o

%`b i�@s�dd
lm
Z
mZmZmZmZ
ddlZddlZddl	Z	ddl
Z
ddlZddlZddl
Z
ddlZddlZddlZdd�Zddd�
Zdd�Zd	d
�Zigfdd�
Zd
d�ZGdd�d�ZGdd�de�ZGdd�de�Zdd�ZdS)�)�AppArmorException�debug�error�msg�cmdNc
CsXd
dddd|g}
|
D]}td|�

t
d|g�
\}}|dkr)td	|d
d�

d
Sq
dS)
z&Verify necessary software is installed�xsetzaa-easyprof�aa-exec�sudo�pkexec�Searching for '%s'�whichr
�Could not find '%s'F�
�do_exitT)rrr)�binary�exes�
e�rc�report�r�2/usr/lib/python3/dist-packages/apparmor/sandbox.py�check_requirementss




�




�rcCs^
|
d
krt�
�}
|
jddddddd�
|
jd	d
ddd
�
|
jdddddd�
|
jddd
dd
�
|
jddddddd�
|
jddd
dd
�
|
jddd
dd
�
|
��\}}|jrYdtj_gd�
}|jrs|j	�
�|v
rstd |j	d!�|�
f�

|jr�|j
r�|j	�
�d"kr�td#|j	�

n|jr�|j	�
�d"kr�td$|j	�

|jd%kr�|jr�d&|_||fSd'|_||fS)(zParse argumentsNz-Xz--with-x�withxFzRun in isolated X server�
store_true)�dest�default�help�actionz--with-xserver�xserver�xpraz6Nested X server to use: xpra (default), xpra3d, xephyr)rrrz--with-clipboard�with_clipboardzAllow clipboard accessz--with-xauthority�
xauthorityzSpecify Xauthority file to usez-dz--debugrzShow debug messagesz--with-xephyr-geometry�xephyr_geometryzGeometry for Xephyr windowz	--profile�profilez+Specify an existing profile (see aa-status)T)r�xpra3d�xephyrz#Invalid server '%s'. Use one of: %sz, r%z/Invalid option --with-xephyr-geometry with '%s'z!Clipboard not supported with '%s'rz	sandbox-x�sandbox)�optparse�OptionParser�
add_option�
parse_argsr�apparmor�common�	DEBUGGINGrr�lowerr�joinr"r �template)�args�parser�my_opt�my_args�valid_xserversrrrr*)sv




�


�



�


�



�


�


�




�






�r*c

Cs$d
t�
t���
dt�dd|�fS)z4Generate a temporary policy based on the binary namezsandbox-%s%sr
�
/�
_)�pwd�getpwuid�os�geteuid�re�sub)
rrrr�gen_policy_namees
�r>c
Cs@|��}
|
�
�
|
D]}td
|||f�

||tj|<q
dS)NzUsing: %s=%s)�keys�sortrr:�environ)�envr?�
krrr�set_environjs




�rDcCs�
|
jd
kr	|
j}n�|
�
dd
�
|
�
dd
�
|
�
dd
�
|
�
dd
�
|
�
dd
�
|d}t|�
}tj�||
�}tj�||
�}|jdi|�
�
}td|�

t	j
d	|d
�
}	tjddkrc|	�
t|d��

n|	�
|�

|	��
td
|
j�

|
jr�tdddd|	jg�
\}
}ntddd|	jg�
\}
}|
dkr�td�
�
tddd|	jg�
\}
}|
dkr�td�
�
|D]}d}
|��D]}|��}||kr�d}

n
q�|
s�td|�
�
q�t|�

dd|dg|}t|�
\}
}|
|fS)z%Execute binary under specified policyN�template_var�name�comment�author�	copyrightr
z
%sz%s-�
�prefix��utf-8zusing '%s' templater
�apparmor_parserz-rz%sr	zCould not load policyz-pzCould not dump policyFTz Could not find required rule: %srz--r)r#�ensure_valuer>r+�easyprof�AppArmorEasyProfile�gen_policy_params�
gen_policyr�tempfile�NamedTemporaryFile�sys�version_info�write�bytes�flushr0rrrFr�
splitlines�striprD)�command�optrA�verify_rules�policy_namer�easyp�params�policy�tmprr�
r�found�liner1rrr�aa_execqsT

























�
�


rhcCst||
�\}}||fS)
zRun application)
rh)r]r^rrrrr�run_sandbox�s
ric@sFeZ
dZ	
	
	
	ddd�
Zdd�Zdd�Zd	d
�Zdd�Zd
d�Zd
S)�SandboxXserverNFcCs�||_|
|_
g|_||_||_g|_d
|_t�|_dD]}|t	j
vr*t	j
||j|<q|��\|_|_
|rJt	j�|�
}t	j�d�
|krGtd�
�
||_
t�|_|j|jd<|j
|jd<d|jd<d	|jd
<d|jd<dS)
N�)�DISPLAY�
XAUTHORITY�UBUNTU_MENUPROXY�QT_X11_NO_NATIVE_MENUBAR�LIBOVERLAY_SCROLLBARz
~/.Xauthorityz+Trusted Xauthority file specified. Abortingrlrm�rn�
1ro�
0rp)�geometry�title�pids�driver�	clipboard�	tempfiles�timeout�dict�old_environr:rA�find_free_x_display�display�xauth�path�
expanduserr�new_environ)�selfrurtrwrrxrB�	abs_xauthrrr�__init__�s0








�










zSandboxXserver.__init__c
Cs�|j�
�
t|j�

|jD]}
td
|
�

t�|
tj�
q
|jD]}
td|
�

t�|
tj�
q |jD]
}tj	�
|�
r@t�|�

q3tj	�
|j�
rNt�|j�

t
|j�

dS)z3Cleanup our forked pids, reset the environment, etczkill %dz
kill -9 %dN)rv�reverserr:�kill�signal�SIGTERM�SIGKILLryr��exists�unlinkrrDr|)r��pid�
trrr�cleanup�s











�
zSandboxXserver.cleanupc
	Cs�d
}
dtj
vrtj
d}
dtj
d<d}|jd}tdd�D]}d|}|tj
d<td	d
g�
\}}|dkr<d|v
r<|}
n
q|
rD|
tj
d<|tj
d<|dkrQtd
�
�
tj�tj�d�
d|�	d�
d�}||fS)zFind a free X displayN�LANG�
Crqrl�
i

z:%drz-qr
zInvalid MIT-MAGIC-COOKIE-1z"Could not find available X display�
~z.Xauthority-sandbox%s�
:)
r:rAr|�rangerrr�r/r��split)	r��old_langr~�current�
irdrrrrrrr}�s.














�





�z"SandboxXserver.find_free_x_displayc

Csd
|j|j
fS)Nz(Sandbox%s) %s)r~ru)
r�rrr�generate_title
s
zSandboxXserver.generate_titlec
Cs�d
}
dtj
vrtj
d}
dtj
d<tdg
�
\}}|
r|
tj
d<|dkr'td�
�
d|v
r/td�
�
t�t���
d}d	||vrDtd
|�
�
d
S)z$Make sure we have everything we needNr�r��xhostr
z'xhost' exited with errorzaccess control enabledz?Access control currently disabled. Please enable with 'xhost -'z
:localuser:%szOAccess control allows '%s' full access. Please see 'man aa-sandbox' for details)r:rArrr8r9r;)r�r�rr�usernamerrr�verify_host_setup
s













�z SandboxXserver.verify_host_setupc
	Csttj
�|j�
r
t�|j�

td
g
�
\}
}|
dkrtd�
�
tdd|jd|jd|��g�
\}
}|
dkr8td|j�
�
d	S)
z*Start a nested X server (need to override)�mcookier
zCould not generate magic cookierz-f�addzMIT-MAGIC-COOKIE-1zCould not generate '%s'N)	r:r�r�rr�rrr~r\)r�r�cookie�outrrr�start
s









�
�zSandboxXserver.start)NNNF)	�__name__�
__module__�__qualname__r�r�r}r�r�r�rrrrrj�s




�#rjc@seZ
dZd
d�ZdS)�
SandboxXephyrc


Cs^
d
D]}
td|
�

t
d|
g�
\}}|dkrtd|
�
�
q	t�|�

	t��}|dkrigd�
}gd�
}|js:d|_d	d
d|jdd
dd|��g	||}dg
||j	g
}td�
|�
�

t�|d|�
t�
d�

|j�|�

t�d�

tj��
t�tjd�

t��}	|	dkr�t|j�

gd�
}td�
|�
�

t
|�

t�
d�

|j�|	�

t�d�

dS)N)�Xephyrzmatchbox-window-managerrrr
r
)
�
-extension�GLXr�zMIT-SHMr��RENDERr��SECURITYr��DAMAGE)z-host-cursorz-fakexaz-nodri�640x480z	-nolisten�tcpz-screenz-brz-resetz
-terminatez-titlez/usr/bin/Xephyr�
 r��HOME)z /usr/bin/matchbox-window-managerz
-use_titlebar�no)rrrrjr�r:�forkrtr�r~r/�execvrV�exitrv�append�time�sleep�stdoutrZ�chdirrArDr�)
r�rrr�
listener_x�x_exts�x_extra_args�x_argsr1�listener_wmrrrr�2
sV




�










���















zSandboxXephyr.startN)r�r�r�r�rrrrr�1
s
r�c@s$eZ
dZd
d�Zdd�Zdd�ZdS)�SandboxXprac
Cs�tj
��
t��}
|
d
kr'dd|jg}td�|�
�

t�|d
|�
t�	d
�

t
�d�

tddg�
\}}|�
�D]}d|j|vrM|j�t|��d	�
�

q8t�|�

dS)
Nr
�
/usr/bin/xpra�stopr���ps�auxwwz-for-Xpra-%sr�)rV�stderrrZr:r�r~rr/r�r�r�r�rr[rvr��intr�rjr�)r��listenerr1rrrgrrrr�p
s













�zSandboxXpra.cleanupc
Csf
g}
|jd
kr6|
�
d�

|
�
d�

|
�
d�

|
�
d�

|
�
d|jd�

|
�
d�

|
�
d	�

|
�
d
�

|
S|jdkr�d}tjd
d�
\}}|j�
|�

tjddkr\t�	|t
|d��
nt�	||�
t�|�

|
�
d�

|
�
d�

|
�
d�

|
�
d�

|
�
dtj�
d|j�
�

|
�
d|jd�

|
�
d|�

gd�
}|D]	}|
�
d|�

q�|
Std|j�
�
)zSetup xvfb argumentsNz--xvfb=Xvfbz-screen 0 3840x2560x24+32z
-nolisten tcpz-noresetz-auth %srmz+extension Compositez+extension SECURITYz-extension GLX�xdummya�# /usr/share/doc/xpra/examples/dummy.xorg.conf.gz
# http://xpra.org/Xdummy.html
##Xdummy:##
Section "ServerFlags"
  Option "DontVTSwitch" "true"
  Option "AllowMouseOpenFail" "true"
  Option "PciForceNone" "true"
  Option "AutoEnableDevices" "false"
  Option "AutoAddDevices" "false"
EndSection


##Xdummy:##
Section "InputDevice"
  Identifier "NoMouse"
  Option "CorePointer" "true"
  Driver "void"
EndSection

Section "InputDevice"
  Identifier "NoKeyboard"
  Option "CoreKeyboard" "true"
  Driver "void"
EndSection

##Xdummy:##
Section "Device"
  Identifier "Videocard0"
  Driver "dummy"
  # In kByte
  #VideoRam 4096000
  #VideoRam 256000
  # This should be good for 3840*2560*32bpp: http://winswitch.org/trac/ticket/140
  VideoRam 64000
EndSection

##Xdummy:##
Section "Monitor"
  Identifier "Monitor0"
  HorizSync   10.0 - 300.0
  VertRefresh 10.0 - 200.0
  DisplaySize 4335 1084
  #The following modeline is invalid (calculator overflowed):
  #Modeline "32000x32000@0" -38917.43 32000 32032 -115848 -115816 32000 32775 32826 33601
  Modeline "16384x8192@10" 2101.93 16384 16416 24400 24432 8192 8390 8403 8602
  Modeline "8192x4096@10" 424.46 8192 8224 9832 9864 4096 4195 4202 4301
  Modeline "5120x3200@10" 199.75 5120 5152 5904 5936 3200 3277 3283 3361
  Modeline "3840x2880@10" 133.43 3840 3872 4376 4408 2880 2950 2955 3025
  Modeline "3840x2560@10" 116.93 3840 3872 4312 4344 2560 2622 2627 2689
  Modeline "3840x2048@10" 91.45 3840 3872 4216 4248 2048 2097 2101 2151
  Modeline "2048x2048@10" 49.47 2048 2080 2264 2296 2048 2097 2101 2151
  Modeline "2560x1600@10" 47.12 2560 2592 2768 2800 1600 1639 1642 1681
  Modeline "1920x1200@10" 26.28 1920 1952 2048 2080 1200 1229 1231 1261
  Modeline "1920x1080@10" 23.53 1920 1952 2040 2072 1080 1106 1108 1135
  Modeline "1680x1050@10" 20.08 1680 1712 1784 1816 1050 1075 1077 1103
  Modeline "1600x900@20" 33.92 1600 1632 1760 1792 900 921 924 946
  Modeline "1440x900@20" 30.66 1440 1472 1584 1616 900 921 924 946
  Modeline "1360x768@20" 24.49 1360 1392 1480 1512 768 786 789 807
  #common resolutions for android devices (both orientations):
  Modeline "800x1280@20" 25.89 800 832 928 960 1280 1310 1315 1345
  Modeline "1280x800@20" 24.15 1280 1312 1400 1432 800 819 822 841
  Modeline "720x1280@25" 30.22 720 752 864 896 1280 1309 1315 1345
  Modeline "1280x720@25" 27.41 1280 1312 1416 1448 720 737 740 757
  Modeline "768x1024@25" 24.93 768 800 888 920 1024 1047 1052 1076
  Modeline "1024x768@25" 23.77 1024 1056 1144 1176 768 785 789 807
  Modeline "600x1024@25" 19.90 600 632 704 736 1024 1047 1052 1076
  Modeline "1024x600@25" 18.26 1024 1056 1120 1152 600 614 617 631
  Modeline "536x960@25" 16.74 536 568 624 656 960 982 986 1009
  Modeline "960x536@25" 15.23 960 992 1048 1080 536 548 551 563
  Modeline "600x800@25" 15.17 600 632 688 720 800 818 822 841
  Modeline "800x600@25" 14.50 800 832 880 912 600 614 617 631
  Modeline "480x854@25" 13.34 480 512 560 592 854 873 877 897
  Modeline "848x480@25" 12.09 848 880 920 952 480 491 493 505
  Modeline "480x800@25" 12.43 480 512 552 584 800 818 822 841
  Modeline "800x480@25" 11.46 800 832 872 904 480 491 493 505
  Modeline "320x480@50" 10.73 320 352 392 424 480 490 494 505
  Modeline "480x320@50" 9.79 480 512 544 576 320 327 330 337
  Modeline "240x400@50" 6.96 240 272 296 328 400 408 412 421
  Modeline "400x240@50" 6.17 400 432 448 480 240 245 247 253
  Modeline "240x320@50" 5.47 240 272 288 320 320 327 330 337
  Modeline "320x240@50" 5.10 320 352 368 400 240 245 247 253
  #resolutions for android devices (both orientations)
  #minus the status bar
  #38px status bar (and width rounded up)
  Modeline "800x1242@20" 25.03 800 832 920 952 1242 1271 1275 1305
  Modeline "1280x762@20" 22.93 1280 1312 1392 1424 762 780 783 801
  Modeline "720x1242@25" 29.20 720 752 856 888 1242 1271 1276 1305
  Modeline "1280x682@25" 25.85 1280 1312 1408 1440 682 698 701 717
  Modeline "768x986@25" 23.90 768 800 888 920 986 1009 1013 1036
  Modeline "1024x730@25" 22.50 1024 1056 1136 1168 730 747 750 767
  Modeline "600x986@25" 19.07 600 632 704 736 986 1009 1013 1036
  Modeline "1024x562@25" 17.03 1024 1056 1120 1152 562 575 578 591
  Modeline "536x922@25" 16.01 536 568 624 656 922 943 947 969
  Modeline "960x498@25" 14.09 960 992 1040 1072 498 509 511 523
  Modeline "600x762@25" 14.39 600 632 680 712 762 779 783 801
  Modeline "800x562@25" 13.52 800 832 880 912 562 575 578 591
  Modeline "480x810@25" 12.59 480 512 552 584 810 828 832 851
  Modeline "848x442@25" 11.09 848 880 920 952 442 452 454 465
  Modeline "480x762@25" 11.79 480 512 552 584 762 779 783 801
  Modeline "800x442@25" 10.51 800 832 864 896 442 452 454 465
  #32px status bar (no need for rounding):
  Modeline "320x448@50" 9.93 320 352 384 416 448 457 461 471
  Modeline "480x288@50" 8.75 480 512 544 576 288 294 297 303
  #24px status bar:
  Modeline "240x376@50" 6.49 240 272 296 328 376 384 387 395
  Modeline "400x216@50" 5.50 400 432 448 480 216 220 222 227
  Modeline "240x296@50" 5.02 240 272 288 320 296 302 305 311
  Modeline "320x216@50" 4.55 320 352 368 400 216 220 222 227
EndSection

##Xdummy:##
Section "Screen"
  Identifier "Screen0"
  Device "Videocard0"
  Monitor "Monitor0"
  DefaultDepth 24
  SubSection "Display"
    Viewport 0 0
    Depth 24
    Modes "32000x32000" "16384x8192" "8192x4096" "5120x3200" "3840x2880" "3840x2560" "3840x2048" "2048x2048" "2560x1600" "1920x1440" "1920x1200" "1920x1080" "1600x1200" "1680x1050" "1600x900" "1400x1050" "1440x900" "1280x1024" "1366x768" "1280x800" "1024x768" "1024x600" "800x600" "320x200"
    #Virtual 32000 32000
    #Virtual 16384 8192
    #Virtual 8192 4096
    # http://winswitch.org/trac/ticket/140
    Virtual 3840 2560
  EndSubSection
EndSection

Section "ServerLayout"
  Identifier   "dummy_layout"
  Screen       "screen0"
  InputDevice  "NoMouse"
  InputDevice  "NoKeyboard"
EndSection
zaa-sandbox-xorg.conf-rJr
rLrMz--xvfb=Xorgz-dpi 96z-logfile %sz~/.xpra/%s.logz
-config %s)�	Compositer��RANDRr�r�z
+extension %szUnsupported X driver '%s')rwr�r�rT�mkstempryrVrWr:rXrY�closer�r�r~r)r��	xvfb_args�confrd�	xorg_conf�
extensionsr�rrr�_get_xvfb_args�
sD














"�
�	

















�zSandboxXpra._get_xvfb_argsc
	CsXtd
d�

t
ddg�
\}
}|
dkrtdd�
�
|jdkr1d}td
|�

tj�|�
s1td|�
�
	t�|�

|�	�}t�
�}|dkr�|jtjd<t
dd	g�

d
dg}|j
s[|�d�

|d
krg|�d�|�
�

dd|jg|}td�|�
�

tj��
t�|d|�
t�d�

|j�|�

d}tj�tjdddt��|j�d�
df�}	t|jd�
D]}
tj�|	�
r�td|	�


ntd|	�

t�d�

q�tj�|	�
s�tj��
|��
td�
�
t|j�
D]9}
t
dd	g�
\}
}d|j|vr�t d|jdd�

nd|j}||v�
rd }
nt�d�

td!|�

t|�

q�|�
s,tj��
|��
td�
�
tj��
t�!tjd�

t�
�}
|
dk�
rqdd"|jd#|�"�d$dg}|j
�
sX|�d�

td�|�
�

tj��
t�|d|�
t�d�

|j�|
�

t|j�
D])}
t�d�

t
dd%|jg�
\}
}d&}||v�
r�td'�


ntd!|�

t|�

�
q|t#d(�

dS))Nrrrr
r
r�z*/usr/lib/xorg/modules/drivers/dummy_drv.sorm�listz--no-daemonz--no-pulseaudioz--no-clipboardrqr�r�r�Fr�z.xpraz%s-%sr�r�r�z Found '%s'! Proceeding to attachz'%s' doesn't exist yet, waitingg�?z(Could not start xpra (try again with -d)zDEAD session at %szxpra session at '%s' diedrzLIVE session at %sTzCould not find '%s' in:
�attachz
--title=%sz	--no-tray�infoz	clients=1zClient successfully attached!zTODO: filter '~/.xpra/run-xpra')$rrrrwr:r�r�rjr�r�r�rrArxr�r/r~rVr�rZr�r�rv�socket�gethostnamer�r�rzr�r�r�r�rr�r�r)r�rr�drvr�r�r�r1�started�fnr�r��search�listener_attachrrrr�8s�












�










�


































�
















zSandboxXpra.startN)r�r�r�r�r�r�rrrrr�o
s

6r�c

CsP
t�
�}|
j��d
krt|d|
j|
jd�}n!|
j��dkr,t|ddd|
j|
jd�}nt|dd|
j|
jd�}|�	�
|j
��}|��
|D]
}t
d	||j
|f�

qGz|��
Wntyq
}
z
t|�

WYd}~nd}~w
wt�|�

|
js}g|
_|
j�|j�

d
g
}zt||
|j|�\}}	Wnty�


|��
�w|��
||	fS)zRun X application in a sandboxr%r
)rtrr$Nr�)rtrwrrx)rtrrxz
Old: %s=%sz%audit deny @{HOME}/.Xauthority mrwlk,)r:�getcwdrr.r�r"r!r�r r�r|r?r@rr��	Exceptionrr��	read_pathr�rrhr�r�)
r]r^�old_cwd�
xr?rCr�required_rulesrrrrr�run_xsandbox�sN

�




�


�






��






�r�)NN)�apparmor.commonrrrrr�apparmor.easyprofr+r'r:r8r<r�r�rVrTr�rr*r>rDrhrirjr�r�r�rrrr�<module>
s0











<6>: