[mhduiy]

修复 CWE-290 认证绕过漏洞

问题

SessionManager::SetLocked() 使用 /proc/PID/cmdline 前缀匹配（startsWith）作为调用者鉴权依据。/proc/PID/cmdline 可被同用户进程伪造，任意进程只需伪装可执行名即可绕过锁定/解锁鉴权。

修复方案

将鉴权方式从读取 /proc/PID/cmdline + startsWith() 前缀匹配改为 readlink(/proc/PID/exe) + 精确 != 比较：

• 新增 #include <climits>（PATH_MAX）
• 通过 readlink 读取 /proc/PID/exe 符号链接获取调用者真实可执行路径
• 精确匹配 != 替代 startsWith() 前缀匹配
• 仅允许 /usr/bin/dde-lock 和 /usr/libexec/deepin/dde-lock

修改文件

• src/dde-session/impl/sessionmanager.cpp

审核

代码审核已通过（100/100，四维度全部通过，无新增安全问题）。

关联 Issue

DDE-518

Summary by Sourcery

Harden SetLocked caller authentication against CWE-290 by using the process executable path for exact authorization checks.

Bug Fixes:

• Prevent authentication bypass in session lock state changes by validating the caller’s actual executable path instead of spoofable process command-line content.

Enhancements:

• Restrict SetLocked callers to exact matches for the approved dde-lock executable paths.

[deepin-ci-robot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mhduiy

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

修复 SetLocked 中基于可伪造 /proc/PID/cmdline 前缀匹配的 CWE-290 认证绕过：使用 readlink 获取调用者真实可执行路径，并对两个受信任路径执行精确匹配。

Sequence diagram for secure SetLocked caller validation

sequenceDiagram
    participant Caller as DdeLockProcess
    participant SessionManager
    participant ProcFS as ProcFS

    Caller->>SessionManager: SetLocked(lock)
    SessionManager->>ProcFS: readlink(/proc/PID/exe)
    ProcFS-->>SessionManager: caller executable path
    alt exact trusted path
        SessionManager->>SessionManager: SetLocked(lock)
    else readlink fails or path is untrusted
        SessionManager-->>Caller: reject request
    end

Loading

File-Level Changes

Change	Details	Files
将 SetLocked 的调用者鉴权从可伪造的 cmdline 前缀匹配改为基于 /proc/PID/exe 的真实可执行文件路径精确匹配。	通过 service PID 构造 /proc/PID/exe 并使用 readlink 读取目标路径 增加 readlink 失败或返回空路径时的日志记录和提前返回 仅放行 /usr/bin/dde-lock 与 /usr/libexec/deepin/dde-lock 两个完整路径，拒绝前缀相似的可执行文件	src/dde-session/impl/sessionmanager.cpp

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.