fix: route desktop power actions through atom

Author: mirkobrombin

internal/control/sdb.go

@@ -76,14 +76,15 @@ func ListenSDB(path string, m *core.Manager, cfg SDBConfig) (*SDBServer, error)
 		_ = os.Remove(path)
 		return nil, fmt.Errorf("set sdb control mode: %w", err)
 	}
-	return &SDBServer{ln: ln, m: m, cfg: cfg}, nil
+	return &SDBServer{ln: ln, m: m, cfg: cfg, shutdown: shutdownAction}, nil
 }
 
-// SDBServer serves only status, enable and disable for sdbd.service.
+// SDBServer serves the fixed desktop operations delegated to ush-broker.
 type SDBServer struct {
-	ln  net.Listener
-	m   *core.Manager
-	cfg SDBConfig
+	ln       net.Listener
+	m        *core.Manager
+	cfg      SDBConfig
+	shutdown func(syscall.Signal) Reply
 }
 
 func (s *SDBServer) Serve() {
@@ -119,6 +120,10 @@ func (s *SDBServer) handle(conn net.Conn) {
 		_ = writeFrame(conn, s.setEnabled(true))
 	case "sdb-disable":
 		_ = writeFrame(conn, s.setEnabled(false))
+	case "session-reboot":
+		_ = writeFrame(conn, s.shutdown(syscall.SIGINT))
+	case "session-poweroff":
+		_ = writeFrame(conn, s.shutdown(syscall.SIGTERM))
 	default:
 		_ = writeFrame(conn, Reply{Error: "unknown command: " + req.Cmd})
 	}

internal/control/sdb_test.go

@@ -94,3 +94,65 @@ func TestSDBControlChecksPeerIdentity(t *testing.T) {
 		t.Fatal("different inode accepted")
 	}
 }
+
+func TestSDBControlDelegatesOnlySessionPowerActions(t *testing.T) {
+	if os.Geteuid() != 0 {
+		t.Skip("the production socket owner check requires root")
+	}
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+	dir := t.TempDir()
+	units := filepath.Join(dir, "units")
+	if err := os.Mkdir(units, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	writeUnit(t, units, "base.target", "[Unit]\n")
+	m, err := core.Build(&unit.Loader{Paths: []string{units}}, "base.target")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	srv, err := ListenSDB(filepath.Join(dir, "sdb.sock"), m, SDBConfig{
+		Unit:             "sdbd.service",
+		Marker:           filepath.Join(dir, "state", "enabled"),
+		BrokerExecutable: exe,
+		GroupID:          os.Getgid(),
+		MinimumUID:       1000,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	signals := make(chan syscall.Signal, 2)
+	srv.shutdown = func(sig syscall.Signal) Reply {
+		signals <- sig
+		return Reply{OK: true}
+	}
+	go srv.Serve()
+	defer srv.Close()
+
+	for _, tc := range []struct {
+		cmd  string
+		want syscall.Signal
+	}{
+		{cmd: "session-reboot", want: syscall.SIGINT},
+		{cmd: "session-poweroff", want: syscall.SIGTERM},
+	} {
+		rep, err := Send(filepath.Join(dir, "sdb.sock"), Request{Cmd: tc.cmd})
+		if err != nil || !rep.OK {
+			t.Fatalf("%s: err=%v rep=%+v", tc.cmd, err, rep)
+		}
+		if got := <-signals; got != tc.want {
+			t.Fatalf("%s signal=%v, want %v", tc.cmd, got, tc.want)
+		}
+	}
+
+	rep, err := Send(filepath.Join(dir, "sdb.sock"), Request{Cmd: "restart", Unit: "other.service"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if rep.OK || rep.Error == "" {
+		t.Fatalf("arbitrary init command accepted: %+v", rep)
+	}
+}

internal/control/server.go

@@ -111,9 +111,9 @@ func (s *Server) mutate(req Request) Reply {
 		// Accepted for wire compatibility; unit reload and boot confirmation
 		// are not handled by the init.
 	case "reboot":
-		return s.shutdownAction(syscall.SIGINT) // waitForShutdown maps SIGINT -> reboot
+		return shutdownAction(syscall.SIGINT) // waitForShutdown maps SIGINT -> reboot
 	case "poweroff", "halt":
-		return s.shutdownAction(syscall.SIGTERM)
+		return shutdownAction(syscall.SIGTERM)
 	}
 	return Reply{OK: true, State: s.m.State(req.Unit)}
 }
@@ -122,7 +122,7 @@ func (s *Server) mutate(req Request) Reply {
 // It signals the init (self) so the single tested shutdown path in waitForShutdown
 // runs; it refuses when not running as the init, so a dev/test invocation cannot
 // signal the host's real PID 1.
-func (s *Server) shutdownAction(sig syscall.Signal) Reply {
+func shutdownAction(sig syscall.Signal) Reply {
 	if os.Getpid() != 1 {
 		return Reply{Error: "reboot/poweroff is only available to the init (pid 1)"}
 	}