summaryrefslogtreecommitdiffstats
path: root/plugins/usb-protection
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/usb-protection')
-rw-r--r--plugins/usb-protection/gsd-usb-protection-manager.c1179
-rw-r--r--plugins/usb-protection/gsd-usb-protection-manager.h44
-rw-r--r--plugins/usb-protection/main.c7
-rw-r--r--plugins/usb-protection/meson.build21
4 files changed, 1251 insertions, 0 deletions
diff --git a/plugins/usb-protection/gsd-usb-protection-manager.c b/plugins/usb-protection/gsd-usb-protection-manager.c
new file mode 100644
index 0000000..63a4e0d
--- /dev/null
+++ b/plugins/usb-protection/gsd-usb-protection-manager.c
@@ -0,0 +1,1179 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*-
+ *
+ * Copyright (C) 2018 Ludovico de Nittis <denittis@gnome.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "config.h"
+
+#include <gio/gio.h>
+#include <glib-object.h>
+#include <glib/gi18n.h>
+#include <libnotify/notify.h>
+#include <locale.h>
+#include <string.h>
+
+#include <gdesktop-enums.h>
+
+#include "gnome-settings-bus.h"
+#include "gnome-settings-profile.h"
+#include "gsd-enums.h"
+#include "gsd-usb-protection-manager.h"
+
+#define PRIVACY_SETTINGS "org.gnome.desktop.privacy"
+#define USB_PROTECTION "usb-protection"
+#define USB_PROTECTION_LEVEL "usb-protection-level"
+
+#define DBUS_VERSION "1"
+
+#define USBGUARD_DBUS_NAME "org.usbguard" DBUS_VERSION
+#define USBGUARD_DBUS_PATH "/org/usbguard" DBUS_VERSION
+#define USBGUARD_DBUS_INTERFACE "org.usbguard"
+#define USBGUARD_DBUS_INTERFACE_VERSIONED USBGUARD_DBUS_INTERFACE DBUS_VERSION
+
+#define USBGUARD_DBUS_PATH_POLICY USBGUARD_DBUS_PATH "/Policy"
+#define USBGUARD_DBUS_INTERFACE_POLICY USBGUARD_DBUS_INTERFACE ".Policy" DBUS_VERSION
+
+#define USBGUARD_DBUS_PATH_DEVICES USBGUARD_DBUS_PATH "/Devices"
+#define USBGUARD_DBUS_INTERFACE_DEVICES USBGUARD_DBUS_INTERFACE ".Devices" DBUS_VERSION
+
+#define APPLY_POLICY "apply-policy"
+#define BLOCK "block"
+#define REJECT "reject"
+
+#define APPLY_DEVICE_POLICY "applyDevicePolicy"
+#define LIST_DEVICES "listDevices"
+#define LIST_RULES "listRules"
+#define ALLOW "allow"
+#define DEVICE_POLICY_CHANGED "DevicePolicyChanged"
+#define DEVICE_PRESENCE_CHANGED "DevicePresenceChanged"
+#define INSERTED_DEVICE_POLICY "InsertedDevicePolicy"
+#define APPEND_RULE "appendRule"
+#define ALLOW_ALL "allow id *:* label \"GNOME_SETTINGS_DAEMON_RULE\""
+#define WITH_CONNECT_TYPE "with-connect-type"
+#define WITH_INTERFACE "with-interface"
+#define NAME "name"
+
+struct _GsdUsbProtectionManager
+{
+ GObject parent;
+ guint start_idle_id;
+ GDBusNodeInfo *introspection_data;
+ GSettings *settings;
+ guint name_id;
+ GDBusConnection *connection;
+ gboolean available;
+ GDBusProxy *usb_protection;
+ GDBusProxy *usb_protection_devices;
+ GDBusProxy *usb_protection_policy;
+ GCancellable *cancellable;
+ GsdScreenSaver *screensaver_proxy;
+ gboolean screensaver_active;
+ NotifyNotification *notification;
+};
+
+typedef enum {
+ EVENT_PRESENT,
+ EVENT_INSERT,
+ EVENT_UPDATE,
+ EVENT_REMOVE
+} UsbGuardEvent;
+
+
+typedef enum {
+ TARGET_ALLOW,
+ TARGET_BLOCK,
+ TARGET_REJECT
+} UsbGuardTarget;
+
+typedef enum {
+ POLICY_DEVICE_ID,
+ POLICY_TARGET_OLD,
+ /* This is the rule that has been applied */
+ POLICY_TARGET_NEW,
+ POLICY_DEV_RULE,
+ /* The ID of the rule that has been applied.
+ * uint32 - 1 is one of the implicit rules,
+ * e.g. ImplicitPolicyTarget or InsertedDevicePolicy.
+ */
+ POLICY_RULE_ID,
+ POLICY_ATTRIBUTES
+} UsbGuardPolicyChanged;
+
+typedef enum {
+ PRESENCE_DEVICE_ID,
+ PRESENCE_EVENT,
+ /* That does not reflect what USBGuard intends to do with the device :( */
+ PRESENCE_TARGET,
+ PRESENCE_DEV_RULE,
+ PRESENCE_ATTRIBUTES
+} UsbGuardPresenceChanged;
+
+static void gsd_usb_protection_manager_finalize (GObject *object);
+
+G_DEFINE_TYPE (GsdUsbProtectionManager, gsd_usb_protection_manager, G_TYPE_OBJECT)
+
+static gpointer manager_object = NULL;
+
+#define GSD_DBUS_NAME "org.gnome.SettingsDaemon"
+#define GSD_DBUS_PATH "/org/gnome/SettingsDaemon"
+#define GSD_DBUS_BASE_INTERFACE "org.gnome.SettingsDaemon"
+
+#define GSD_USB_PROTECTION_DBUS_NAME GSD_DBUS_NAME ".UsbProtection"
+#define GSD_USB_PROTECTION_DBUS_PATH GSD_DBUS_PATH "/UsbProtection"
+
+static const gchar introspection_xml[] =
+"<node>"
+" <interface name='org.gnome.SettingsDaemon.UsbProtection'>"
+" <property name='Available' type='b' access='read'/>"
+" </interface>"
+"</node>";
+
+static void
+dbus_call_log_error (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ g_autoptr(GVariant) result = NULL;
+ g_autoptr(GError) error = NULL;
+ const gchar *msg = user_data;
+
+ result = g_dbus_proxy_call_finish (G_DBUS_PROXY (source_object),
+ res,
+ &error);
+ if (result == NULL &&
+ !g_error_matches (error, G_DBUS_ERROR, G_DBUS_ERROR_SERVICE_UNKNOWN))
+ g_warning ("%s: %s", msg, error->message);
+}
+
+static void
+add_usbguard_allow_rule (GsdUsbProtectionManager *manager)
+{
+ /* This appends a "allow all" rule.
+ * It has the purpose of ensuring the authorization of new devices when
+ * the lockscreen is off while respecting existing rules.
+ * We make it temporary, so that we are stateless and don't alter the
+ * existing (persistent) configuration.
+ */
+
+ GVariant *params;
+ GDBusProxy *policy_proxy = manager->usb_protection_policy;
+
+ if (policy_proxy == NULL) {
+ g_warning ("Cannot add allow rule, because dbus proxy is missing");
+ } else {
+ gboolean temporary = TRUE;
+ /* This is USBGuard's Rule::LastID */
+ /* const guint32 last_rule_id = G_MAXUINT32 - 2; */
+ /* We can't use Rule::LastID, due to a bug in USBGuard.
+ * We cannot pick an arbitrary number, so we pick
+ * "0" which means we prepend our rule.
+ * https://github.com/USBGuard/usbguard/pull/355
+ */
+ const guint32 last_rule_id = 0;
+ g_debug ("Adding rule %u", last_rule_id);
+ params = g_variant_new ("(sub)", ALLOW_ALL, last_rule_id, temporary);
+ g_dbus_proxy_call (policy_proxy,
+ APPEND_RULE,
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error appending USBGuard rule");
+ }
+}
+
+static gboolean
+is_usbguard_allow_rule_present (GVariant *rules)
+{
+ g_autoptr(GVariantIter) iter = NULL;
+ g_autofree gchar *value = NULL;
+ guint number = 0;
+
+ g_debug ("Detecting rule...");
+
+ g_variant_get (rules, "a(us)", &iter);
+ while (g_variant_iter_loop (iter, "(us)", &number, &value)) {
+ if (g_strcmp0 (value, ALLOW_ALL) == 0) {
+ g_debug ("Detected rule!");
+ return TRUE;
+ }
+ }
+ return FALSE;
+}
+
+static void
+usbguard_listrules_cb (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ GVariant *result, *rules;
+ g_autoptr(GError) error = NULL;
+
+ result = g_dbus_proxy_call_finish (G_DBUS_PROXY (source_object),
+ res,
+ &error);
+
+ if (!result) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
+ g_warning ("Failed to fetch USBGuard rules list: %s", error->message);
+ }
+ return;
+ }
+
+ rules = g_variant_get_child_value (result, 0);
+ g_variant_unref (result);
+ if (!is_usbguard_allow_rule_present (rules))
+ add_usbguard_allow_rule (user_data);
+
+}
+
+static void
+usbguard_ensure_allow_rule (GsdUsbProtectionManager *manager)
+{
+ GVariant *params;
+ GDBusProxy *policy_proxy = manager->usb_protection_policy;
+
+ if (policy_proxy == NULL) {
+ g_warning ("Cannot list rules, because dbus proxy is missing");
+ } else {
+ /* listRules parameter is a label for matching rules.
+ * Currently we are using an empty label to get all the
+ * rules instead of just using "GNOME_SETTINGS_DAEMON_RULE"
+ * until this bug gets solved:
+ * https://github.com/USBGuard/usbguard/issues/328 */
+ params = g_variant_new ("(s)", "");
+ g_dbus_proxy_call (policy_proxy,
+ LIST_RULES,
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ usbguard_listrules_cb,
+ manager);
+ }
+}
+
+static void
+settings_changed_callback (GSettings *settings,
+ const char *key,
+ GsdUsbProtectionManager *manager)
+{
+ gchar *value_usbguard;
+ gboolean usbguard_controlled;
+ GVariant *params;
+ GDesktopUsbProtection protection_level;
+
+ /* We react only if one of the two USB related properties has been changed */
+ if (g_strcmp0 (key, USB_PROTECTION) != 0 && g_strcmp0 (key, USB_PROTECTION_LEVEL) != 0)
+ return;
+
+ usbguard_controlled = g_settings_get_boolean (settings, USB_PROTECTION);
+ protection_level = g_settings_get_enum (settings, USB_PROTECTION_LEVEL);
+ g_debug ("USBGuard control is currently %i with a protection level of %i",
+ usbguard_controlled, protection_level);
+
+ /* If previously we were controlling USBGuard and now we are not,
+ * we leave the USBGuard configuration in a clean state. I.e. we set
+ * "InsertedDevicePolicy" to "apply-policy" and we ensure that
+ * there is an always allow rule. In this way even if USBGuard daemon
+ * is running every USB devices will be automatically authorized. */
+ if (g_strcmp0 (key, USB_PROTECTION) == 0 && !usbguard_controlled) {
+ g_debug ("let's clean usbguard config state");
+ params = g_variant_new ("(ss)",
+ INSERTED_DEVICE_POLICY,
+ APPLY_POLICY);
+
+ if (manager->usb_protection != NULL) {
+ g_dbus_proxy_call (manager->usb_protection,
+ "setParameter",
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error calling USBGuard DBus to set a clean configuration state");
+ }
+
+ usbguard_ensure_allow_rule (manager);
+ }
+
+ /* Only if we are entitled to handle USBGuard */
+ if (usbguard_controlled && manager->usb_protection != NULL) {
+ value_usbguard = (protection_level == G_DESKTOP_USB_PROTECTION_ALWAYS) ? BLOCK : APPLY_POLICY;
+ params = g_variant_new ("(ss)",
+ INSERTED_DEVICE_POLICY,
+ value_usbguard);
+
+ g_dbus_proxy_call (manager->usb_protection,
+ "setParameter",
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error calling USBGuard DBus to set the desidered protection level");
+
+ /* If we are in "When lockscreen is active" we also check if the
+ * always allow rule is present. */
+ if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN)
+ usbguard_ensure_allow_rule (manager);
+ }
+}
+
+static void update_usb_protection_store (GsdUsbProtectionManager *manager,
+ GVariant *parameter)
+{
+ const gchar *key;
+ gboolean usbguard_controlled;
+ GDesktopUsbProtection protection_level;
+ GSettings *settings = manager->settings;
+
+ usbguard_controlled = g_settings_get_boolean (settings, USB_PROTECTION);
+ /* If we are not handling USBGuard configuration (e.g. the user is using
+ * a third party program) we do nothing when the config changes. */
+ if (usbguard_controlled) {
+ key = g_variant_get_string (parameter, NULL);
+ protection_level = g_settings_get_enum (settings, USB_PROTECTION_LEVEL);
+ /* If the USBGuard configuration has been changed and doesn't match
+ * our internal state, most likely means that the user externally
+ * changed it. When this happens we set to false the control value. */
+ if ((g_strcmp0 (key, APPLY_POLICY) == 0 && protection_level == G_DESKTOP_USB_PROTECTION_ALWAYS)) {
+ g_settings_set (settings, USB_PROTECTION, "b", FALSE);
+ g_warning ("We don't control anymore USBGuard because the configuration changed externally.");
+ }
+ }
+}
+
+static gboolean
+is_protection_active (GsdUsbProtectionManager *manager)
+{
+ GSettings *settings = manager->settings;
+
+ return g_settings_get_boolean (settings, USB_PROTECTION);
+}
+
+static void
+on_notification_closed (NotifyNotification *n,
+ GsdUsbProtectionManager *manager)
+{
+ g_clear_object (&manager->notification);
+}
+
+static void
+show_notification (GsdUsbProtectionManager *manager,
+ const char *summary,
+ const char *body)
+{
+ /* Don't show a notice if one is already displayed */
+ if (manager->notification != NULL)
+ return;
+
+ manager->notification = notify_notification_new (summary, body, "drive-removable-media-symbolic");
+ notify_notification_set_app_name (manager->notification, _("USB Protection"));
+ notify_notification_set_hint (manager->notification, "transient", g_variant_new_boolean (TRUE));
+ notify_notification_set_hint_string (manager->notification, "x-gnome-privacy-scope", "system");
+ notify_notification_set_timeout (manager->notification, NOTIFY_EXPIRES_DEFAULT);
+ notify_notification_set_urgency (manager->notification, NOTIFY_URGENCY_CRITICAL);
+ g_signal_connect_object (manager->notification,
+ "closed",
+ G_CALLBACK (on_notification_closed),
+ manager,
+ 0);
+ if (!notify_notification_show (manager->notification, NULL)) {
+ g_warning ("Failed to send USB protection notification");
+ g_clear_object (&manager->notification);
+ }
+}
+
+static void authorize_device (GDBusProxy *proxy,
+ GsdUsbProtectionManager *manager,
+ guint device_id,
+ guint target,
+ gboolean permanent)
+{
+ if (manager->usb_protection_devices == NULL) {
+ g_warning("Could not authorize device, because DBus is missing");
+ } else {
+ GVariant *params = g_variant_new ("(uub)", device_id, target, permanent);
+ g_dbus_proxy_call (manager->usb_protection_devices,
+ APPLY_DEVICE_POLICY,
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error calling USBGuard DBus to authorize a device");
+ }
+}
+
+static gboolean
+is_hid_or_hub (GVariant *device,
+ gboolean *has_other_classes)
+{
+ g_autoptr(GVariantIter) iter = NULL;
+ g_autofree gchar *name = NULL;
+ g_autofree gchar *value = NULL;
+ guint i;
+ gboolean is_hid_or_hub = FALSE;
+
+ if (has_other_classes != NULL) {
+ *has_other_classes = FALSE;
+ }
+
+ g_variant_get_child (device, PRESENCE_ATTRIBUTES, "a{ss}", &iter);
+ while (g_variant_iter_loop (iter, "{ss}", &name, &value)) {
+ if (g_strcmp0 (name, WITH_INTERFACE) == 0) {
+ g_auto(GStrv) interfaces_splitted = NULL;
+ interfaces_splitted = g_strsplit (value, " ", -1);
+ for (i = 0; i < g_strv_length (interfaces_splitted); i++) {
+ if (g_str_has_prefix (interfaces_splitted[i], "03:")
+ || g_str_has_prefix (interfaces_splitted[i], "09:")) {
+ is_hid_or_hub = TRUE;
+ }
+ else if (has_other_classes != NULL) {
+ *has_other_classes = TRUE;
+ }
+ }
+ }
+ }
+ return is_hid_or_hub;
+}
+
+static gboolean
+is_hardwired (GVariant *device)
+{
+ g_autoptr(GVariantIter) iter = NULL;
+ g_autofree gchar *name = NULL;
+ g_autofree gchar *value = NULL;
+
+ g_variant_get_child (device, PRESENCE_ATTRIBUTES, "a{ss}", &iter);
+ while (g_variant_iter_loop (iter, "{ss}", &name, &value)) {
+ if (g_strcmp0 (name, WITH_CONNECT_TYPE) == 0) {
+ return g_strcmp0 (value, "hardwired") == 0;
+ }
+ }
+ return FALSE;
+}
+
+static void
+auth_device (GsdUsbProtectionManager *manager,
+ GVariant *device)
+{
+ guint device_id;
+
+ if (manager->usb_protection_devices == NULL)
+ return;
+
+ g_variant_get_child (device, POLICY_DEVICE_ID, "u", &device_id);
+ authorize_device(manager->usb_protection_devices,
+ manager,
+ device_id,
+ TARGET_ALLOW,
+ FALSE);
+}
+
+static void
+on_screen_locked (GsdScreenSaver *screen_saver,
+ GAsyncResult *result,
+ GsdUsbProtectionManager *manager)
+{
+ g_autoptr(GError) error = NULL;
+
+ gsd_screen_saver_call_lock_finish (screen_saver, result, &error);
+
+ if (error) {
+ if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ return;
+ g_warning ("Couldn't lock screen: %s", error->message);
+ }
+
+ show_notification (manager,
+ _("New USB device"),
+ _("New device has been detected while the session was not locked. "
+ "If you did not plug anything, check your system for any suspicious device."));
+
+}
+
+static void
+on_usbguard_signal (GDBusProxy *proxy,
+ gchar *sender_name,
+ gchar *signal_name,
+ GVariant *parameters,
+ gpointer user_data)
+{
+ UsbGuardTarget target = TARGET_BLOCK;
+ UsbGuardEvent device_event;
+ GDesktopUsbProtection protection_level;
+ GsdUsbProtectionManager *manager = user_data;
+ g_autoptr(GVariantIter) iter = NULL;
+ g_autofree gchar *name = NULL;
+ g_autofree gchar *device_name = NULL;
+ gboolean hid_or_hub = FALSE;
+ gboolean has_other_classes = FALSE;
+
+ g_debug ("USBGuard signal: %s", signal_name);
+
+ /* We act only if we receive a signal indicating that a device has been inserted */
+ if (g_strcmp0 (signal_name, DEVICE_PRESENCE_CHANGED) != 0) {
+ return;
+ }
+
+ g_variant_get_child (parameters, PRESENCE_EVENT, "u", &device_event);
+ if (device_event != EVENT_INSERT) {
+ g_debug ("Device hat not been inserted (%d); ignoring", device_event);
+ return;
+ }
+
+ /* We would like to show a notification for an inserted device that
+ * *has not been blocked*. But USBGuard is not providing that information.
+ * So we have to work around that limitation and assume that any device plugged in
+ * during screensaver shall be blocked.
+ * https://github.com/USBGuard/usbguard/issues/353
+
+ g_variant_get_child (parameters, POLICY_TARGET_NEW, "u", &target);
+ */
+
+ /* If the device is already authorized we do nothing */
+ if (target == TARGET_ALLOW) {
+ g_debug ("Device will be allowed, we return");
+ return;
+ }
+
+ /* If the USB protection is disabled we do nothing */
+ if (!is_protection_active (manager)) {
+ g_debug ("Protection is not active. Not acting on the device");
+ return;
+ }
+
+ g_variant_get_child (parameters, PRESENCE_ATTRIBUTES, "a{ss}", &iter);
+ while (g_variant_iter_loop (iter, "{ss}", &name, &device_name)) {
+ if (g_strcmp0 (name, NAME) == 0)
+ g_debug ("A new USB device has been connected: %s", device_name);
+ }
+
+ if (is_hardwired (parameters)) {
+ g_debug ("Device is hardwired, allowing it to be connected");
+ auth_device (manager, parameters);
+ return;
+ }
+
+ protection_level = g_settings_get_enum (manager->settings, USB_PROTECTION_LEVEL);
+
+ g_debug ("Screensaver active: %d", manager->screensaver_active);
+ hid_or_hub = is_hid_or_hub (parameters, &has_other_classes);
+ if (manager->screensaver_active) {
+ /* If the session is locked we check if the inserted device is a HID,
+ * e.g. a keyboard or a mouse, or an HUB.
+ * If that is the case we authorize the newly inserted device as an
+ * antilockout policy.
+ *
+ * If this device advertises also interfaces outside the HID class, or the
+ * HUB class, it is suspect. It could be a false positive because this could
+ * be a "smart" keyboard for example, but at this stage is better be safe. */
+ if (hid_or_hub && !has_other_classes) {
+ show_notification (manager,
+ _("New device detected"),
+ _("Either one of your existing devices has been reconnected or a new one has been plugged in. "
+ "If you did not do it, check your system for any suspicious device."));
+ auth_device (manager, parameters);
+ } else {
+ if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) {
+ show_notification (manager,
+ _("Reconnect USB device"),
+ _("New device has been detected while you were away. "
+ "Please disconnect and reconnect the device to start using it."));
+ } else {
+ const char* name_for_notification = device_name ? device_name : "unknown name";
+ g_debug ("Showing notification for %s", name_for_notification);
+ show_notification (manager,
+ _("USB device blocked"),
+ _("New device has been detected while you were away. "
+ "It has been blocked because the USB protection is active."));
+ }
+ }
+ } else {
+ /* If the protection level is "lockscreen" the device will be automatically
+ * authorized by usbguard. */
+ if (protection_level == G_DESKTOP_USB_PROTECTION_ALWAYS) {
+ /* We authorize the device if this is a HID,
+ * e.g. a keyboard or a mouse, or an HUB.
+ * We also lock the screen to prevent an attacker to plug malicious
+ * devices if the legitimate user forgot to lock his session.
+ *
+ * If this device advertises also interfaces outside the HID class, or the
+ * HUB class, it is suspect. It could be a false positive because this could
+ * be a "smart" keyboard for example, but at this stage is better be safe. */
+ if (hid_or_hub && !has_other_classes) {
+ gsd_screen_saver_call_lock (manager->screensaver_proxy,
+ manager->cancellable,
+ (GAsyncReadyCallback) on_screen_locked,
+ manager);
+ auth_device (manager, parameters);
+ } else {
+ show_notification (manager,
+ _("USB device blocked"),
+ _("The new inserted device has been blocked because the USB protection is active."));
+ }
+ }
+ }
+}
+
+static void
+on_usb_protection_signal (GDBusProxy *proxy,
+ gchar *sender_name,
+ gchar *signal_name,
+ GVariant *parameters,
+ gpointer user_data)
+{
+ g_autoptr(GVariant) parameter = NULL;
+ g_autofree gchar *policy_name = NULL;
+
+ if (g_strcmp0 (signal_name, "PropertyParameterChanged") != 0)
+ return;
+
+ g_variant_get_child (parameters, 0, "s", &policy_name);
+
+ /* Right now we just care about the InsertedDevicePolicy value */
+ if (g_strcmp0 (policy_name, INSERTED_DEVICE_POLICY) != 0)
+ return;
+
+ parameter = g_variant_get_child_value (parameters, 2);
+ update_usb_protection_store (user_data, parameter);
+
+}
+
+static void
+get_parameter_cb (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ GVariant *result;
+ GVariant *params = NULL;
+ g_autofree gchar *key = NULL;
+ GDesktopUsbProtection protection_level;
+ GsdUsbProtectionManager *manager;
+ GSettings *settings;
+ g_autoptr(GError) error = NULL;
+
+ result = g_dbus_proxy_call_finish (G_DBUS_PROXY (source_object),
+ res,
+ &error);
+ if (result == NULL) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED)) {
+ g_warning ("Failed to fetch USBGuard parameters: %s", error->message);
+ }
+ return;
+ }
+
+ manager = GSD_USB_PROTECTION_MANAGER (user_data);
+ settings = manager->settings;
+
+ g_variant_get_child (result, 0, "s", &key);
+ g_variant_unref (result);
+ protection_level = g_settings_get_enum (settings, USB_PROTECTION_LEVEL);
+
+ g_debug ("InsertedDevicePolicy is: %s", key);
+
+ if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) {
+ if (g_strcmp0 (key, APPLY_POLICY) != 0) {
+ /* We are out of sync. */
+ params = g_variant_new ("(ss)",
+ INSERTED_DEVICE_POLICY,
+ APPLY_POLICY);
+ }
+ } else if (protection_level == G_DESKTOP_USB_PROTECTION_ALWAYS) {
+ if (g_strcmp0 (key, BLOCK) != 0) {
+ /* We are out of sync. */
+ params = g_variant_new ("(ss)",
+ INSERTED_DEVICE_POLICY,
+ BLOCK);
+ }
+ }
+
+ if (params != NULL) {
+ /* We are out of sync. We need to call setParameter to update USBGuard state */
+ if (manager->usb_protection != NULL) {
+ g_debug ("Setting InsertedDevicePolicy");
+ g_dbus_proxy_call (manager->usb_protection,
+ "setParameter",
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error calling USBGuard DBus while we were out of sync");
+ }
+
+ }
+
+ /* If we are in "When lockscreen is active" we also check
+ * if the "always allow" rule is present. */
+ if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) {
+ g_debug ("Ensuring allow all");
+ usbguard_ensure_allow_rule (manager);
+ }
+}
+
+static void
+sync_usb_protection (GDBusProxy *proxy,
+ GsdUsbProtectionManager *manager)
+{
+ GVariant *params;
+ gboolean usbguard_controlled;
+ GSettings *settings = manager->settings;
+
+ usbguard_controlled = g_settings_get_boolean (settings, USB_PROTECTION);
+
+ g_debug ("Attempting to sync USB parameters: %d %p %p",
+ usbguard_controlled, proxy, manager->usb_protection);
+
+ if (!usbguard_controlled || manager->usb_protection == NULL)
+ return;
+
+ params = g_variant_new ("(s)", INSERTED_DEVICE_POLICY);
+ g_dbus_proxy_call (manager->usb_protection,
+ "getParameter",
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ get_parameter_cb,
+ manager);
+}
+
+static void
+usb_protection_properties_changed (GsdUsbProtectionManager *manager)
+{
+ GVariantBuilder props_builder;
+ GVariant *props_changed = NULL;
+
+ /* not yet connected to the session bus */
+ if (manager->connection == NULL)
+ return;
+
+ g_variant_builder_init (&props_builder, G_VARIANT_TYPE ("a{sv}"));
+
+ g_variant_builder_add (&props_builder, "{sv}", "Available",
+ g_variant_new_boolean (manager->available));
+
+ props_changed = g_variant_new ("(s@a{sv}@as)", GSD_USB_PROTECTION_DBUS_NAME,
+ g_variant_builder_end (&props_builder),
+ g_variant_new_strv (NULL, 0));
+
+ g_dbus_connection_emit_signal (manager->connection,
+ NULL,
+ GSD_USB_PROTECTION_DBUS_PATH,
+ "org.freedesktop.DBus.Properties",
+ "PropertiesChanged",
+ props_changed, NULL);
+}
+
+static void
+on_usb_protection_owner_changed_cb (GObject *object,
+ GParamSpec *pspec,
+ gpointer user_data)
+{
+ GsdUsbProtectionManager *manager = user_data;
+ GDBusProxy *proxy = G_DBUS_PROXY(object);
+ g_autofree gchar *name_owner = NULL;
+
+ name_owner = g_dbus_proxy_get_name_owner (proxy);
+ g_debug ("Got owner change: %s", name_owner);
+
+ if (name_owner) {
+ manager->available = TRUE;
+ } else {
+ manager->available = FALSE;
+ }
+
+ usb_protection_properties_changed (manager);
+}
+
+static void
+handle_screensaver_active (GsdUsbProtectionManager *manager,
+ GVariant *parameters)
+{
+ gboolean active;
+ gchar *value_usbguard;
+ gboolean usbguard_controlled;
+ GVariant *params;
+ GDesktopUsbProtection protection_level;
+ GSettings *settings = manager->settings;
+
+ usbguard_controlled = g_settings_get_boolean (settings, USB_PROTECTION);
+ protection_level = g_settings_get_enum (settings, USB_PROTECTION_LEVEL);
+
+ g_variant_get (parameters, "(b)", &active);
+ g_debug ("Received screensaver ActiveChanged signal: %d (old: %d)", active, manager->screensaver_active);
+ if (manager->screensaver_active != active) {
+ manager->screensaver_active = active;
+ if (usbguard_controlled && protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) {
+ /* If we are in the "lockscreen protection" level we change
+ * the usbguard config with apply-policy or block if the session
+ * is unlocked or locked, respectively. */
+ value_usbguard = active ? BLOCK : APPLY_POLICY;
+ params = g_variant_new ("(ss)",
+ INSERTED_DEVICE_POLICY,
+ value_usbguard);
+ if (manager->usb_protection != NULL) {
+ g_dbus_proxy_call (manager->usb_protection,
+ "setParameter",
+ params,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ dbus_call_log_error,
+ "Error calling USBGuard DBus to change the protection after a screensaver event");
+ }
+ }
+ }
+}
+
+static void
+screensaver_signal_cb (GDBusProxy *proxy,
+ const gchar *sender_name,
+ const gchar *signal_name,
+ GVariant *parameters,
+ gpointer user_data)
+{
+ g_debug ("ScreenSaver Signal: %s", signal_name);
+ if (g_strcmp0 (signal_name, "ActiveChanged") == 0)
+ handle_screensaver_active (GSD_USB_PROTECTION_MANAGER (user_data), parameters);
+}
+
+static void
+usb_protection_policy_proxy_ready (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ GsdUsbProtectionManager *manager;
+ GDBusProxy *proxy;
+ g_autoptr(GError) error = NULL;
+ g_debug ("usb_protection_policy_proxy_ready");
+
+ proxy = g_dbus_proxy_new_for_bus_finish (res, &error);
+ if (!proxy) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ g_warning ("Failed to contact USBGuard: %s", error->message);
+ return;
+ } else {
+ manager = GSD_USB_PROTECTION_MANAGER (user_data);
+ manager->usb_protection_policy = proxy;
+ g_debug ("Set protection policy proxy to %p", proxy);
+ sync_usb_protection (proxy, manager);
+ }
+}
+
+static void
+usb_protection_devices_proxy_ready (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ GsdUsbProtectionManager *manager;
+ GDBusProxy *proxy;
+ g_autoptr(GError) error = NULL;
+
+ proxy = g_dbus_proxy_new_for_bus_finish (res, &error);
+ if (!proxy) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ g_warning ("Failed to contact USBGuard: %s", error->message);
+ return;
+ }
+ manager = GSD_USB_PROTECTION_MANAGER (user_data);
+ manager->usb_protection_devices = proxy;
+
+ /* We don't care about already plugged in devices because they'll be
+ * already autorized by the "allow all" rule in USBGuard. */
+ g_debug ("Listening to signals");
+ g_signal_connect_object (source_object,
+ "g-signal",
+ G_CALLBACK (on_usbguard_signal),
+ user_data,
+ 0);
+}
+
+static void
+get_current_screen_saver_status (GsdUsbProtectionManager *manager)
+{
+ g_autoptr(GVariant) ret = NULL;
+ g_autoptr(GError) error = NULL;
+
+ ret = g_dbus_proxy_call_sync (G_DBUS_PROXY (manager->screensaver_proxy),
+ "GetActive",
+ NULL,
+ G_DBUS_CALL_FLAGS_NONE,
+ -1,
+ manager->cancellable,
+ &error);
+ if (ret == NULL) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ g_warning ("Failed to get screen saver status: %s", error->message);
+ return;
+ }
+ handle_screensaver_active (manager, ret);
+}
+
+static void
+usb_protection_proxy_ready (GObject *source_object,
+ GAsyncResult *res,
+ gpointer user_data)
+{
+ GsdUsbProtectionManager *manager;
+ GDBusProxy *proxy;
+ g_autofree gchar *name_owner = NULL;
+ g_autoptr(GError) error = NULL;
+
+ proxy = g_dbus_proxy_new_for_bus_finish (res, &error);
+ if (!proxy) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ g_warning ("Failed to contact USBGuard: %s", error->message);
+ return;
+ }
+ manager = GSD_USB_PROTECTION_MANAGER (user_data);
+ manager->usb_protection = proxy;
+
+ g_signal_connect (G_OBJECT (manager->settings), "changed",
+ G_CALLBACK (settings_changed_callback), manager);
+
+ manager->screensaver_proxy = gnome_settings_bus_get_screen_saver_proxy ();
+
+ get_current_screen_saver_status (manager);
+
+ g_signal_connect (manager->screensaver_proxy, "g-signal",
+ G_CALLBACK (screensaver_signal_cb), manager);
+
+ name_owner = g_dbus_proxy_get_name_owner (G_DBUS_PROXY (proxy));
+
+ if (name_owner == NULL) {
+ g_debug("Probably USBGuard >= 0.7.5 is not currently installed.");
+ manager->available = FALSE;
+ } else {
+ manager->available = TRUE;
+ }
+
+ g_signal_connect_object (source_object,
+ "notify::g-name-owner",
+ G_CALLBACK (on_usb_protection_owner_changed_cb),
+ user_data,
+ 0);
+
+ g_signal_connect_object (source_object,
+ "g-signal",
+ G_CALLBACK (on_usb_protection_signal),
+ user_data,
+ 0);
+
+ g_dbus_proxy_new_for_bus (G_BUS_TYPE_SYSTEM,
+ G_DBUS_PROXY_FLAGS_NONE,
+ NULL,
+ USBGUARD_DBUS_NAME,
+ USBGUARD_DBUS_PATH_DEVICES,
+ USBGUARD_DBUS_INTERFACE_DEVICES,
+ manager->cancellable,
+ usb_protection_devices_proxy_ready,
+ manager);
+
+ g_dbus_proxy_new_for_bus (G_BUS_TYPE_SYSTEM,
+ G_DBUS_PROXY_FLAGS_NONE,
+ NULL,
+ USBGUARD_DBUS_NAME,
+ USBGUARD_DBUS_PATH_POLICY,
+ USBGUARD_DBUS_INTERFACE_POLICY,
+ manager->cancellable,
+ usb_protection_policy_proxy_ready,
+ manager);
+}
+
+static GVariant *
+handle_get_property (GDBusConnection *connection,
+ const gchar *sender,
+ const gchar *object_path,
+ const gchar *interface_name,
+ const gchar *property_name,
+ GError **error,
+ gpointer user_data)
+{
+ GsdUsbProtectionManager *manager = GSD_USB_PROTECTION_MANAGER (user_data);
+
+ /* Check session pointer as a proxy for whether the manager is in the
+ start or stop state */
+ if (manager->connection == NULL)
+ return NULL;
+
+ if (g_strcmp0 (property_name, "Available") == 0)
+ return g_variant_new_boolean (manager->available);
+
+ return NULL;
+}
+
+static const GDBusInterfaceVTable interface_vtable =
+{
+ NULL,
+ handle_get_property,
+ NULL
+};
+
+static void
+on_bus_gotten (GObject *source_object,
+ GAsyncResult *res,
+ GsdUsbProtectionManager *manager)
+{
+ GDBusConnection *connection;
+ GError *error = NULL;
+
+ connection = g_bus_get_finish (res, &error);
+ if (connection == NULL) {
+ if (!g_error_matches (error, G_IO_ERROR, G_IO_ERROR_CANCELLED))
+ g_warning ("Could not get session bus: %s", error->message);
+ g_error_free (error);
+ return;
+ }
+ manager->connection = connection;
+
+ g_dbus_connection_register_object (connection,
+ GSD_USB_PROTECTION_DBUS_PATH,
+ manager->introspection_data->interfaces[0],
+ &interface_vtable,
+ manager,
+ NULL,
+ NULL);
+
+ manager->name_id = g_bus_own_name_on_connection (connection,
+ GSD_USB_PROTECTION_DBUS_NAME,
+ G_BUS_NAME_OWNER_FLAGS_NONE,
+ NULL,
+ NULL,
+ NULL,
+ NULL);
+}
+
+static gboolean
+start_usb_protection_idle_cb (GsdUsbProtectionManager *manager)
+{
+ g_debug ("Starting USB protection manager");
+
+ manager->settings = g_settings_new (PRIVACY_SETTINGS);
+ manager->cancellable = g_cancellable_new ();
+
+ g_dbus_proxy_new_for_bus (G_BUS_TYPE_SYSTEM,
+ G_DBUS_PROXY_FLAGS_NONE,
+ NULL,
+ USBGUARD_DBUS_NAME,
+ USBGUARD_DBUS_PATH,
+ USBGUARD_DBUS_INTERFACE_VERSIONED,
+ manager->cancellable,
+ usb_protection_proxy_ready,
+ manager);
+
+ notify_init ("gnome-settings-daemon");
+
+ manager->start_idle_id = 0;
+
+ return FALSE;
+}
+
+gboolean
+gsd_usb_protection_manager_start (GsdUsbProtectionManager *manager,
+ GError **error)
+{
+ gnome_settings_profile_start (NULL);
+
+ manager->start_idle_id = g_idle_add ((GSourceFunc) start_usb_protection_idle_cb, manager);
+ g_source_set_name_by_id (manager->start_idle_id, "[gnome-settings-daemon] start_usbguard_idle_cb");
+
+ manager->introspection_data = g_dbus_node_info_new_for_xml (introspection_xml, NULL);
+ g_assert (manager->introspection_data != NULL);
+
+ /* Start process of owning a D-Bus name */
+ g_bus_get (G_BUS_TYPE_SESSION,
+ manager->cancellable,
+ (GAsyncReadyCallback) on_bus_gotten,
+ manager);
+
+ gnome_settings_profile_end (NULL);
+ return TRUE;
+}
+
+void
+gsd_usb_protection_manager_stop (GsdUsbProtectionManager *manager)
+{
+ g_debug ("Stopping USB protection manager");
+
+ if (manager->cancellable != NULL) {
+ g_cancellable_cancel (manager->cancellable);
+ g_clear_object (&manager->cancellable);
+ }
+
+ g_clear_object (&manager->notification);
+
+ if (manager->start_idle_id != 0) {
+ g_source_remove (manager->start_idle_id);
+ manager->start_idle_id = 0;
+ }
+
+ if (manager->name_id != 0) {
+ g_bus_unown_name (manager->name_id);
+ manager->name_id = 0;
+ }
+
+ g_clear_pointer (&manager->introspection_data, g_dbus_node_info_unref);
+ g_clear_object (&manager->connection);
+ g_clear_object (&manager->settings);
+ g_clear_object (&manager->usb_protection);
+ g_clear_object (&manager->usb_protection_devices);
+ g_clear_object (&manager->usb_protection_policy);
+ g_clear_object (&manager->screensaver_proxy);
+}
+
+static void
+gsd_usb_protection_manager_class_init (GsdUsbProtectionManagerClass *klass)
+{
+ GObjectClass *object_class = G_OBJECT_CLASS (klass);
+
+ object_class->finalize = gsd_usb_protection_manager_finalize;
+}
+
+static void
+gsd_usb_protection_manager_init (GsdUsbProtectionManager *manager)
+{
+}
+
+static void
+gsd_usb_protection_manager_finalize (GObject *object)
+{
+ GsdUsbProtectionManager *usb_protection_manager;
+
+ usb_protection_manager = GSD_USB_PROTECTION_MANAGER (object);
+ gsd_usb_protection_manager_stop (usb_protection_manager);
+
+ G_OBJECT_CLASS (gsd_usb_protection_manager_parent_class)->finalize (object);
+}
+
+GsdUsbProtectionManager *
+gsd_usb_protection_manager_new (void)
+{
+ if (manager_object != NULL) {
+ g_object_ref (manager_object);
+ } else {
+ manager_object = g_object_new (GSD_TYPE_USB_PROTECTION_MANAGER, NULL);
+ g_object_add_weak_pointer (manager_object,
+ (gpointer *) &manager_object);
+ }
+
+ return GSD_USB_PROTECTION_MANAGER (manager_object);
+}
diff --git a/plugins/usb-protection/gsd-usb-protection-manager.h b/plugins/usb-protection/gsd-usb-protection-manager.h
new file mode 100644
index 0000000..8b2bbd7
--- /dev/null
+++ b/plugins/usb-protection/gsd-usb-protection-manager.h
@@ -0,0 +1,44 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 8 -*-
+ *
+ * Copyright (C) 2018 Ludovico de Nittis <denittis@gnome.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#ifndef __GSD_USB_PROTECTION_MANAGER_H
+#define __GSD_USB_PROTECTION_MANAGER_H
+
+#include <glib-object.h>
+
+G_BEGIN_DECLS
+
+#define GSD_TYPE_USB_PROTECTION_MANAGER (gsd_usb_protection_manager_get_type ())
+G_DECLARE_FINAL_TYPE (GsdUsbProtectionManager, gsd_usb_protection_manager, GSD, USB_PROTECTION_MANAGER, GObject);
+
+typedef struct
+{
+ GObjectClass parent_class;
+} _GsdUsbProtectionManagerClass;
+
+GType gsd_usb_protection_manager_get_type (void);
+
+GsdUsbProtectionManager * gsd_usb_protection_manager_new (void);
+gboolean gsd_usb_protection_manager_start (GsdUsbProtectionManager *manager,
+ GError **error);
+void gsd_usb_protection_manager_stop (GsdUsbProtectionManager *manager);
+
+G_END_DECLS
+
+#endif /* __GSD_USB_PROTECTION_MANAGER_H */
diff --git a/plugins/usb-protection/main.c b/plugins/usb-protection/main.c
new file mode 100644
index 0000000..fd453bc
--- /dev/null
+++ b/plugins/usb-protection/main.c
@@ -0,0 +1,7 @@
+#define NEW gsd_usb_protection_manager_new
+#define START gsd_usb_protection_manager_start
+#define STOP gsd_usb_protection_manager_stop
+#define MANAGER GsdUsbProtectionManager
+#include "gsd-usb-protection-manager.h"
+
+#include "daemon-skeleton.h"
diff --git a/plugins/usb-protection/meson.build b/plugins/usb-protection/meson.build
new file mode 100644
index 0000000..1eed2fb
--- /dev/null
+++ b/plugins/usb-protection/meson.build
@@ -0,0 +1,21 @@
+sources = files(
+ 'gsd-usb-protection-manager.c',
+ 'main.c'
+)
+
+deps = plugins_deps + [
+ gsettings_desktop_dep,
+ libcommon_dep,
+ libnotify_dep,
+]
+
+executable(
+ 'gsd-' + plugin_name,
+ sources,
+ include_directories: [top_inc, common_inc, data_inc],
+ dependencies: deps,
+ c_args: cflags,
+ install: true,
+ install_rpath: gsd_pkglibdir,
+ install_dir: gsd_libexecdir
+)
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-16 20:30:35 +0000