Refactor fm-shim to use D-Bus forwarding instead of CLI invocation#361
Closed
assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
Closed
Refactor fm-shim to use D-Bus forwarding instead of CLI invocation#361assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
assisted-by-ai wants to merge 2 commits intoKicksecure:masterfrom
Conversation
Root cause fixes for fm-shim issues on Qubes OS: 1. Backend: Transform from full intercepting proxy into D-Bus activation proxy (marmarek's suggestion). On confirmed request, release the FileManager1 name, start pcmanfm-qt --daemon-mode, and forward the request via D-Bus ShowFolders. This eliminates the TOCTOU vulnerability that existed with CLI invocation (gio launch). 2. Backend: Fix name ownership handling. When another process already owns org.freedesktop.FileManager1 (e.g. pcmanfm-qt in daemon mode), send READY=1 so systemd does not time out the service. The shim stays queued and takes over when the current owner exits. 3. Frontend: Simplify to confirmation-only dialog. Exit code 0 = user confirmed (backend handles D-Bus forwarding), exit code 1 = user cancelled. Remove all xdg-mime query and gio launch code. 4. Add XDG autostart entry that runs dbus-update-activation-environment --systemd --all at session start. This syncs the session environment to systemd's user manager, fixing the stale XDG_DATA_DIRS that caused xdg-mime to return Catfish instead of pcmanfm-qt on Qubes OS. 5. Add D-Bus service activation file for org.freedesktop.FileManager1 so the shim can be started on-demand by D-Bus. https://forums.whonix.org/t/is-catfish-the-new-default-in-the-qubes-domain-open-file-manager-quick-widget-for-whonix/20233 https://claude.ai/code/session_01SAkV8U9vft3vzZAyJfzXGE
The stale systemd user manager environment on Qubes OS is a Qubes bug (QubesOS/qubes-issues), not a security-misc bug. Working around it here is fixing the issue in the wrong place. The D-Bus forwarding approach already eliminates the dependency on xdg-mime (which was the component affected by stale XDG_DATA_DIRS), so the env mismatch no longer causes Catfish to open. https://claude.ai/code/session_01SAkV8U9vft3vzZAyJfzXGE
Member
|
Superseded by assisted-by-ai#7 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR refactors the fm-shim file manager handler to eliminate a TOCTOU (Time-of-Check-Time-of-Use) vulnerability by forwarding confirmed file manager requests to pcmanfm-qt via D-Bus instead of CLI invocation. The frontend is now a confirmation-only dialog, with the backend handling the actual file manager launch.
Key Changes
Backend (fm-shim-backend.c):
launch_frontend_process()into separate functions:get_systemd_environment(): Fetches environment from systemd's user manager on each requestlaunch_frontend(): Forks and execs the confirmation dialog, returns child PIDlaunch_pcmanfm_qt_daemon(): Starts pcmanfm-qt in daemon mode using double-fork to avoid zombieswait_for_dbus_name_owner(): Polls until pcmanfm-qt claims the D-Bus nameforward_dbus_request(): Forwards the original request via D-Bus ShowFolders/ShowItems/ShowItemPropertiesSIG_IGNtoSIG_DFLto enablewaitpid()for the frontend processFrontend (fm_shim_frontend.py):
open_dir_list()now simply exits with code 0 to signal confirmationexit_app()now exits with code 1 to signal cancellationNew Files:
etc/xdg/autostart/security-misc-dbus-env-sync.desktop: Autostart script that syncs session environment to D-Bus and systemd user manager viadbus-update-activation-environment --systemd --allusr/share/dbus-1/services/org.freedesktop.FileManager1.service: D-Bus service activation file for fm-shim-backendNotable Implementation Details
https://claude.ai/code/session_01SAkV8U9vft3vzZAyJfzXGE