1 files changed, 66 insertions, 0 deletions

diff --git a/sway/main.c b/sway/main.c
index a040cec9..73c4b5f2 100644
--- a/sway/main.c
+++ b/sway/main.c
@@ -4,13 +4,16 @@
 #include <wlc/wlc.h>
 #include <sys/wait.h>
 #include <sys/types.h>
+#include <sys/stat.h>
 #include <sys/un.h>
 #include <signal.h>
 #include <unistd.h>
 #include <getopt.h>
+#include <sys/capability.h>
 #include "sway/extensions.h"
 #include "sway/layout.h"
 #include "sway/config.h"
+#include "sway/security.h"
 #include "sway/handlers.h"
 #include "sway/input.h"
 #include "sway/ipc-server.h"
@@ -142,6 +145,63 @@ static void log_kernel() {
 	fclose(f);
 }
 
+static void security_sanity_check() {
+	// TODO: Notify users visually if this has issues
+	struct stat s;
+	if (stat("/proc", &s)) {
+		sway_log(L_ERROR,
+			"!! DANGER !! /proc is not available - sway CANNOT enforce security rules!");
+	}
+	cap_flag_value_t v;
+	cap_t cap = cap_get_proc();
+	if (!cap || cap_get_flag(cap, CAP_SYS_PTRACE, CAP_PERMITTED, &v) != 0 || v != CAP_SET) {
+		sway_log(L_ERROR,
+			"!! DANGER !! Sway does not have CAP_SYS_PTRACE and cannot enforce security rules for processes running as other users.");
+	}
+	if (cap) {
+		cap_free(cap);
+	}
+	if (!stat(SYSCONFDIR "/sway", &s)) {
+		if (s.st_uid != 0 || s.st_gid != 0
+				|| (s.st_mode & S_IWGRP) || (s.st_mode & S_IWOTH)) {
+			sway_log(L_ERROR,
+				"!! DANGER !! " SYSCONFDIR "/sway is not secure! It should be owned by root and set to 0755 at the minimum");
+		}
+	}
+	struct {
+		char *command;
+		enum command_context context;
+		bool checked;
+	} expected[] = {
+		{ "reload", CONTEXT_BINDING, false },
+		{ "restart", CONTEXT_BINDING, false },
+		{ "permit", CONTEXT_CONFIG, false },
+		{ "reject", CONTEXT_CONFIG, false },
+		{ "ipc", CONTEXT_CONFIG, false },
+	};
+	int expected_len = 5;
+	for (int i = 0; i < config->command_policies->length; ++i) {
+		struct command_policy *policy = config->command_policies->items[i];
+		for (int j = 0; j < expected_len; ++j) {
+			if (strcmp(expected[j].command, policy->command) == 0) {
+				expected[j].checked = true;
+				if (expected[j].context != policy->context) {
+					sway_log(L_ERROR,
+						"!! DANGER !! Command security policy for %s should be set to %s",
+						expected[j].command, command_policy_str(expected[j].context));
+				}
+			}
+		}
+	}
+	for (int j = 0; j < expected_len; ++j) {
+		if (!expected[j].checked) {
+			sway_log(L_ERROR,
+				"!! DANGER !! Command security policy for %s should be set to %s",
+				expected[j].command, command_policy_str(expected[j].context));
+		}
+	}
+}
+
 int main(int argc, char **argv) {
 	static int verbose = 0, debug = 0, validate = 0;
 
@@ -170,6 +230,10 @@ int main(int argc, char **argv) {
 		"      --get-socketpath   Gets the IPC socket path and prints it, then exits.\n"
 		"\n";
 
+	// Security:
+	unsetenv("LD_PRELOAD");
+	setenv("LD_LIBRARY_PATH", _LD_LIBRARY_PATH, 1);
+
 	int c;
 	while (1) {
 		int option_index = 0;
@@ -298,6 +362,8 @@ int main(int argc, char **argv) {
 		free(config_path);
 	}
 
+	security_sanity_check();
+
 	if (!terminate_request) {
 		wlc_run();
 	}