feat: dde-api安全整改，音效服务用户改成deepin-daemon

fly602 · fly602 · commit ba193da5442b · 2025-08-14T14:10:57.000+08:00
/lib/systemd/system/deepin-sound-theme-player.service User不应该再使用deepin-sound-player

Log: dde-api安全整改
PMS: TASK-369021
diff --git a/archlinux/deepin-api.install b/archlinux/deepin-api.install
diff --git a/archlinux/deepin-api.sysusers b/archlinux/deepin-api.sysusers
diff --git a/debian/dde-api.postinst b/debian/dde-api.postinst
@@ -3,9 +3,6 @@
 
 set -e
 
-player_user=deepin-sound-player
-player_home=/var/lib/$player_user
-
 themeDir="/boot/grub/themes/deepin"
 fallbackThemeDir=$themeDir-fallback
 adjustGrubThemeBin="/usr/lib/deepin-api/adjust-grub-theme"
@@ -45,17 +42,6 @@ adjustGrubTheme () {
 
 case "$1" in
     configure)
-        if ! getent group $player_user >/dev/null; then
-            addgroup --quiet --system $player_user
-        fi
-        if ! getent passwd $player_user >/dev/null; then
-            adduser --quiet --system --ingroup $player_user --home $player_home $player_user
-            adduser --quiet $player_user audio
-        fi
-
-        runuser -u $player_user -- mkdir -p $player_home/.config/pulse
-        runuser - deepin-sound-player -s /bin/sh -c "echo 'autospawn = no' > $player_home/.config/pulse/client.conf"
-
         adjustGrubTheme
         setupFallbackTheme
     ;;
diff --git a/debian/dde-api.postrm b/debian/dde-api.postrm
diff --git a/misc/conf/org.deepin.dde.SoundThemePlayer1.conf b/misc/conf/org.deepin.dde.SoundThemePlayer1.conf
@@ -5,8 +5,8 @@
  "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
 <busconfig>
 
-  <!-- Only user deepin-sound-player can own the service -->
-  <policy user="deepin-sound-player">
+  <!-- Only user deepin-daemon can own the service -->
+  <policy user="deepin-daemon">
     <allow own="org.deepin.dde.SoundThemePlayer1"/>
   </policy>
 
diff --git a/misc/system-services/org.deepin.dde.SoundThemePlayer1.service b/misc/system-services/org.deepin.dde.SoundThemePlayer1.service
@@ -1,5 +1,5 @@
 [D-BUS Service]
 Name=org.deepin.dde.SoundThemePlayer1
 Exec=/usr/lib/deepin-api/sound-theme-player
-User=deepin-sound-player
+User=deepin-daemon
 SystemdService=dbus-org.deepin.dde.SoundThemePlayer1.service
diff --git a/misc/systemd/system/deepin-api-device.service b/misc/systemd/system/deepin-api-device.service
@@ -17,23 +17,32 @@ ExecStart=/usr/lib/deepin-api/device
 DeviceAllow=/dev/rfkill rw
 DevicePolicy=closed
 
-ProtectSystem=full
+ProtectSystem=strict
+
+InaccessiblePaths=/etc/shadow
+InaccessiblePaths=-/etc/NetworkManager/system-connections
+InaccessiblePaths=-/etc/pam.d
+InaccessiblePaths=-/usr/share/uadp/
+
+NoNewPrivileges=yes
 ProtectHome=yes
-PrivateTmp=yes
-#PrivateDevices=yes
-PrivateNetwork=yes
-ProtectHostname=yes
-ProtectClock=yes
 ProtectKernelTunables=yes
 ProtectKernelModules=yes
-ProtectKernelLogs=yes
 ProtectControlGroups=yes
-RestrictAddressFamilies=AF_UNIX
+PrivateMounts=yes
+PrivateTmp=yes
+# 需要操作rfkill
+#PrivateDevices=yes
+PrivateNetwork=yes
+# 需要读取/proc的exe字段数据
+#PrivateUsers=yes
 RestrictNamespaces=yes
 LockPersonality=yes
 RestrictRealtime=yes
-RestrictSUIDSGID=yes
 RemoveIPC=yes
+# 和golang -pie参数冲突，导致进程无法启动
+#MemoryDenyWriteExecute=yes
+MemoryLimit=100M
 
 [Install]
 Alias=dbus-org.deepin.dde.Device1.service
diff --git a/misc/systemd/system/deepin-login-sound.service b/misc/systemd/system/deepin-login-sound.service
@@ -5,7 +5,8 @@ After=dbus.service lightdm.service
 
 [Service]
 Type=oneshot
-User=deepin-sound-player
+User=deepin-daemon
+Environment=HOME=/var/lib/deepin-sound-player
 ExecStart=/usr/bin/dbus-send --system --print-reply --dest=org.deepin.dde.SoundThemePlayer1 /org/deepin/dde/SoundThemePlayer1 org.deepin.dde.SoundThemePlayer1.PlaySoundDesktopLogin
 RemainAfterExit=yes
 
@@ -28,3 +29,6 @@ LockPersonality=yes
 RestrictRealtime=yes
 RestrictSUIDSGID=yes
 RemoveIPC=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/misc/systemd/system/deepin-shutdown-sound.service b/misc/systemd/system/deepin-shutdown-sound.service
@@ -7,13 +7,14 @@ Before=shutdown.target
 
 [Service]
 Type=simple
-User=deepin-sound-player
+User=deepin-daemon
+Environment=HOME=/var/lib/deepin-sound-player
 ExecStart=/usr/bin/true
 ExecStop=/usr/lib/deepin-api/deepin-shutdown-sound
 RemainAfterExit=yes
 TimeoutStopSec=7s
 
-ReadOnlyPaths=/var/lib/deepin-sound-player
+StateDirectory=deepin-sound-player
 BindReadOnlyPaths=-/tmp/deepin-shutdown-sound.json
 
 DeviceAllow=char-alsa rw
@@ -36,3 +37,6 @@ LockPersonality=yes
 RestrictRealtime=yes
 RestrictSUIDSGID=yes
 RemoveIPC=yes
+
+[Install]
+WantedBy=graphical.target
diff --git a/misc/systemd/system/deepin-sound-theme-player.service b/misc/systemd/system/deepin-sound-theme-player.service
@@ -11,7 +11,8 @@ After=dbus.socket
 [Service]
 Type=dbus
 BusName=org.deepin.dde.SoundThemePlayer1
-User=deepin-sound-player
+User=deepin-daemon
+Environment=HOME=/var/lib/deepin-sound-player
 ExecStart=/usr/lib/deepin-api/sound-theme-player
 
 StateDirectory=deepin-sound-player
diff --git a/rpm/dde-api.spec b/rpm/dde-api.spec
@@ -88,15 +88,15 @@ for file in $(find . -iname "*.go" -o -iname "*.c" -o -iname "*.h" -o -iname "*.
     echo "%{gopath}/src/%{goipath}/$file" >> devel.file-list
 done
 %make_install SYSTEMD_SERVICE_DIR="%{_unitdir}" LIBDIR="%{_libexecdir}"
-# HOME directory for user deepin-sound-player
-mkdir -p %{buildroot}%{_sharedstatedir}/deepin-sound-player
+# HOME directory for user deepin-daemon
+mkdir -p %{buildroot}%{_sharedstatedir}/deepin-daemon
 
 %pre
-getent group deepin-sound-player >/dev/null || groupadd -r deepin-sound-player
-getent passwd deepin-sound-player >/dev/null || \
-    useradd -r -g deepin-sound-player -d %{_sharedstatedir}/deepin-sound-player\
+getent group deepin-daemon >/dev/null || groupadd -r deepin-daemon
+getent passwd deepin-daemon >/dev/null || \
+    useradd -r -g deepin-daemon -d %{_sharedstatedir}/deepin-daemon\
     -s /sbin/nologin \
-    -c "User of org.deepin.dde.SoundThemePlayer1.service" deepin-sound-player
+    -c "User of org.deepin.dde.SoundThemePlayer1.service" deepin-daemon
 exit 0
 
 %post
@@ -122,8 +122,8 @@ exit 0
 %{_datadir}/dde-api/data/grub-themes/
 %{_datadir}/polkit-1/actions/org.deepin.dde.locale-helper.policy
 %{_datadir}/polkit-1/actions/org.deepin.dde.device.unblock-bluetooth-devices.policy
-%{_var}/lib/polkit-1/localauthority/10-vendor.d/org.deepin.dde.device.pkla
-%attr(-, deepin-sound-player, deepin-sound-player) %{_sharedstatedir}/deepin-sound-player
+%{_var}/lib/polkit-1/rules.d/org.deepin.dde.device.rules
+%attr(-, deepin-daemon, deepin-daemon) %{_sharedstatedir}/deepin-daemon
 
 %files -n %{name}-devel -f devel.file-list
 
diff --git a/sound-theme-player/config.go b/sound-theme-player/config.go
@@ -9,9 +9,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	"path/filepath"
-
-	"github.com/linuxdeepin/dde-api/soundutils"
-	gio "github.com/linuxdeepin/go-gir/gio-2.0"
 )
 
 type config struct {
@@ -39,22 +36,7 @@ func saveUserConfig(uid int, cfg *config) error {
 	return saveConfig(filename, cfg)
 }
 
-var _loadDefaultCfgFromGSettings bool = false
-
 func loadConfig(filename string, cfg *config) error {
-	if _loadDefaultCfgFromGSettings {
-		// 从 gsettings 获取默认值
-		soundEffectGs := gio.NewSettings("com.deepin.dde.sound-effect")
-		defer soundEffectGs.Unref()
-		appearanceGs := gio.NewSettings("com.deepin.dde.appearance")
-		defer appearanceGs.Unref()
-
-		cfg.Enabled = soundEffectGs.GetBoolean("enabled")
-		cfg.DesktopLoginEnabled = soundEffectGs.GetBoolean(soundutils.EventDesktopLogin)
-		cfg.SystemShutdownEnabled = soundEffectGs.GetBoolean(soundutils.EventSystemShutdown)
-		cfg.Theme = appearanceGs.GetString("sound-theme")
-	}
-
 	data, err := ioutil.ReadFile(filename)
 	if err != nil {
 		return err
diff --git a/sound-theme-player/main.go b/sound-theme-player/main.go
@@ -42,12 +42,7 @@ var (
 
 func init() {
 	flag.BoolVar(&optAutoQuit, "auto-quit", true, "auto quit")
-	u, err := user.Current()
-	if err != nil {
-		logger.Warning(err)
-	} else {
-		homeDir = u.HomeDir
-	}
+	homeDir = os.Getenv("HOME")
 	if homeDir == "" {
 		homeDir = defaultHomeDir
 	}
@@ -382,8 +377,6 @@ func main() {
 		logger.Fatalf("name %q already has the owner", dbusServiceName)
 	}
 
-	// 实际运行时才从 gsettings 加载默认设置，测试环境下没安装相关 gsettings schema 会导致崩溃。
-	_loadDefaultCfgFromGSettings = true
 	m := newManager(service)
 	err = service.Export(dbusPath, m)
 	if err != nil {
