Skip to content

Document File Manager D-Bus shim security feature #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
assisted-by-ai wants to merge 1 commit into from
+32 −0
Closed

Document File Manager D-Bus shim security feature #360

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -786,6 +786,38 @@ See:
by the user to function properly, see notes in
`/etc/security-misc/emerg-shutdown/30_security_misc.conf`.

## File Manager D-Bus shim
Copy link
Copy Markdown
Contributor

@ArrayBolt3 ArrayBolt3 Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idea accepted, but I'm going to rewrite this, it's both too detailed in places that don't matter as much and not detailed enough in places that matter more.


A D-Bus shim intercepts `org.freedesktop.FileManager1` method calls to prevent
applications from silently opening directories in the default file manager. Instead
of allowing unrestricted access to the file manager via D-Bus, a confirmation dialog
is presented to the user before any directories are opened. This works around issues
with PCManFM-Qt's D-Bus handling and provides an additional layer of user control.

The shim consists of two components:

- A C backend that claims the `org.freedesktop.FileManager1` D-Bus name on the session
bus, intercepts `ShowFolders`, `ShowItems`, and `ShowItemProperties` method calls, and
forwards them to the frontend. The backend is compiled with comprehensive GCC hardening
flags including `_FORTIFY_SOURCE=3`, full stack protector, PIE, RELRO, and
architecture-specific control-flow integrity protections.

- A Python/PyQt5 frontend that validates received URIs (restricting to local `file://`
URIs, rejecting Unicode and control characters, verifying paths exist and are accessible
directories), resolves symlinks so the user sees the actual target, and presents a
confirmation dialog before opening the directories with the system's default file manager
via `gio launch`.

The backend runs as a systemd user service that starts automatically on login.

See:

- `/usr/src/security-misc/fm-shim-backend.c`
- `/usr/lib/python3/dist-packages/fm_shim_frontend/fm_shim_frontend.py`
- `/usr/bin/fm-shim-frontend`
- `/usr/libexec/security-misc/build-fm-shim-backend`
- `/usr/lib/systemd/user/fm-shim.service`

## Application-specific hardening

- `sudo`: Enables "`Defaults !fqdn`", which disables attempts to
Expand Down