diff --git a/CMakeLists.txt b/CMakeLists.txt index 6855a5e..6f5f396 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -7,16 +7,17 @@ include(FindPackageHandleStandardArgs) option(STEAM "Build for Steam" OFF) set(STEAMWORKS_PATH "${CMAKE_CURRENT_SOURCE_DIR}/steamworks" CACHE PATH "Path to Steamworks folder") option(DEBUG "Debug mode" ON) -set(SDLTTF_VENDORED ON) +#For paranoics:3 +option(EXTRA_SECURITY "Extra security" OFF) set(ZLIB_USE_STATIC_LIBS ON) set(CMAKE_INCLUDE_CURRENT_DIR ON) if(DEBUG) # Debug stuff if (MSVC) - add_compile_options(/EHr /fsanitize /validate-charset /DEBUG /RTCu /RTCs /RTCc /guard:cf /GS) + add_compile_options(/EHr /fsanitize /validate-charset /DEBUG /RTCu /RTCs /RTCc) else() - add_compile_options(-g3 -O0 -fno-omit-frame-pointer -ggdb -Wall -fcheck-new -gbtf -pipe) + add_compile_options(-g3 -O0 -fno-omit-frame-pointer -ggdb -fcheck-new -gbtf -pipe) endif() else() # Optimization stuff @@ -27,6 +28,15 @@ else() add_link_options(-Wl,-O2) endif() endif() + +if(EXTRA_SECURITY) + if (MSVC) + add_compile_options(/guard:cf /GS /sdl /DYNAMICBASE /HIGHENTROPYVA /SAFESEH /guard:ehcont) + else() + add_compile_options(-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstrict-flex-arrays=3 -fstack-clash-protection -fstack-protector-strong -Wl,--no-copy-dt-needed-entries -fPIE -pie) + endif() +endif() + ## Setup main source ## # main stuff @@ -78,6 +88,7 @@ set(MAIN_HEADERS src/gl-meta.h src/vertex.h src/soundemitter.h + src/security.h src/aldatasource.h src/alstream.h src/audiostream.h @@ -118,6 +129,7 @@ set(MAIN_SOURCE src/etc.cpp src/config.cpp src/settingsmenu.cpp + src/security.cpp src/keybindings.cpp src/tileatlas.cpp src/sharedstate.cpp @@ -140,16 +152,13 @@ if(WIN32) list(APPEND MAIN_SOURCE assets/resources.rc) list(APPEND DEFINES UNICODE) list(APPEND PLATFORM_LIBRARIES Secur32 Shlwapi winmm z) - #list(APPEND PLATFORM_LIBS winmm z) - include_directories( - ${CMAKE_CURRENT_BINARY_DIR}/windows - ) + include_directories( ${CMAKE_CURRENT_BINARY_DIR}/windows ) elseif(APPLE) list(APPEND MAIN_HEADERS src/mac-desktop.h) list(APPEND MAIN_SOURCE src/mac-desktop.mm) elseif(LINUX) find_package(PkgConfig REQUIRED) - pkg_check_modules(LINUXPKGS REQUIRED gtk+-3.0 libxfconf-0) + pkg_check_modules(LINUXPKGS REQUIRED gtk+-3.0 libxfconf-0 libseccomp) include_directories(${LINUXPKGS_INCLUDE_DIRS}) add_compile_options(${LINUXPKGS_CFLAGS_OTHER}) list(APPEND PLATFORM_LIBRARIES ${LINUXPKGS_LDFLAGS}) @@ -216,12 +225,6 @@ set(EMBEDDED_INPUT assets/gamecontrollerdb.txt ) -if (RGSS2) - list(APPEND DEFINES - RGSS2 - ) -endif() - if (MSVC) list(APPEND DEFINES _CRT_SECURE_NO_WARNINGS @@ -321,6 +324,12 @@ add_executable(${PROJECT_NAME} MACOSX_BUNDLE WIN32 ${EMBEDDED_SOURCE} ) +if(LINUX) + pkg_check_modules(SECCOMP REQUIRED libseccomp) + target_include_directories(${PROJECT_NAME} PRIVATE ${SECCOMP_INCLUDE_DIRS}) + target_link_libraries(${PROJECT_NAME} PRIVATE ${SECCOMP_LIBRARIES}) +endif() + find_package(ZLIB REQUIRED) find_package(SDL3 CONFIG) find_package(SDL3_image CONFIG) @@ -335,11 +344,6 @@ find_package(Ruby 3.0 REQUIRED COMPONENTS Development) pkg_check_modules(SIGC2 REQUIRED sigc++-2.0) pkg_check_modules(VORBISFILE REQUIRED vorbisfile) find_package_handle_standard_args(pixman-1 DEFAULT_MSG PIXMAN_LIBRARY PIXMAN_INCLUDE_DIR) -if(PIXMAN-1_FOUND) - set(PIXMAN_LIBRARIES ${PIXMAN_LIBRARY}) - set(PIXMAN_INCLUDE_DIRS ${PIXMAN_INCLUDE_DIR}) -endif() - mark_as_advanced(PIXMAN_INCLUDE_DIR PIXMAN_LIBRARY) target_compile_definitions(${PROJECT_NAME} @@ -349,7 +353,7 @@ target_compile_definitions(${PROJECT_NAME} target_include_directories(${PROJECT_NAME} PRIVATE src - ${PIXMAN_INCLUDE_DIRS} + ${PIXMAN_INCLUDE_DIR} ${SIGC2_INCLUDE_DIRS} ${Ruby_INCLUDE_DIRS} Boost::boost ${Boost_INCLUDE_DIRS} @@ -361,15 +365,14 @@ target_link_libraries(${PROJECT_NAME} SDL3::SDL3 SDL3_image::SDL3_image SDL3_sound::SDL3_sound SDL3_ttf::SDL3_ttf OpenAL::OpenAL physfs - ${PIXMAN_LIBRARIES} + ${PIXMAN_LIBRARY} ${SIGC2_LIBRARIES} ${PLATFORM_LIBRARIES} ${Ruby_LIBRARIES} Boost::boost Boost::chrono ${Boost_LIBRARIES} ${VORBISFILE_LIBRARIES} ZLIB::ZLIB - ${PLATFORM_LIBS} - ) + ${PLATFORM_LIBS}) IF(APPLE) add_custom_command(TARGET ${PROJECT_NAME} POST_BUILD COMMAND cmake -P "${CMAKE_SOURCE_DIR}/patches/mac/CompleteBundle.cmake" VERBATIM) diff --git a/binding-mri/sunshine-binding.cpp b/binding-mri/sunshine-binding.cpp index 5edfc8e..88aca3f 100644 --- a/binding-mri/sunshine-binding.cpp +++ b/binding-mri/sunshine-binding.cpp @@ -1,6 +1,7 @@ #include #include #include +#include "security.h" //Просто на C реализуем методы мне в падлу ебаться со статической линковкой и прочим дерьмом. //Аминь. @@ -38,10 +39,7 @@ void SunshineBindingInit(){ rb_const_set(module, rb_intern("SDLVersion_major"), INT2NUM(SDL_MAJOR_VERSION)); rb_const_set(module, rb_intern("SDLVersion_minor"), INT2NUM(SDL_MINOR_VERSION)); rb_const_set(module, rb_intern("SDLVersion_micro"), INT2NUM(SDL_MICRO_VERSION)); - - #ifdef DEBUG - printf("[SunshineBindingInit] SDL version: %i.%i.%i\n", SDL_MAJOR_VERSION, SDL_MINOR_VERSION, SDL_MICRO_VERSION); - #endif + //если методы доступны то просто не перезаписываем их if (!rb_respond_to(rb_cObject, rb_intern("class"))) { rb_define_method(rb_cObject, "class", rb_obj_class, 0); diff --git a/scripts/Desktop_Message.rb b/scripts/Desktop_Message.rb index 9c1ebae..21bfbe5 100644 --- a/scripts/Desktop_Message.rb +++ b/scripts/Desktop_Message.rb @@ -193,7 +193,7 @@ class Desktop_Message refresh @viewport.visible = true @fade_in = true - Audio.se_play("Audio/SE/pc_messagebox.wav", (sfx_volume * 0.9).to_i, 150) + Audio.se_play("Audio/SE/pc_messagebox.wav", (Audio.sfx_volume * 0.9).to_i, 150) end end diff --git a/src/main.cpp b/src/main.cpp index e999e1c..d2fdb95 100644 --- a/src/main.cpp +++ b/src/main.cpp @@ -48,6 +48,7 @@ #include "exception.h" #include "gl-fun.h" #include "i18n.h" +#include "security.h" #include "meow.h" @@ -56,11 +57,12 @@ #include "icon.png.xxd" #ifdef STEAM -#include "steamshim/steamshim_child.h" + #include "steamshim/steamshim_child.h" #else -#include "gamecontrollerdb.txt.xxd" + #include "gamecontrollerdb.txt.xxd" #endif + static void rgssThreadError(RGSSThreadData *rtData, const std::string &msg){ rtData->rgssErrorMsg = msg; rtData->ethread->requestTerminate(); @@ -211,8 +213,9 @@ static void setGamePathInRegistry() { #endif //TODO handle this for Linux/Mac } -int main(int argc, char *argv[]){ - char msg[512]; +int main(int argc, char *argv[]){ + char msg[512]; + SecurityManagerInit(); loadLanguageMetadata(); //there will be a segfault on fclose if I don't move it here SDL_SetHint(SDL_HINT_VIDEO_MINIMIZE_ON_FOCUS_LOSS, "0"); @@ -227,7 +230,7 @@ int main(int argc, char *argv[]){ SDL_SetHint(SDL_HINT_VIDEO_X11_ENABLE_XSYNC_EXT, "1"); #endif #endif - + /* initialize SDL first */ if (SDL_Init(SDL_INIT_VIDEO | SDL_INIT_JOYSTICK | SDL_INIT_GAMEPAD) == false){ SDL_snprintf(msg, sizeof msg, "Error initializing SDL: %s", SDL_GetError()); diff --git a/src/security.cpp b/src/security.cpp new file mode 100644 index 0000000..a27f4c8 --- /dev/null +++ b/src/security.cpp @@ -0,0 +1,45 @@ +// https://github.com/moby/profiles/blob/main/seccomp/default.json +#include "security.h" +#include "meow.h" +#include + +#ifdef __linux__ + #include + //shitty shit + scmp_filter_ctx ctx; + int seccomplist[] = {SCMP_SYS(bpf), SCMP_SYS(set_mempolicy), SCMP_SYS(set_mempolicy_home_node), SCMP_SYS(vhangup), SCMP_SYS(settimeofday), SCMP_SYS(stime), SCMP_SYS(clock_settime), SCMP_SYS(clock_settime64), + SCMP_SYS(iopl), SCMP_SYS(ioperm), SCMP_SYS(ptrace), SCMP_SYS(process_vm_writev), SCMP_SYS(process_vm_readv), SCMP_SYS(process_madvise), SCMP_SYS(pidfd_getfd), SCMP_SYS(kcmp), + SCMP_SYS(delete_module), SCMP_SYS(init_module), SCMP_SYS(init_module), SCMP_SYS(chroot), SCMP_SYS(reboot), SCMP_SYS(unshare), SCMP_SYS(umount2), SCMP_SYS(umount), SCMP_SYS(setns), SCMP_SYS(sethostname), SCMP_SYS(setdomainname), SCMP_SYS(bpf), SCMP_SYS(quotactl_fd), SCMP_SYS(quotactl), + SCMP_SYS(move_mount), SCMP_SYS(mount_setattr), SCMP_SYS(mount), SCMP_SYS(lsm_set_self_attr), SCMP_SYS(lsm_list_modules), SCMP_SYS(lsm_get_self_attr), SCMP_SYS(process_vm_readv), SCMP_SYS(process_vm_writev), SCMP_SYS(ptrace)}; + + char ro_paths[] = {"/"}; +#endif + +void SecurityManagerInit(){ + printf("[SECURITY] Initializing SecurityEngine...\n"); + #ifdef __linux__ + printf("[SECURITY] initializing SECCOMP filter...\n"); + ctx = seccomp_init(SCMP_ACT_ALLOW); // Default action: Kill the process + if(ctx == NULL) { + WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!"); + }else{ + int n = sizeof(seccomplist) / sizeof(seccomplist[0]); + for(int i = 0; i < n; ++i){ + if(seccomp_rule_add(ctx, SCMP_ACT_KILL, seccomplist[i], 0) < 0) { + printf("seccomp_rule_add failed for %i", seccomplist[i]); + } + } + + if(seccomp_load(ctx) < 0) { + WarnMsg("Warning: Failed to load SECCOMP! If you receive this warning, IT IS NOT RECOMMENDED to add any third-party modifications to Sunshine!"); + seccomp_release(ctx); + } + } + #endif +} + +void SecurityManagerDeInit(){ + #ifdef __linux__ + seccomp_release(ctx); + #endif +} diff --git a/src/security.h b/src/security.h new file mode 100644 index 0000000..ec45550 --- /dev/null +++ b/src/security.h @@ -0,0 +1,2 @@ +void SecurityManagerInit(); +void SecurityManagerDeInit(); diff --git a/src/xdg-user-dir-lookup.c b/src/xdg-user-dir-lookup.c index a521556..88b7b2d 100644 --- a/src/xdg-user-dir-lookup.c +++ b/src/xdg-user-dir-lookup.c @@ -28,6 +28,8 @@ #include "xdg-user-dir-lookup.h" #include +#include +#include /** * xdg_user_dir_lookup_with_fallback: * @type: a string specifying the type of directory @@ -65,7 +67,7 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback if (config_file == NULL) goto error; - SDL_strcpy(config_file, home_dir); + SDL_strlcpy(config_file, home_dir, sizeof(config_file)); SDL_strlcat(config_file, "/.config/user-dirs.dirs", sizeof(config_file) + 22); } else{ @@ -73,8 +75,8 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback if (config_file == NULL) goto error; - SDL_strcpy(config_file, config_home); - SDL_strcat(config_file, "/user-dirs.dirs", sizeof(config_file) + 16); + SDL_strlcpy(config_file, config_home, sizeof(config_file)); + SDL_strlcat(config_file, "/user-dirs.dirs", sizeof(config_file) + 16); } file = fopen(config_file, "r"); @@ -130,7 +132,7 @@ char * xdg_user_dir_lookup_with_fallback (const char *type, const char *fallback if (user_dir == NULL) goto error2; - SDL_strcpy(user_dir, home_dir); + SDL_strlcpy(user_dir, home_dir, sizeof(user_dir)); SDL_strlcat(user_dir, "/", sizeof(user_dir) + 2); } else{ @@ -196,7 +198,7 @@ char *xdg_user_dir_lookup (const char *type){ if (user_dir == NULL) return NULL; - SDL_strcpy(user_dir, home_dir); + SDL_strlcpy(user_dir, home_dir, sizeof(user_dir)); SDL_strlcat(user_dir, "/Desktop", sizeof(user_dir) + 9); return user_dir; }