "Error" << process.error;
if (process.exitCode == 0)
return true;
@ -143,13 +145,13 @@ QMap<QString, QString> NetctlProfile::getSettingsFromProfile(const QString profi
// getting variables list
// system variables
QProcess shell;
QString cmd = QString("env -i bash -c \"set\"");
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Run cmd" << cmd;
shell.start(cmd);
shell.waitForFinished(-1);
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Cmd returns" << shell.exitCode();
QStringList output = QString(shell.readAllStandardOutput()).trimmed().split(QChar('\n'));
TaskResult process = runTask(cmd, false);
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Error" << process.error;
QStringList output = QString(process.output).trimmed().split(QChar('\n'));
QStringList systemVariables;
systemVariables.append(QString("PIPESTATUS"));
for (int i=0; i<output.count(); i++)
@ -157,12 +159,13 @@ QMap<QString, QString> NetctlProfile::getSettingsFromProfile(const QString profi
// profile variables
QMap<QString, QString> settings;
QString profileUrl = profileDirectory->absolutePath() + QDir::separator() + QFileInfo(profile).fileName();
cmd = QString("env -i bash -c \"source ") + profileUrl + QString("; set\"");
cmd = QString("env -i bash -c \"source '") + profileUrl + QString("'; set\"");
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Run cmd" << cmd;
shell.start(cmd);
shell.waitForFinished(-1);
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Cmd returns" << shell.exitCode();
output = QString(shell.readAllStandardOutput()).trimmed().split(QChar('\n'));
process = runTask(cmd, false);
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << "Error" << process.error;
output = QString(process.output).trimmed().split(QChar('\n'));
// gettings variables
QStringList keys;
@ -170,12 +173,11 @@ QMap<QString, QString> NetctlProfile::getSettingsFromProfile(const QString profi
if (!systemVariables.contains(output[i].split(QChar('='))[0]))
keys.append(output[i].split(QChar('='))[0]);
for (int i=0; i<keys.count(); i++){
cmd = QString("env -i bash -c \"source ") + profileUrl +
QString("; for i in ${!") + keys[i] + QString("[@]}; do echo ${") +
cmd = QString("env -i bash -c \"source '") + profileUrl +
QString("'; for i in ${!") + keys[i] + QString("[@]}; do echo ${") +
keys[i] + QString("[$i]}; done\"");
shell.start(cmd);
shell.waitForFinished(-1);
settings[keys[i]] = shell.readAllStandardOutput().trimmed();
process = runTask(cmd, false);
settings[keys[i]] = process.output.trimmed();
if (debug) qDebug() << "[NetctlProfile]" << "[getSettingsFromProfile]" << ":" << keys[i] << "=" << settings[keys[i]];
}
@ -197,7 +199,7 @@ QString NetctlProfile::getValueFromProfile(const QString profile, const QString
if (settings.contains(key))
return settings[key];
else
return QString("");
return QString();
}
@ -214,10 +216,12 @@ bool NetctlProfile::removeProfile(const QString profile)
}
QString profilePath = profileDirectory->absolutePath() + QDir::separator() + QFileInfo(profile).fileName();
QString cmd = sudoCommand + QString(" /usr/bin/rm ") + profilePath;
QString cmd = sudoCommand + QString(" /usr/bin/rm \"") + profilePath + QString("\"");
if (debug) qDebug() << "[NetctlProfile]" << "[removeProfile]" << ":" << "Run cmd" << cmd;
TaskResult process = runTask(cmd, useSuid);
if (debug) qDebug() << "[NetctlProfile]" << "[removeProfile]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[NetctlProfile]" << "[removeProfile]" << ":" << "Error" << process.error;
if (process.exitCode == 0)
return true;

6
sources/netctlgui/src/wpasupinteract.cpp
View File

@ -269,6 +269,8 @@ bool WpaSup::startWpaSupplicant()
TaskResult process = runTask(cmd, useSuid);
waitForProcess(1);
if (debug) qDebug() << "[WpaSup]" << "[startWpaSupplicant]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[WpaSup]" << "[startWpaSupplicant]" << ":" << "Error" << process.error;
if (process.exitCode == 0)
return true;
@ -324,6 +326,8 @@ QString WpaSup::getWpaCliOutput(const QString commandLine)
if (debug) qDebug() << "[WpaSup]" << "[getWpaCliOutput]" << ":" << "Run cmd" << cmd;
TaskResult process = runTask(cmd);
if (debug) qDebug() << "[WpaSup]" << "[getWpaCliOutput]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[WpaSup]" << "[getWpaCliOutput]" << ":" << "Error" << process.error;
return process.output;
}
@ -380,6 +384,8 @@ bool WpaSup::wpaCliCall(const QString commandLine)
TaskResult process = runTask(cmd);
waitForProcess(1);
if (debug) qDebug() << "[WpaSup]" << "[getWpaCliOutput]" << ":" << "Cmd returns" << process.exitCode;
if (process.exitCode != 0)
if (debug) qDebug() << "[NetctlProfile]" << "[getWpaCliOutput]" << ":" << "Error" << process.error;
if (process.exitCode == 0)
return true;

1
sources/plasmoid/netctl.cpp
View File

@ -907,7 +907,6 @@ void Netctl::configChanged()
if (useHelper) startHelper();
checkHelperStatus();
connectToEngine();
setAssociatedApplication(paths[QString("gui")]);
}