security: Verify session pid against DBus connection

[waydroid.git] / tools / actions / container_manager.py

diff --git a/tools/actions/container_manager.py b/tools/actions/container_manager.py
index 0092f1e61e5c6898a27550b96563561a5496a879..5a6fe71b3e0641e4ff0740992d7b7b4949a66324 100644 (file)
--- a/tools/actions/container_manager.py
+++ b/tools/actions/container_manager.py
@@ -28,6 +28,9 @@ class DbusContainerManager(dbus.service.Object):
         uid = dbus_info.GetConnectionUnixUser(sender)
         if str(uid) not in ["0", session["user_id"]]:
             raise RuntimeError("Cannot start a session on behalf of another user")
+        pid = dbus_info.GetConnectionUnixProcessID(sender)
+        if str(uid) != "0" and str(pid) != session["pid"]:
+            raise RuntimeError("Invalid session pid")
         do_start(self.args, session)
 
     @dbus.service.method("id.waydro.ContainerManager", in_signature='b', out_signature='')
@@ -145,10 +148,6 @@ def do_start(args, session):
 
     helpers.protocol.set_aidl_version(args)
 
-    # Mount data
-    helpers.mount.bind(args, session["waydroid_data"],
-                       tools.config.defaults["data"])
-
     # Cgroup hacks
     if which("start"):
         command = ["start", "cgroup-lite"]
@@ -165,6 +164,14 @@ def do_start(args, session):
     # Set permissions
     set_permissions(args)
 
+    # Create session-specific LXC config file
+    helpers.lxc.generate_session_lxc_config(args, session)
+    # Backwards compatibility
+    with open(tools.config.defaults["lxc"] + "/waydroid/config") as f:
+        if "config_session" not in f.read():
+            helpers.mount.bind(args, session["waydroid_data"],
+                               tools.config.defaults["data"])
+
     helpers.lxc.start(args)
     services.hardware_manager.start(args)
 
@@ -200,8 +207,11 @@ def stop(args, quit_session=True):
         # Umount rootfs
         helpers.images.umount_rootfs(args)
 
-        # Umount data
-        helpers.mount.umount_all(args, tools.config.defaults["data"])
+        # Backwards compatibility
+        try:
+            helpers.mount.umount_all(args, tools.config.defaults["data"])
+        except:
+            pass
 
         if "session" in args:
             if quit_session: