#47576 [security] ibus-daemon launches ungrafted subprocesses

Message #34 received at 47576@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47576) by debbugs.gnu.org; 20 Apr 2021 21:26:28 +0000
From debbugs-submit-bounces@debbugs.gnu.org Tue Apr 20 17:26:28 2021
Received: from localhost ([127.0.0.1]:56234 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lYxt2-0005IX-Kg
	for submit@debbugs.gnu.org; Tue, 20 Apr 2021 17:26:28 -0400
Received: from eggs.gnu.org ([209.51.188.92]:35196)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1lYxt1-0005IL-Mq
 for 47576@debbugs.gnu.org; Tue, 20 Apr 2021 17:26:24 -0400
Received: from fencepost.gnu.org ([2001:470:142:3::e]:43150)
 by eggs.gnu.org with esmtp (Exim 4.90_1)
 (envelope-from <ludo@gnu.org>)
 id 1lYxsu-0002X2-TZ; Tue, 20 Apr 2021 17:26:18 -0400
Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=51904 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1lYxsu-0004S9-A9; Tue, 20 Apr 2021 17:26:16 -0400
From: Ludovic Courtès <ludo@gnu.org>
To: Ricardo Wurmus <rekado@elephly.net>
Subject: Re: bug#47576: [security] ibus-daemon launches ungrafted subprocesses
References: <87pmzcdljm.fsf@netris.org> <87v98hko0z.fsf@elephly.net>
X-URL: http://www.fdn.fr/~lcourtes/
X-Revolutionary-Date: 1 Floréal an 229 de la Révolution
X-PGP-Key-ID: 0x090B11993D9AEBB5
X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc
X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5
X-OS: x86_64-pc-linux-gnu
Date: Tue, 20 Apr 2021 23:26:14 +0200
In-Reply-To: <87v98hko0z.fsf@elephly.net> (Ricardo Wurmus's message of "Tue,
 20 Apr 2021 16:51:08 +0200")
Message-ID: <8735vkabrd.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 47576
Cc: 47576@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.7 (-)

[Message part 1 (text/plain, inline)]

Ricardo Wurmus <rekado@elephly.net> skribis:

> Ludo, the patch looks good to me.  However, many ibus input methods
> are not provided by the ibus package itself, so for ibus-anthy or
> ibus-libpinyin we would need a different mechanism.

Right.

> Would it make sense to introduce another environment variable
> (e.g. GUIX_IBUS_COMPONENTS_PATH) that specifies a search path on 
> which components are looked up?  I feel that this partially defeats
> the purpose of having a cache, so perhaps this is nonsensical.

That makes sense to me.

Attached is a variant of the previous patch that supports
GUIX_IBUS_COMPONENTS_DIRECTORY (not PATH because… it’s complicated).
It would be set to $HOME/.guix-profile/libexec.

We then need to modify the XML files of ibus-anthy, ibus-libpinyin,
etc. so that their <exec> tags use relative file names.

Thoughts?

Ludo’.

PS: IBus still builds with the patch, but that’s all I can say.  :-)

[ibus.patch (text/x-patch, inline)]

diff --git a/conf/dconf/dconf.xml.in b/conf/dconf/dconf.xml.in
index 4205cb0..538f500 100644
--- a/conf/dconf/dconf.xml.in
+++ b/conf/dconf/dconf.xml.in
@@ -3,7 +3,7 @@
 <component>
 	<name>org.freedesktop.IBus.Config</name>
 	<description>Dconf Config Component</description>
-	<exec>@libexecdir@/ibus-dconf</exec>
+	<exec>ibus-dconf</exec>
 	<version>@VERSION@</version>
 	<author>Daiki Ueno &lt;ueno@unixuser.org&gt;</author>
 	<license>GPL</license>
diff --git a/conf/memconf/memconf.xml.in b/conf/memconf/memconf.xml.in
index d6ea690..9f51bcc 100644
--- a/conf/memconf/memconf.xml.in
+++ b/conf/memconf/memconf.xml.in
@@ -2,7 +2,7 @@
 <component>
 	<name>org.freedesktop.IBus.Config</name>
 	<description>On-memory Config Component</description>
-	<exec>@libexecdir@/ibus-memconf</exec>
+	<exec>ibus-memconf</exec>
 	<version>@VERSION@</version>
 	<author>Peng Huang &lt;shawn.p.huang@gmail.com&gt;, modified by the Chromium OS Authors</author>
 	<license>GPL</license>
diff --git a/engine/simple.xml.in b/engine/simple.xml.in
index fc1541e..47cbea1 100644
--- a/engine/simple.xml.in
+++ b/engine/simple.xml.in
@@ -2,7 +2,7 @@
 <component>
 	<name>org.freedesktop.IBus.Simple</name>
 	<description>A table based simple engine</description>
-	<exec>@libexecdir@/ibus-engine-simple</exec>
+	<exec>ibus-engine-simple</exec>
 	<version>@VERSION@</version>
 	<author>Peng Huang &lt;shawn.p.huang@gmail.com&gt;</author>
 	<license>GPL</license>
diff --git a/src/Makefile.am b/src/Makefile.am
index a8e3d07..2c461ee 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -49,6 +49,7 @@ AM_CPPFLAGS =                                           \
     @GLIB2_CFLAGS@                                      \
     @GOBJECT2_CFLAGS@                                   \
     @GIO2_CFLAGS@                                       \
+    -DLIBEXECDIR=\"$(libexecdir)\"			\
     -DIBUS_CACHE_DIR=\""$(localstatedir)/cache/ibus"\"  \
     -DIBUS_DATA_DIR=\"$(pkgdatadir)\"                   \
     -DIBUS_DISABLE_DEPRECATION_WARNINGS                 \
diff --git a/src/Makefile.in b/src/Makefile.in
index 2a9c2ab..c3dfd87 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -613,6 +613,7 @@ CLEANFILES = $(am__append_2) $(BUILT_SOURCES) stamp-ibusmarshalers.h \
 # C preprocessor flags
 AM_CPPFLAGS = -DG_LOG_DOMAIN=\"IBUS\" @GLIB2_CFLAGS@ @GOBJECT2_CFLAGS@ \
 	@GIO2_CFLAGS@ \
+	-DLIBEXECDIR=\"$(libexecdir)\" \
 	-DIBUS_CACHE_DIR=\""$(localstatedir)/cache/ibus"\" \
 	-DIBUS_DATA_DIR=\"$(pkgdatadir)\" \
 	-DIBUS_DISABLE_DEPRECATION_WARNINGS -DIBUS_COMPILATION \
diff --git a/src/ibuscomponent.c b/src/ibuscomponent.c
index 9837f47..ca875bd 100644
--- a/src/ibuscomponent.c
+++ b/src/ibuscomponent.c
@@ -613,16 +613,45 @@ ibus_component_parse_engines (IBusComponent *component,
     }
 
     if (exec != NULL) {
-        gchar *output = NULL;
-        if (g_spawn_command_line_sync (exec, &output, NULL, NULL, NULL)) {
-            engines_node = ibus_xml_parse_buffer (output);
-            g_free (output);
-
-            if (engines_node) {
-                if (g_strcmp0 (engines_node->name, "engines") == 0) {
-                    node = engines_node;
+        gint argc;
+        gchar **argv;
+
+        if (g_shell_parse_argv (exec, &argc, &argv, NULL)) {
+            gchar *output = NULL;
+            gchar *program = argv[0];
+
+            if (program[0] != '/') {
+                /* PROGRAM is a relative file name, so assume it's the name
+                   of an executable in LIBEXECDIR or
+                   $GUIX_IBUS_COMPONENTS_DIRECTORY and expand it.  */
+                const gchar *directory;
+                gchar *absolute;
+
+                directory = g_getenv ("GUIX_IBUS_COMPONENTS_DIRECTORY") ?: LIBEXECDIR;
+                absolute = g_malloc (strlen (directory) + strlen (program) + 2);
+                strcpy (absolute, directory);
+                strcat (absolute, "/");
+                strcat (absolute, program);
+
+                g_free (program);
+                argv[0] = absolute;
+            }
+
+            if (g_spawn_sync (NULL, argv, NULL,
+                              G_SPAWN_DEFAULT, NULL, NULL,
+                              &output, NULL,         /* stdout, stderr */
+                              NULL, NULL)) {
+                engines_node = ibus_xml_parse_buffer (output);
+                g_free (output);
+
+                if (engines_node) {
+                    if (g_strcmp0 (engines_node->name, "engines") == 0) {
+                        node = engines_node;
+                    }
                 }
             }
+
+            g_strfreev (argv);
         }
     }
 
diff --git a/ui/gtk3/gtkextension.xml.in b/ui/gtk3/gtkextension.xml.in
index b8157c9..fc945ab 100644
--- a/ui/gtk3/gtkextension.xml.in
+++ b/ui/gtk3/gtkextension.xml.in
@@ -3,7 +3,7 @@
 <component>
 	<name>org.freedesktop.IBus.Panel.Extension</name>
 	<description>Gtk Panel Extension Component</description>
-	<exec>@libexecdir@/ibus-extension-gtk3</exec>
+	<exec>ibus-extension-gtk3</exec>
 	<version>@VERSION@</version>
 	<author>Takao Fujiwara &lt;takao.fujiwara1@gmail.com&gt;</author>
 	<license>GPL</license>
diff --git a/ui/gtk3/gtkpanel.xml.in b/ui/gtk3/gtkpanel.xml.in
index b61f400..2175b93 100644
--- a/ui/gtk3/gtkpanel.xml.in
+++ b/ui/gtk3/gtkpanel.xml.in
@@ -3,7 +3,7 @@
 <component>
 	<name>org.freedesktop.IBus.Panel</name>
 	<description>Gtk Panel Component</description>
-	<exec>@libexecdir@/ibus-ui-gtk3</exec>
+	<exec>ibus-ui-gtk3</exec>
 	<version>@VERSION@</version>
 	<author>Peng Huang &lt;shawn.p.huang@gmail.com&gt;</author>
 	<license>GPL</license>

Send a report that this bug log contains spam.