dns_secure.cpp File Reference

Go to the source code of this file.

Classes
struct	anonymous_namespace{dns_secure.cpp}::BwrapArgs

Namespaces
namespace	anonymous_namespace{dns_secure.cpp}

Functions
static void	write_resolv_conf (const std::string &path)
static bool	anonymous_namespace{dns_secure.cpp}::path_safe (const char *p)
static bool	anonymous_namespace{dns_secure.cpp}::path_exists (const std::string &p)
void	reexec_inside_bwrap_with_custom_dns (int argc, char **argv)

Function Documentation

reexec_inside_bwrap_with_custom_dns()

void reexec_inside_bwrap_with_custom_dns	(	int	argc,
		char **	argv )

Definition at line 128 of file dns_secure.cpp.

                                                                {
    if (std::getenv("BASTIONGUARD_IN_BWRAP")) return;
    if ((bg_process::exists_on_path("bwrap") ? 0 : 1) != 0) return;
 
    const std::string resolv = "/tmp/bastionguard-resolv.conf";
    write_resolv_conf(resolv);
 
    const char* home = std::getenv("HOME");
    if (!home || !*home) {
        std::cerr << _("[BastionGuard-secure] HOME non impostata.\n");
        return;
    }
 
    const std::string host_cache  = std::string(home) + "/.cache/BastionGuard/cef_sandbox";
    const std::string host_config = std::string(home) + "/.config/BastionGuard";
 
    // Assicurati che la cache esista (bwrap --bind richiede sorgente esistente).
    {
        ::mkdir((std::string(home) + "/.cache").c_str(), 0700);
        ::mkdir((std::string(home) + "/.cache/BastionGuard").c_str(), 0700);
        ::mkdir(host_cache.c_str(), 0700);
    }
 
    const char* xdg_rt   = std::getenv("XDG_RUNTIME_DIR");
    const char* wl_disp  = std::getenv("WAYLAND_DISPLAY");
    const char* x_disp   = std::getenv("DISPLAY");
    const char* xauth    = std::getenv("XAUTHORITY");
 
    const bool have_wayland = wl_disp && *wl_disp && xdg_rt && *xdg_rt;
    const bool have_x11     = x_disp  && *x_disp;
 
    BwrapArgs a;
    a.add("bwrap");
    a.add("--new-session");
    a.add("--die-with-parent");
 
    // Hostname dedicato dentro la sandbox
    a.add("--unshare-uts");
    a.add("--hostname"); a.add("BastionGuard-secure");
 
    // Root FS in RO
    a.add("--ro-bind"); a.add("/"); a.add("/");
 
    // /dev e /proc minimali
    a.add("--dev");  a.add("/dev");
    a.add("--proc"); a.add("/proc");
 
    // /tmp privato + bind del file resolv.conf custom
    a.add("--tmpfs"); a.add("/tmp");
    a.add("--ro-bind"); a.add(resolv); a.add("/etc/resolv.conf");
 
    // Cache CEF (rw)
    if (path_safe(host_cache.c_str())) {
        a.add("--bind"); a.add(host_cache); a.add(host_cache);
    }
 
    // Config BastionGuard (ro: legge whitelist, payments, ecc.)
    if (path_safe(host_config.c_str()) && path_exists(host_config)) {
        a.add("--ro-bind"); a.add(host_config); a.add(host_config);
    }
 
    // ---------------------------------------------------------------------
    //  Backend Wayland: serve XDG_RUNTIME_DIR (contiene il socket wayland-*)
    // ---------------------------------------------------------------------
    if (have_wayland) {
        if (path_safe(xdg_rt))
            a.add("--bind"), a.add(xdg_rt), a.add(xdg_rt);
        a.add("--setenv"); a.add("WAYLAND_DISPLAY"); a.add(wl_disp);
        std::cout << _("[BastionGuard-secure] bwrap: Wayland abilitato (")
                  << wl_disp << ")\n";
    } else if (xdg_rt && *xdg_rt && path_safe(xdg_rt)) {
        // Anche senza Wayland conviene avere XDG_RUNTIME_DIR (PulseAudio,
        // PipeWire, dbus user) — ma non strettamente necessario.
        a.add("--bind"); a.add(xdg_rt); a.add(xdg_rt);
    }
 
    // ---------------------------------------------------------------------
    //  Backend X11: /tmp/.X11-unix, $DISPLAY, $XAUTHORITY (cookie MIT-MAGIC)
    //  /tmp è già una tmpfs nuova qui dentro, quindi va re-bindata.
    // ---------------------------------------------------------------------
    if (have_x11) {
        if (path_exists("/tmp/.X11-unix")) {
            a.add("--ro-bind"); a.add("/tmp/.X11-unix"); a.add("/tmp/.X11-unix");
        }
 
        std::string xauth_path;
        if (xauth && *xauth && path_safe(xauth) && path_exists(xauth)) {
            xauth_path = xauth;
        } else {
            const std::string default_xauth = std::string(home) + "/.Xauthority";
            if (path_exists(default_xauth)) xauth_path = default_xauth;
        }
        if (!xauth_path.empty()) {
            a.add("--ro-bind"); a.add(xauth_path); a.add(xauth_path);
            a.add("--setenv"); a.add("XAUTHORITY"); a.add(xauth_path);
        }
 
        a.add("--setenv"); a.add("DISPLAY"); a.add(x_disp);
        std::cout << _("[BastionGuard-secure] bwrap: X11 abilitato (DISPLAY=")
                  << x_disp << ")\n";
    }
 
    if (!have_wayland && !have_x11) {
        std::cerr << _("[BastionGuard-secure] ⚠ Nessun display Wayland/X11 rilevato; "
                       "il browser non riuscirà ad aprirsi.\n");
    }
 
    // Evita re-entry
    a.add("--setenv"); a.add("BASTIONGUARD_IN_BWRAP"); a.add("1");
 
    // Pass-through di un eventuale forced backend (utile per debug)
    if (const char* fb = std::getenv("BastionGuard_CEF_BACKEND")) {
        a.add("--setenv"); a.add("BastionGuard_CEF_BACKEND"); a.add(fb);
    }
 
    // Programma originale + suoi argv
    if (argc < 1 || !argv[0]) {
        std::cerr << _("[BastionGuard-secure] argv[0] mancante, abort bwrap.\n");
        return;
    }
    a.add(argv[0]);
    for (int i = 1; i < argc; ++i) {
        if (argv[i]) a.add(argv[i]);
    }
 
    auto cargv = a.to_argv();
    execvp("bwrap", cargv.data());
    std::perror("execvp(bwrap)");
}

References _, bg_process::exists_on_path(), anonymous_namespace{dns_secure.cpp}::path_exists(), anonymous_namespace{dns_secure.cpp}::path_safe(), reexec_inside_bwrap_with_custom_dns(), and write_resolv_conf().

Referenced by main(), main(), and reexec_inside_bwrap_with_custom_dns().

write_resolv_conf()

void write_resolv_conf ( const std::string & path )

static

Definition at line 59 of file dns_secure.cpp.

                                                     {
    std::ofstream o(path, std::ios::trunc);
    if (!o) {
        std::perror("[BastionGuard-secure] write resolv.conf");
        return;
    }
    o << "nameserver 1.1.1.1\n";
    o << "nameserver 9.9.9.9\n";
    o << "nameserver 8.8.8.8\n";
    o << "options timeout:2 attempts:3 rotate\n";
    o.close();
}

References write_resolv_conf().

Referenced by reexec_inside_bwrap_with_custom_dns(), and write_resolv_conf().