80664d1a27
* Move portbase into monorepo * Add new simple module mgr * [WIP] Switch to new simple module mgr * Add StateMgr and more worker variants * [WIP] Switch more modules * [WIP] Switch more modules * [WIP] swtich more modules * [WIP] switch all SPN modules * [WIP] switch all service modules * [WIP] Convert all workers to the new module system * [WIP] add new task system to module manager * [WIP] Add second take for scheduling workers * [WIP] Add FIXME for bugs in new scheduler * [WIP] Add minor improvements to scheduler * [WIP] Add new worker scheduler * [WIP] Fix more bug related to new module system * [WIP] Fix start handing of the new module system * [WIP] Improve startup process * [WIP] Fix minor issues * [WIP] Fix missing subsystem in settings * [WIP] Initialize managers in constructor * [WIP] Move module event initialization to constrictors * [WIP] Fix setting for enabling and disabling the SPN module * [WIP] Move API registeration into module construction * [WIP] Update states mgr for all modules * [WIP] Add CmdLine operation support * Add state helper methods to module group and instance * Add notification and module status handling to status package * Fix starting issues * Remove pilot widget and update security lock to new status data * Remove debug logs * Improve http server shutdown * Add workaround for cleanly shutting down firewall+netquery * Improve logging * Add syncing states with notifications for new module system * Improve starting, stopping, shutdown; resolve FIXMEs/TODOs * [WIP] Fix most unit tests * Review new module system and fix minor issues * Push shutdown and restart events again via API * Set sleep mode via interface * Update example/template module * [WIP] Fix spn/cabin unit test * Remove deprecated UI elements * Make log output more similar for the logging transition phase * Switch spn hub and observer cmds to new module system * Fix log sources * Make worker mgr less error prone * Fix tests and minor issues * Fix observation hub * Improve shutdown and restart handling * Split up big connection.go source file * Move varint and dsd packages to structures repo * Improve expansion test * Fix linter warnings * Fix interception module on windows * Fix linter errors --------- Co-authored-by: Vladimir Stoilov <vladimir@safing.io>
58 lines
1.8 KiB
Go
58 lines
1.8 KiB
Go
package helper
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"strings"
|
|
|
|
"github.com/safing/portmaster/base/log"
|
|
"github.com/safing/portmaster/base/updater"
|
|
)
|
|
|
|
var pmElectronUpdate *updater.File
|
|
|
|
const suidBitWarning = `Failed to set SUID permissions for chrome-sandbox. This is required for Linux kernel versions that do not have unprivileged user namespaces (CONFIG_USER_NS_UNPRIVILEGED) enabled. If you're running and up-to-date distribution kernel you can likely ignore this warning. If you encounter issue starting the user interface please either update your kernel or set the SUID bit (mode 0%0o) on %s`
|
|
|
|
// EnsureChromeSandboxPermissions makes sure the chrome-sandbox distributed
|
|
// by our app-electron package has the SUID bit set on systems that do not
|
|
// allow unprivileged CLONE_NEWUSER (clone(3)).
|
|
// On non-linux systems or systems that have kernel.unprivileged_userns_clone
|
|
// set to 1 EnsureChromeSandboPermissions is a NO-OP.
|
|
func EnsureChromeSandboxPermissions(reg *updater.ResourceRegistry) error {
|
|
if runtime.GOOS != "linux" {
|
|
return nil
|
|
}
|
|
|
|
if pmElectronUpdate != nil && !pmElectronUpdate.UpgradeAvailable() {
|
|
return nil
|
|
}
|
|
|
|
identifier := PlatformIdentifier("app/portmaster-app.zip")
|
|
|
|
var err error
|
|
pmElectronUpdate, err = reg.GetFile(identifier)
|
|
if err != nil {
|
|
if errors.Is(err, updater.ErrNotAvailableLocally) {
|
|
return nil
|
|
}
|
|
return fmt.Errorf("failed to get file: %w", err)
|
|
}
|
|
|
|
unpackedPath := strings.TrimSuffix(
|
|
pmElectronUpdate.Path(),
|
|
filepath.Ext(pmElectronUpdate.Path()),
|
|
)
|
|
sandboxFile := filepath.Join(unpackedPath, "chrome-sandbox")
|
|
if err := os.Chmod(sandboxFile, 0o0755|os.ModeSetuid); err != nil {
|
|
log.Errorf(suidBitWarning, 0o0755|os.ModeSetuid, sandboxFile)
|
|
|
|
return fmt.Errorf("failed to chmod: %w", err)
|
|
}
|
|
log.Debugf("updates: fixed SUID permission for chrome-sandbox")
|
|
|
|
return nil
|
|
}
|