feat: integrate security loader into session startup

CMakeLists.txt

@@ -17,6 +17,8 @@ set(DTK_VERSION_MAJOR 6)
 find_package(DtkBuildHelper REQUIRED)
 find_package(Dtk${DTK_VERSION_MAJOR} REQUIRED COMPONENTS Tools)
 
+include(CTest)
+
 macro(install_symlink filepath wantsdir)
     file(MAKE_DIRECTORY ${PROJECT_BINARY_DIR}/link/${wantsdir}/)
     execute_process(COMMAND ${CMAKE_COMMAND} -E create_symlink ${CMAKE_INSTALL_PREFIX}/lib/systemd/user/${filepath} ${PROJECT_BINARY_DIR}/link/${wantsdir}/${filepath})

debian/control

@@ -25,7 +25,8 @@ Architecture: any
 Depends:
  jq,
  sed (>= 4),
- dde-daemon (>= 6.1.26),
+ dde-daemon (>= 6.1.102),
+ deepin-security-loader,
  libdtkdata (>=5.7.18),
  libdtk6core (>=6.0.38),
  systemd,

misc/dde-session-loader-wrapper.in

@@ -0,0 +1,32 @@
+#!/bin/bash
+# Log to systemd journal with tag "dde-session"
+log_to_journal() {
+    logger -t dde-session -p user.info -- "$1"
+}
+
+set -u
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+
+REAL_BINARY="@CMAKE_INSTALL_FULL_LIBEXECDIR@/deepin/dde-session"
+LOADER="/usr/bin/deepin-security-loader"
+LOADER_EXEC="/usr/bin/deepin-security-loader-exec"
+
+systemd_service=false
+for argument in "$@"; do
+    if [ "$argument" = "--systemd-service" ]; then
+        systemd_service=true
+        break
+    fi
+done
+log_to_journal "dde-session launched with args: $*"
+
+if [ -x "$LOADER" ] && [ -x "$LOADER_EXEC" ] && \
+    getcap "$LOADER_EXEC" 2>/dev/null | grep -q 'cap_setgid'; then
+    log_to_journal "Using deepin-security-loader with authorization groups"
+    exec "$LOADER" --group deepin-daemon -- "$REAL_BINARY" "$@"
+fi
+
+# Fallback: direct launch without loader (no polkit-free authorization)
+log_to_journal "Fallback: launching directly without security loader"
+exec "$REAL_BINARY" "$@"

src/dde-session/CMakeLists.txt

@@ -55,6 +55,8 @@ file(GLOB_RECURSE DBUS_TYPES ${PROJECT_SOURCE_DIR}/dbus/types/*)
 
 add_executable(dde-session
     main.cpp
+    securityloaderhelper.h
+    securityloaderhelper.cpp
     environmentsmanager.h
     environmentsmanager.cpp
     othersmanager.h
@@ -100,3 +102,23 @@ target_include_directories(dde-session PUBLIC
 )
 
 install(TARGETS dde-session DESTINATION ${CMAKE_INSTALL_BINDIR})
+install(TARGETS dde-session DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}/deepin)
+
+configure_file(${PROJECT_SOURCE_DIR}/misc/dde-session-loader-wrapper.in
+    ${PROJECT_BINARY_DIR}/misc/dde-session-loader-wrapper
+    @ONLY)
+
+install(PROGRAMS ${PROJECT_BINARY_DIR}/misc/dde-session-loader-wrapper
+    DESTINATION ${CMAKE_INSTALL_LIBEXECDIR}/deepin)
+
+if(BUILD_TESTING)
+    add_executable(securityloaderhelper_test
+        securityloaderhelper_test.cpp
+        securityloaderhelper.cpp
+    )
+    target_link_libraries(securityloaderhelper_test
+        Qt${QT_VERSION_MAJOR}::Core
+        Qt${QT_VERSION_MAJOR}::DBus
+    )
+    add_test(NAME securityloaderhelper_test COMMAND securityloaderhelper_test)
+endif()

src/dde-session/main.cpp

@@ -13,7 +13,6 @@
 
 #include <DLog>
 
-#include <systemd/sd-daemon.h>
 #include <unistd.h>
 #include <sys/wait.h>
 #include <sys/prctl.h>
@@ -28,6 +27,7 @@
 #include "impl/iowait/iowaitwatcher.h"
 #include "environmentsmanager.h"
 #include "othersmanager.h"
+#include "securityloaderhelper.h"
 
 DCORE_USE_NAMESPACE
 
@@ -77,7 +77,11 @@ int main(int argc, char *argv[])
     parser.addVersionOption();
 
     QCommandLineOption systemd(QStringList{"d", "systemd-service", "wait for systemd services"});
+    QCommandLineOption fd1(QStringLiteral("fd1"), QStringLiteral("security loader request pipe"), QStringLiteral("fd"));
+    QCommandLineOption fd2(QStringLiteral("fd2"), QStringLiteral("security loader response pipe"), QStringLiteral("fd"));
     parser.addOption(systemd);
+    parser.addOption(fd1);
+    parser.addOption(fd2);
     parser.process(app);
 
     DLogManager::registerJournalAppender();
@@ -112,6 +116,15 @@ int main(int argc, char *argv[])
     }
 
     /* ---systemd-service--- */
+    QString securityLoaderError;
+    const SecurityLoaderInfo loaderInfo = parseSecurityLoaderFds(parser.isSet(fd1), parser.value(fd1),
+                                                                 parser.isSet(fd2), parser.value(fd2),
+                                                                 &securityLoaderError);
+    const QString systemBusUniqueName = systemBusConnection().baseService();
+    if (loaderInfo.loaded && !authorizePowerCaller(loaderInfo, systemBusUniqueName, &securityLoaderError)) {
+        qCritical() << "Security loader handshake failed:" << securityLoaderError;
+        return EXIT_FAILURE;
+    }
 
     auto* session = new Session(&app);
     new Session1Adaptor(session);
@@ -156,7 +169,6 @@ int main(int argc, char *argv[])
         qInfo() << "pipe read finish, app exit.";
         QMetaObject::invokeMethod(qApp, &QCoreApplication::quit, Qt::QueuedConnection);
     });
-    sd_notify(0, "READY=1");
 
     return app.exec();
 }