mirror of
https://forgejo.xatacraft.ru/Sunshine/mkxp-sunshine.git
synced 2026-08-19 13:29:54 +00:00
Security Sandbox
This commit is contained in:
DepressedTWM
parent
a77834f66e
commit
92e20199af
7 changed files with 91 additions and 38 deletions
|
|
@ -7,16 +7,17 @@ include(FindPackageHandleStandardArgs)
|
|||
option(STEAM "Build for Steam" OFF)
|
||||
set(STEAMWORKS_PATH "${CMAKE_CURRENT_SOURCE_DIR}/steamworks" CACHE PATH "Path to Steamworks folder")
|
||||
option(DEBUG "Debug mode" ON)
|
||||
set(SDLTTF_VENDORED ON)
|
||||
#For paranoics:3
|
||||
option(EXTRA_SECURITY "Extra security" OFF)
|
||||
set(ZLIB_USE_STATIC_LIBS ON)
|
||||
set(CMAKE_INCLUDE_CURRENT_DIR ON)
|
||||
|
||||
if(DEBUG)
|
||||
# Debug stuff
|
||||
if (MSVC)
|
||||
add_compile_options(/EHr /fsanitize /validate-charset /DEBUG /RTCu /RTCs /RTCc /guard:cf /GS)
|
||||
add_compile_options(/EHr /fsanitize /validate-charset /DEBUG /RTCu /RTCs /RTCc)
|
||||
else()
|
||||
add_compile_options(-g3 -O0 -fno-omit-frame-pointer -ggdb -Wall -fcheck-new -gbtf -pipe)
|
||||
add_compile_options(-g3 -O0 -fno-omit-frame-pointer -ggdb -fcheck-new -gbtf -pipe)
|
||||
endif()
|
||||
else()
|
||||
# Optimization stuff
|
||||
|
|
@ -27,6 +28,15 @@ else()
|
|||
add_link_options(-Wl,-O2)
|
||||
endif()
|
||||
endif()
|
||||
|
||||
if(EXTRA_SECURITY)
|
||||
if (MSVC)
|
||||
add_compile_options(/guard:cf /GS /sdl /DYNAMICBASE /HIGHENTROPYVA /SAFESEH /guard:ehcont)
|
||||
else()
|
||||
add_compile_options(-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -Wl,--no-copy-dt-needed-entries -fPIE -pie)
|
||||
endif()
|
||||
endif()
|
||||
|
||||
## Setup main source ##
|
||||
|
||||
# main stuff
|
||||
|
|
@ -78,6 +88,7 @@ set(MAIN_HEADERS
|
|||
src/gl-meta.h
|
||||
src/vertex.h
|
||||
src/soundemitter.h
|
||||
src/security.h
|
||||
src/aldatasource.h
|
||||
src/alstream.h
|
||||
src/audiostream.h
|
||||
|
|
@ -118,6 +129,7 @@ set(MAIN_SOURCE
|
|||
src/etc.cpp
|
||||
src/config.cpp
|
||||
src/settingsmenu.cpp
|
||||
src/security.cpp
|
||||
src/keybindings.cpp
|
||||
src/tileatlas.cpp
|
||||
src/sharedstate.cpp
|
||||
|
|
@ -140,16 +152,13 @@ if(WIN32)
|
|||
list(APPEND MAIN_SOURCE assets/resources.rc)
|
||||
list(APPEND DEFINES UNICODE)
|
||||
list(APPEND PLATFORM_LIBRARIES Secur32 Shlwapi winmm z)
|
||||
#list(APPEND PLATFORM_LIBS winmm z)
|
||||
include_directories(
|
||||
${CMAKE_CURRENT_BINARY_DIR}/windows
|
||||
)
|
||||
include_directories( ${CMAKE_CURRENT_BINARY_DIR}/windows )
|
||||
elseif(APPLE)
|
||||
list(APPEND MAIN_HEADERS src/mac-desktop.h)
|
||||
list(APPEND MAIN_SOURCE src/mac-desktop.mm)
|
||||
elseif(LINUX)
|
||||
find_package(PkgConfig REQUIRED)
|
||||
pkg_check_modules(LINUXPKGS REQUIRED gtk+-3.0 libxfconf-0)
|
||||
pkg_check_modules(LINUXPKGS REQUIRED gtk+-3.0 libxfconf-0 libseccomp)
|
||||
include_directories(${LINUXPKGS_INCLUDE_DIRS})
|
||||
add_compile_options(${LINUXPKGS_CFLAGS_OTHER})
|
||||
list(APPEND PLATFORM_LIBRARIES ${LINUXPKGS_LDFLAGS})
|
||||
|
|
@ -216,12 +225,6 @@ set(EMBEDDED_INPUT
|
|||
assets/gamecontrollerdb.txt
|
||||
)
|
||||
|
||||
if (RGSS2)
|
||||
list(APPEND DEFINES
|
||||
RGSS2
|
||||
)
|
||||
endif()
|
||||
|
||||
if (MSVC)
|
||||
list(APPEND DEFINES
|
||||
_CRT_SECURE_NO_WARNINGS
|
||||
|
|
@ -321,6 +324,12 @@ add_executable(${PROJECT_NAME} MACOSX_BUNDLE WIN32
|
|||
${EMBEDDED_SOURCE}
|
||||
)
|
||||
|
||||
if(LINUX)
|
||||
pkg_check_modules(SECCOMP REQUIRED libseccomp)
|
||||
target_include_directories(${PROJECT_NAME} PRIVATE ${SECCOMP_INCLUDE_DIRS})
|
||||
target_link_libraries(${PROJECT_NAME} PRIVATE ${SECCOMP_LIBRARIES})
|
||||
endif()
|
||||
|
||||
find_package(ZLIB REQUIRED)
|
||||
find_package(SDL3 CONFIG)
|
||||
find_package(SDL3_image CONFIG)
|
||||
|
|
@ -335,11 +344,6 @@ find_package(Ruby 3.0 REQUIRED COMPONENTS Development)
|
|||
pkg_check_modules(SIGC2 REQUIRED sigc++-2.0)
|
||||
pkg_check_modules(VORBISFILE REQUIRED vorbisfile)
|
||||
find_package_handle_standard_args(pixman-1 DEFAULT_MSG PIXMAN_LIBRARY PIXMAN_INCLUDE_DIR)
|
||||
if(PIXMAN-1_FOUND)
|
||||
set(PIXMAN_LIBRARIES ${PIXMAN_LIBRARY})
|
||||
set(PIXMAN_INCLUDE_DIRS ${PIXMAN_INCLUDE_DIR})
|
||||
endif()
|
||||
|
||||
mark_as_advanced(PIXMAN_INCLUDE_DIR PIXMAN_LIBRARY)
|
||||
|
||||
target_compile_definitions(${PROJECT_NAME}
|
||||
|
|
@ -349,7 +353,7 @@ target_compile_definitions(${PROJECT_NAME}
|
|||
target_include_directories(${PROJECT_NAME}
|
||||
PRIVATE
|
||||
src
|
||||
${PIXMAN_INCLUDE_DIRS}
|
||||
${PIXMAN_INCLUDE_DIR}
|
||||
${SIGC2_INCLUDE_DIRS}
|
||||
${Ruby_INCLUDE_DIRS}
|
||||
Boost::boost ${Boost_INCLUDE_DIRS}
|
||||
|
|
@ -361,15 +365,14 @@ target_link_libraries(${PROJECT_NAME}
|
|||
SDL3::SDL3 SDL3_image::SDL3_image SDL3_sound::SDL3_sound SDL3_ttf::SDL3_ttf
|
||||
OpenAL::OpenAL
|
||||
physfs
|
||||
${PIXMAN_LIBRARIES}
|
||||
${PIXMAN_LIBRARY}
|
||||
${SIGC2_LIBRARIES}
|
||||
${PLATFORM_LIBRARIES}
|
||||
${Ruby_LIBRARIES}
|
||||
Boost::boost Boost::chrono ${Boost_LIBRARIES}
|
||||
${VORBISFILE_LIBRARIES}
|
||||
ZLIB::ZLIB
|
||||
${PLATFORM_LIBS}
|
||||
)
|
||||
${PLATFORM_LIBS})
|
||||
|
||||
IF(APPLE)
|
||||
add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD COMMAND cmake -P "${CMAKE_SOURCE_DIR}/patches/mac/CompleteBundle.cmake" VERBATIM)
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
#include <ruby.h>
|
||||
#include <SDL3/SDL_version.h>
|
||||
#include <limits.h>
|
||||
#include "security.h"
|
||||
|
||||
//Просто на C реализуем методы мне в падлу ебаться со статической линковкой и прочим дерьмом.
|
||||
//Аминь.
|
||||
|
|
@ -38,10 +39,7 @@ void SunshineBindingInit(){
|
|||
rb_const_set(module, rb_intern("SDLVersion_major"), INT2NUM(SDL_MAJOR_VERSION));
|
||||
rb_const_set(module, rb_intern("SDLVersion_minor"), INT2NUM(SDL_MINOR_VERSION));
|
||||
rb_const_set(module, rb_intern("SDLVersion_micro"), INT2NUM(SDL_MICRO_VERSION));
|
||||
|
||||
#ifdef DEBUG
|
||||
printf("[SunshineBindingInit] SDL version: %i.%i.%i\n", SDL_MAJOR_VERSION, SDL_MINOR_VERSION, SDL_MICRO_VERSION);
|
||||
#endif
|
||||
|
||||
//если методы доступны то просто не перезаписываем их
|
||||
if (!rb_respond_to(rb_cObject, rb_intern("class"))) {
|
||||
rb_define_method(rb_cObject, "class", rb_obj_class, 0);
|
||||
|
|
|
|||
|
|
@ -193,7 +193,7 @@ class Desktop_Message
|
|||
refresh
|
||||
@viewport.visible = true
|
||||
@fade_in = true
|
||||
Audio.se_play("Audio/SE/pc_messagebox.wav", (sfx_volume * 0.9).to_i, 150)
|
||||
Audio.se_play("Audio/SE/pc_messagebox.wav", (Audio.sfx_volume * 0.9).to_i, 150)
|
||||
end
|
||||
end
|
||||
|
||||
|
|
|
|||
13
src/main.cpp
13
src/main.cpp
|
|
@ -48,6 +48,7 @@
|
|||
#include "exception.h"
|
||||
#include "gl-fun.h"
|
||||
#include "i18n.h"
|
||||
#include "security.h"
|
||||
|
||||
#include "meow.h"
|
||||
|
||||
|
|
@ -56,11 +57,12 @@
|
|||
#include "icon.png.xxd"
|
||||
|
||||
#ifdef STEAM
|
||||
#include "steamshim/steamshim_child.h"
|
||||
#include "steamshim/steamshim_child.h"
|
||||
#else
|
||||
#include "gamecontrollerdb.txt.xxd"
|
||||
#include "gamecontrollerdb.txt.xxd"
|
||||
#endif
|
||||
|
||||
|
||||
static void rgssThreadError(RGSSThreadData *rtData, const std::string &msg){
|
||||
rtData->rgssErrorMsg = msg;
|
||||
rtData->ethread->requestTerminate();
|
||||
|
|
@ -211,8 +213,9 @@ static void setGamePathInRegistry() {
|
|||
#endif
|
||||
//TODO handle this for Linux/Mac
|
||||
}
|
||||
int main(int argc, char *argv[]){
|
||||
char msg[512];
|
||||
int main(int argc, char *argv[]){
|
||||
char msg[512];
|
||||
SecurityManagerInit();
|
||||
loadLanguageMetadata(); //there will be a segfault on fclose if I don't move it here
|
||||
|
||||
SDL_SetHint(SDL_HINT_VIDEO_MINIMIZE_ON_FOCUS_LOSS, "0");
|
||||
|
|
@ -227,7 +230,7 @@ int main(int argc, char *argv[]){
|
|||
SDL_SetHint(SDL_HINT_VIDEO_X11_ENABLE_XSYNC_EXT, "1");
|
||||
#endif
|
||||
#endif
|
||||
|
||||
|
||||
/* initialize SDL first */
|
||||
if (SDL_Init(SDL_INIT_VIDEO | SDL_INIT_JOYSTICK | SDL_INIT_GAMEPAD) == false){
|
||||
SDL_snprintf(msg, sizeof msg, "Error initializing SDL: %s", SDL_GetError());
|
||||
|
|
|
|||
45
src/security.cpp
Normal file
45
src/security.cpp
Normal file
|
|
@ -0,0 +1,45 @@
|
|||
// https://github.com/moby/profiles/blob/main/seccomp/default.json
|
||||
#include "security.h"
|
||||
#include "meow.h"
|
||||
#include <stdio.h>
|
||||
|
||||
#ifdef __linux__
|
||||
#include <seccomp.h>
|
||||
//shitty shit
|
||||
scmp_filter_ctx ctx;
|
||||
int seccomplist[] = {SCMP_SYS(bpf), SCMP_SYS(set_mempolicy), SCMP_SYS(set_mempolicy_home_node), SCMP_SYS(vhangup), SCMP_SYS(settimeofday), SCMP_SYS(stime), SCMP_SYS(clock_settime), SCMP_SYS(clock_settime64),
|
||||
SCMP_SYS(iopl), SCMP_SYS(ioperm), SCMP_SYS(ptrace), SCMP_SYS(process_vm_writev), SCMP_SYS(process_vm_readv), SCMP_SYS(process_madvise), SCMP_SYS(pidfd_getfd), SCMP_SYS(kcmp),
|
||||
SCMP_SYS(delete_module), SCMP_SYS(init_module), SCMP_SYS(init_module), SCMP_SYS(chroot), SCMP_SYS(reboot), SCMP_SYS(unshare), SCMP_SYS(umount2), SCMP_SYS(umount), SCMP_SYS(setns), SCMP_SYS(sethostname), SCMP_SYS(setdomainname), SCMP_SYS(bpf), SCMP_SYS(quotactl_fd), SCMP_SYS(quotactl),
|
||||
SCMP_SYS(move_mount), SCMP_SYS(mount_setattr), SCMP_SYS(mount), SCMP_SYS(lsm_set_self_attr), SCMP_SYS(lsm_list_modules), SCMP_SYS(lsm_get_self_attr), SCMP_SYS(process_vm_readv), SCMP_SYS(process_vm_writev), SCMP_SYS(ptrace)};
|
||||
|
||||
char ro_paths[] = {"/"};
|
||||
#endif
|
||||
|
||||
void SecurityManagerInit(){
|
||||
printf("[SECURITY] Initializing SecurityEngine...\n");
|
||||
#ifdef __linux__
|
||||
printf("[SECURITY] initializing SECCOMP filter...\n");
|
||||
ctx = seccomp_init(SCMP_ACT_ALLOW); // Default action: Kill the process
|
||||
if(ctx == NULL) {
|
||||
WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!");
|
||||
}else{
|
||||
int n = sizeof(seccomplist) / sizeof(seccomplist[0]);
|
||||
for(int i = 0; i < n; ++i){
|
||||
if(seccomp_rule_add(ctx, SCMP_ACT_KILL, seccomplist[i], 0) < 0) {
|
||||
printf("seccomp_rule_add failed for %i", seccomplist[i]);
|
||||
}
|
||||
}
|
||||
|
||||
if(seccomp_load(ctx) < 0) {
|
||||
WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!");
|
||||
seccomp_release(ctx);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
void SecurityManagerDeInit(){
|
||||
#ifdef __linux__
|
||||
seccomp_release(ctx);
|
||||
#endif
|
||||
}
|
||||
2
src/security.h
Normal file
2
src/security.h
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
void SecurityManagerInit();
|
||||
void SecurityManagerDeInit();
|
||||
|
|
@ -28,6 +28,8 @@
|
|||
#include "xdg-user-dir-lookup.h"
|
||||
|
||||
#include <SDL3/SDL_stdinc.h>
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
/**
|
||||
* xdg_user_dir_lookup_with_fallback:
|
||||
* @type: a string specifying the type of directory
|
||||
|
|
@ -65,7 +67,7 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback
|
|||
if (config_file == NULL)
|
||||
goto error;
|
||||
|
||||
SDL_strcpy(config_file, home_dir);
|
||||
SDL_strlcpy(config_file, home_dir, sizeof(config_file));
|
||||
SDL_strlcat(config_file, "/.config/user-dirs.dirs", sizeof(config_file) + 22);
|
||||
}
|
||||
else{
|
||||
|
|
@ -73,8 +75,8 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback
|
|||
if (config_file == NULL)
|
||||
goto error;
|
||||
|
||||
SDL_strcpy(config_file, config_home);
|
||||
SDL_strcat(config_file, "/user-dirs.dirs", sizeof(config_file) + 16);
|
||||
SDL_strlcpy(config_file, config_home, sizeof(config_file));
|
||||
SDL_strlcat(config_file, "/user-dirs.dirs", sizeof(config_file) + 16);
|
||||
}
|
||||
|
||||
file = fopen(config_file, "r");
|
||||
|
|
@ -130,7 +132,7 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback
|
|||
if (user_dir == NULL)
|
||||
goto error2;
|
||||
|
||||
SDL_strcpy(user_dir, home_dir);
|
||||
SDL_strlcpy(user_dir, home_dir, sizeof(user_dir));
|
||||
SDL_strlcat(user_dir, "/", sizeof(user_dir) + 2);
|
||||
}
|
||||
else{
|
||||
|
|
@ -196,7 +198,7 @@ char *xdg_user_dir_lookup (const char *type){
|
|||
if (user_dir == NULL)
|
||||
return NULL;
|
||||
|
||||
SDL_strcpy(user_dir, home_dir);
|
||||
SDL_strlcpy(user_dir, home_dir, sizeof(user_dir));
|
||||
SDL_strlcat(user_dir, "/Desktop", sizeof(user_dir) + 9);
|
||||
return user_dir;
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue