This adds additional Polkit authorization within the proxy service for a list of manually maintained D-Bus methods. The checkAuthorization() method uses Polkit in an unsafe way, though:
auto pid = connection.interface()->servicePid(service).value();
auto authority = PolkitQt1::Authority::instance();
auto result = authority->checkAuthorizationSync(actionId,
PolkitQt1::UnixProcessSubject(pid),
PolkitQt1::Authority::AllowUserInteraction);
Using the caller's PID for authentication poses a race condition that can again lead to a local root exploit.
Upstream published a bugfix here:
martyr-deepin/dde-api-proxy@95b50dd
This adds additional Polkit authorization within the proxy service for a list of manually maintained D-Bus methods. The
checkAuthorization()method uses Polkit in an unsafe way, though:Using the caller's PID for authentication poses a race condition that can again lead to a local root exploit.