fix: pick the Fix for Security Issues

grub2/grub2_ifc.go

@@ -6,7 +6,6 @@ package grub2
 
 import (
 	"errors"
-	"os"
 	"strings"
 
 	"github.com/godbus/dbus/v5"
@@ -316,7 +315,7 @@ func (g *Grub2) PrepareGfxmodeDetect(sender dbus.Sender) *dbus.Error {
 
 	g.addModifyTask(getModifyTaskPrepareGfxmodeDetect(gfxmodesStr))
 
-	err = os.WriteFile(grub_common.GfxmodeDetectReadyPath, nil, 0644)
+	err = grub_common.CreateGfxmodeDetectReady()
 	if err != nil {
 		return dbusutil.ToError(err)
 	}

grub2/main.go

@@ -81,7 +81,7 @@ func PrepareGfxmodeDetect() error {
 	gfxmodesStr := joinGfxmodesForDetect(gfxmodes)
 	getModifyFuncPrepareGfxmodeDetect(gfxmodesStr)(params)
 
-	err = os.WriteFile(grub_common.GfxmodeDetectReadyPath, nil, 0644)
+	err = grub_common.CreateGfxmodeDetectReady()
 	if err != nil {
 		return err
 	}

grub2/theme_ifc.go

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
@@ -8,13 +8,11 @@ import (
 	"os"
 	"os/exec"
 	"path"
-	"path/filepath"
 	"strings"
 
 	"github.com/godbus/dbus/v5"
 	"github.com/linuxdeepin/go-lib/dbusutil"
 	"github.com/linuxdeepin/go-lib/utils"
-	dutils "github.com/linuxdeepin/go-lib/utils"
 )
 
 const (
@@ -79,19 +77,35 @@ func (theme *Theme) GetBackground(sender dbus.Sender) (background string, busErr
 
 	if len(background) == 0 {
 		return "", nil
-	} else {
+	}
 
-		tmpBackground := "dde-grub-background" + path.Ext(defaultGrubBackground)
-		backGroundTmpPath := filepath.Join("/tmp", tmpBackground)
-		//copy file to /tmp
-		err := dutils.CopyFile(background, backGroundTmpPath)
-		if err != nil {
-			return "", dbusutil.ToError(err)
-		}
-		logger.Debugf("Copy file %s to %s", background, backGroundTmpPath)
+	ext := path.Ext(background)
+	backGroundTmpFile, err := os.CreateTemp("/tmp", "dde-grub-background-*"+ext)
+	if err != nil {
+		return "", dbusutil.ToError(err)
+	}
 
-		return backGroundTmpPath, nil
+	backGroundTmpPath := backGroundTmpFile.Name()
+	backGroundTmpFile.Close()
+
+	err = utils.CopyFile(background, backGroundTmpPath)
+	if err != nil {
+		logger.Warningf("GetBackground: copy %q to %q failed: %v", background, backGroundTmpPath, err)
+		_ = os.Remove(backGroundTmpPath)
+		return "", dbusutil.ToError(err)
+	}
+
+	err = os.Chmod(backGroundTmpPath, 0644)
+	if err != nil {
+		logger.Warningf("GetBackground: chmod %q 0644 failed: %v", backGroundTmpPath, err)
+		_ = os.Remove(backGroundTmpPath)
+		return "", dbusutil.ToError(err)
 	}
+	logger.Debugf("Copy file %s to %s", background, backGroundTmpPath)
+
+	// 已知问题：返回的临时文件由调用方使用，本服务不清理。每次调用产生一个
+	// 唯一命名的新文件，重复调用会在 /tmp 中累积（依赖重启清空 tmpfs）。
+	return backGroundTmpPath, nil
 }
 
 func (theme *Theme) emitSignalBackgroundChanged() {

grub_common/common.go

@@ -28,7 +28,7 @@ var logger = log.NewLogger("grub_common")
 const (
 	GrubParamsFile            = "/etc/default/grub"
 	DDEGrubParamsFile         = "/etc/default/grub.d/11_dde.cfg"
-	GfxmodeDetectReadyPath    = "/tmp/deepin-gfxmode-detect-ready"
+	GfxmodeDetectReadyPath    = "/run/deepin-gfxmode-detect/ready"
 	DeepinGfxmodeDetect       = "DEEPIN_GFXMODE_DETECT"
 	DeepinGfxmodeAdjusted     = "DEEPIN_GFXMODE_ADJUSTED"
 	DeepinGfxmodeNotSupported = "DEEPIN_GFXMODE_NOT_SUPPORTED"
@@ -265,6 +265,21 @@ func (v Gfxmodes) SortDesc() {
 	sort.Sort(sort.Reverse(v))
 }
 
+// CreateGfxmodeDetectReady 创建 gfxmode 探测完成信号文件。
+//
+// MkdirAll 兜底 unit 外调用（如 postinst 的 `grub2 -prepare-gfxmode-detect`）——此时无
+// RuntimeDirectory 托管父目录；服务内调用时父目录已由 systemd 建好，MkdirAll 为 no-op。
+func CreateGfxmodeDetectReady() error {
+	dir := filepath.Dir(GfxmodeDetectReadyPath)
+	if err := os.MkdirAll(dir, 0755); err != nil {
+		return fmt.Errorf("failed to mkdir %s: %w", dir, err)
+	}
+	if err := os.WriteFile(GfxmodeDetectReadyPath, nil, 0644); err != nil {
+		return fmt.Errorf("failed to create %s: %w", GfxmodeDetectReadyPath, err)
+	}
+	return nil
+}
+
 func ShouldFinishGfxmodeDetect(params map[string]string) bool {
 	if params[DeepinGfxmodeDetect] == "1" {
 		_, err := os.Stat(GfxmodeDetectReadyPath)

misc/polkit-rules/org.deepin.dde.uadp.rules

@@ -0,0 +1,17 @@
+polkit.addRule(function(action, subject) {
+    if (action.id === "org.deepin.dde.uadp.doAction") {
+        // lightdm 活跃会话放行（greeter 免密码调用）
+        if (subject.user === "lightdm") {
+            if (subject.active) {
+                return polkit.Result.YES;
+            } else {
+                return polkit.Result.NO;
+            }
+        }
+
+        // deepin-daemon 用户及组放行
+        if (subject.user === "deepin-daemon" || subject.isInGroup("deepin-daemon")) {
+            return polkit.Result.YES;
+        }
+    }
+});

misc/systemd/services/system/deepin-grub2.service

@@ -16,7 +16,9 @@ InaccessiblePaths=-/etc/pam.d
 #InaccessiblePaths=-/usr/share/uadp/
 # 创建/etc/default/grub.d/11_dde.cfg
 ReadWritePaths=-/etc/default/grub.d
-# 创建/tmp/deepin-gfxmode-detect-ready // TODO分析该文件是否有被其他进程使用，该文件存放需要修改
+# /run/deepin-gfxmode-detect/ready，作为 gfxmode 探测完成信号文件
+RuntimeDirectory=deepin-gfxmode-detect
+RuntimeDirectoryPreserve=yes
 ReadWritePaths=-/tmp/
 # /var/cache/deepin/grub2.log
 ReadWritePaths=-/var/cache/deepin

system/uadp1/manager.go

@@ -1,11 +1,14 @@
-// SPDX-FileCopyrightText: 2018 - 2022 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2018 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: GPL-3.0-or-later
 
 package uadp
 
 import (
-	"github.com/godbus/dbus/v5"
+	"errors"
+
+	dbus "github.com/godbus/dbus/v5"
+	polkit "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.policykit1"
 	"github.com/linuxdeepin/go-lib/dbusutil"
 	"github.com/linuxdeepin/go-lib/procfs"
 )
@@ -16,6 +19,28 @@ import (
 const uadpEncryptMaxSize = 256 - 11
 const uadpDecryptMaxSize = 256
 
+const uadpActionId = "org.deepin.dde.uadp.doAction"
+
+func checkAuthorization(actionId string, sysBusName string) error {
+	systemBus, err := dbus.SystemBus()
+	if err != nil {
+		return err
+	}
+	authority := polkit.NewAuthority(systemBus)
+	subject := polkit.MakeSubject(polkit.SubjectKindSystemBusName)
+	subject.SetDetail("name", sysBusName)
+
+	ret, err := authority.CheckAuthorization(0, subject, actionId,
+		nil, polkit.CheckAuthorizationFlagsAllowUserInteraction, "")
+	if err != nil {
+		return err
+	}
+	if !ret.IsAuthorized {
+		return errors.New("not authorized")
+	}
+	return nil
+}
+
 type Manager struct {
 	service *dbusutil.Service
 
@@ -60,6 +85,12 @@ func (m *Manager) Available() (bool, *dbus.Error) {
 }
 
 func (m *Manager) ListName(sender dbus.Sender) ([]string, *dbus.Error) {
+	err := checkAuthorization(uadpActionId, string(sender))
+	if err != nil {
+		logger.Warning(err)
+		return []string{}, dbusutil.ToError(err)
+	}
+
 	exec, err := m.getExecPath(sender)
 	if err != nil {
 		logger.Warning(err)
@@ -70,6 +101,12 @@ func (m *Manager) ListName(sender dbus.Sender) ([]string, *dbus.Error) {
 }
 
 func (m *Manager) Set(sender dbus.Sender, name string, data []byte) *dbus.Error {
+	err := checkAuthorization(uadpActionId, string(sender))
+	if err != nil {
+		logger.Warning(err)
+		return dbusutil.ToError(err)
+	}
+
 	exec, err := m.getExecPath(sender)
 	if err != nil {
 		logger.Warning(err)
@@ -102,6 +139,12 @@ func (m *Manager) Set(sender dbus.Sender, name string, data []byte) *dbus.Error
 }
 
 func (m *Manager) Get(sender dbus.Sender, name string) ([]byte, *dbus.Error) {
+	err := checkAuthorization(uadpActionId, string(sender))
+	if err != nil {
+		logger.Warning(err)
+		return []byte{}, dbusutil.ToError(err)
+	}
+
 	exec, err := m.getExecPath(sender)
 	if err != nil {
 		logger.Warning(err)
@@ -123,6 +166,12 @@ func (m *Manager) Get(sender dbus.Sender, name string) ([]byte, *dbus.Error) {
 }
 
 func (m *Manager) Delete(sender dbus.Sender, name string) *dbus.Error {
+	err := checkAuthorization(uadpActionId, string(sender))
+	if err != nil {
+		logger.Warning(err)
+		return dbusutil.ToError(err)
+	}
+
 	exec, err := m.getExecPath(sender)
 	if err != nil {
 		logger.Warning(err)
@@ -140,6 +189,12 @@ func (m *Manager) Delete(sender dbus.Sender, name string) *dbus.Error {
 }
 
 func (m *Manager) Release(sender dbus.Sender) *dbus.Error {
+	err := checkAuthorization(uadpActionId, string(sender))
+	if err != nil {
+		logger.Warning(err)
+		return dbusutil.ToError(err)
+	}
+
 	exec, err := m.getExecPath(sender)
 	if err != nil {
 		logger.Warning(err)