amnesia
released this
2026-07-04 02:53:19 +02:00
| 19 commits to main since this release
protocol7-core 5.5.3-5 (2026-07-03)
lainos-dbus-bridge security fixes
- Removed setuid, setgid, setreuid, setregid, setresuid, setresgid, setgroups
from seccomp whitelist ~ privilege drop completes before seccomp is applied
so these syscalls serve no purpose post-drop and were unnecessary attack surface
- Added execve and wait4 to seccomp whitelist ~ fixes silently broken
Reboot/PowerOff D-Bus methods (fork/exec path was blocked by seccomp)
- Replaced atoi with strtoul + error checking in /etc/passwd UID parsing ~
prevents silent fallback to UID 0 on malformed entries
- Removed all debug fprintf calls from main() ~ 11 lines of stderr output
on every startup that were never cleaned up from development
Verification
- Daemon confirmed running as nobody after reboot:
ps -o user,pid,comm -p $(pgrep -f lainos-dbus-bridge) returned USER=nobody
- seccomp filter confirmed active:
/proc/<pid>/status unreadable even with doas ~ seccomp blocking the read
- D-Bus query methods confirmed working:
CanReboot, CanPowerOff, CanSuspend all return "yes" via dbus-send
- System boots and desktop session starts correctly after package install
- No regressions observed in wlogout, polkit, seatd, or greetd
Downloads