Fixed Ubuntu 22x and Fedora 39x build support - #29
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
📝 WalkthroughWalkthroughThis PR adds AppImage packaging with glibc compatibility checks, restructures dependency installation as an array-based package list, updates CI and release workflows to build and smoke-test AppImages on Ubuntu 22.04 containers and Fedora, updates README documentation, and reworks privilege-escalation and platform-plugin handling in main.cpp. ChangesAppImage packaging, CI/release, and runtime compatibility
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant main
participant qtPlatformPluginAvailable
participant buildPkexecArguments
participant pkexec
main->>qtPlatformPluginAvailable: check linuxfb plugin availability
qtPlatformPluginAvailable-->>main: plugin available or not
main->>buildPkexecArguments: build args (AppImage path, env vars, SEB_PASSWORD)
buildPkexecArguments-->>main: argument list
main->>pkexec: relaunch with /bin/sh preserving cwd
sequenceDiagram
participant BuildScript
participant linuxdeploy
participant AppDir
participant objdump
BuildScript->>linuxdeploy: build_linuxdeploy_extra_args()
BuildScript->>AppDir: build_appimage()
BuildScript->>objdump: check_glibc_symbols(app_dir, max_version)
objdump-->>BuildScript: symbol versions found
BuildScript->>BuildScript: version_gt() comparison
alt symbol too new
BuildScript->>BuildScript: fail build
else compatible
BuildScript->>AppDir: accept AppImage
end
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
scripts/build-release.sh (1)
264-264: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert that
linuxfbis in each AppImage.
EXTRA_PLATFORM_PLUGINSonly requests the plugin.src/main.cppfalls back toxcbwhenlinuxfbis unavailable. The AppImage smoke jobs forceQT_QPA_PLATFORM=xcb, so they can pass withoutlibqlinuxfb.so. After packaging, check the actual AppDir or extracted artifact and fail if the plugin is absent.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/build-release.sh` at line 264, Update the release packaging flow around EXTRA_PLATFORM_PLUGINS to verify that libqlinuxfb.so exists in the assembled AppDir or extracted AppImage after packaging. Fail the build immediately when the plugin is absent, rather than relying only on the requested plugin list or smoke tests..github/workflows/ci.yml (1)
152-152: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winSmoke-test the documented minimum distributions.
Building in
ubuntu:22.04does not execute a generated AppImage. The only Ubuntu--versiontest runs on Ubuntu 24.04.fedora:latestdoes not bind the test to Fedora 39. A host-runtime regression can pass CI while breaking a stated minimum platform.
.github/workflows/ci.yml#L152-L152: Run the existing smoke loop in an Ubuntu 22.04 container..github/workflows/ci.yml#L193-L193: Run the Fedora smoke loop in a Fedora 39 container. Keep newer-release coverage in a separate job.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 152, The existing Ubuntu smoke loop at .github/workflows/ci.yml lines 152-152 must run inside an ubuntu:22.04 container instead of the current host runtime. The Fedora smoke loop at .github/workflows/ci.yml lines 193-193 must run inside a fedora:39 container, while retaining newer Fedora coverage in a separate job.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 193: Replace the tag-only container images at
.github/workflows/ci.yml:122, .github/workflows/ci.yml:193, and
.github/workflows/release.yml:24 with reviewed immutable digests; use a
consistent Ubuntu 22.04 digest at the Ubuntu sites and pin the Fedora image at
the Fedora site.
In `@scripts/build-release.sh`:
- Line 242: Update the release validation around check_glibc_symbols to scan
both app_dir and the discovered appimage_path, ensuring the generated AppImage
runtime is checked before release completion. Preserve the existing
MAX_GLIBC_VERSION constraint and invoke validation for the final .AppImage after
its path is available.
In `@src/main.cpp`:
- Around line 563-570: Remove the SEB_PASSWORD entry from extraEnv and stop
passing the userPassword through buildPkexecArguments() or any pkexec
environment/argv value. Preserve the elevated authentication flow by collecting
or transferring the password only after privilege escalation through protected
IPC or another mechanism that prevents command-line and environment exposure.
- Around line 320-326: Update applyEarlyEnvironment’s protected-mode setup
branch so a failure of qtPlatformPluginAvailable("linuxfb") or
setup_barebones_vt() cannot continue to launch with the default xcb platform.
Fail closed by terminating or returning an error before launch, or explicitly
mark the mode unprotected and reject the protected resource; preserve normal
fallback behavior only when protected mode was not requested.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 152: The existing Ubuntu smoke loop at .github/workflows/ci.yml lines
152-152 must run inside an ubuntu:22.04 container instead of the current host
runtime. The Fedora smoke loop at .github/workflows/ci.yml lines 193-193 must
run inside a fedora:39 container, while retaining newer Fedora coverage in a
separate job.
In `@scripts/build-release.sh`:
- Line 264: Update the release packaging flow around EXTRA_PLATFORM_PLUGINS to
verify that libqlinuxfb.so exists in the assembled AppDir or extracted AppImage
after packaging. Fail the build immediately when the plugin is absent, rather
than relying only on the requested plugin list or smoke tests.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: bdc0fdeb-3149-45d9-8d6c-171ac72f37b6
📒 Files selected for processing (6)
.github/workflows/ci.yml.github/workflows/release.ymlREADME.mdscripts/build-release.shscripts/dependencies.shsrc/main.cpp
| - build-appimage | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: fedora:latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Tracked workflow files:\n'
git ls-files .github/workflows || true
printf '\nWorkflow lines around image references:\n'
sed -n '112,128p' .github/workflows/ci.yml || true
sed -n '185,200p' .github/workflows/ci.yml || true
sed -n '18,30p' .github/workflows/release.yml || true
printf '\nFull image references in workflows:\n'
rg -n 'image:\s*[^[:space:]]+' .github/workflows || trueRepository: Jvr2022/seb-linux
Length of output: 1975
🌐 Web query:
Docker content trust immutable image digests best practice tag digest documentation
💡 Result:
As of August 2026, Docker Content Trust (DCT) is being retired [1]. It is recommended to migrate from DCT to more modern, industry-standard signing tools such as Sigstore (Cosign) or Notation [1]. Best Practices for Image Integrity and Reproducibility: 1. Use Immutable Image Digests: Always reference container images by their SHA-256 digest (e.g., image@sha256:abcdef...) rather than mutable tags like latest, stable, or version numbers [1][2][3]. Tags can be overwritten or moved to point to different content, whereas digests are unique, immutable, and cryptographically linked to the image content [1][3][4]. 2. Implement a Multi-Layer Integrity Pipeline: To ensure secure and reproducible deployments, adopt a three-layer integrity approach [5]: - Layer 1 (Build): Generate a Software Bill of Materials (SBOM) and sign the image digest using tools like Cosign or Notation [5]. - Layer 2 (Registry): Enable immutable tags (preventing tag overwrites) and restrict push access to authorized CI/CD roles only [5]. - Layer 3 (Deploy): Use admission controllers (e.g., Kyverno, OPA Gatekeeper) or deployment scripts to verify the image's signature and digest before allowing it to run in your environment [5]. 3. Why Move Beyond DCT: DCT was designed for tag-level verification [6]. However, it is tied to specific legacy infrastructure (Notary) and has become limited compared to modern OCI-native signing solutions [1][7]. Modern tools like Cosign store signatures as OCI artifacts directly within the registry, providing better compatibility, improved performance, and support for advanced features like provenance attestations and SBOMs [1][5]. If you currently rely on DCT for base image verification, consider switching to Docker Hardened Images (DHI), which come with pre-built cryptographic signatures, attestations, and SBOMs [1]. If you are a publisher who was using DCT, you should adopt Cosign or Notation to maintain your own image signing workflows [1].
Citations:
- 1: https://www.docker.com/blog/docker-content-trust-retirement-and-migration-guidance/
- 2: https://docs.docker.com/build/policies/validate-images/
- 3: https://docs.docker.com/dhi/explore/security-concepts/digests/
- 4: https://docs.docker.com/dhi/core-concepts/digests/
- 5: https://dev.to/rufilboss/how-to-build-a-three-layer-artifact-integrity-pipeline-for-container-releases-1fpf
- 6: https://docs.docker.com/engine/security/trust/
- 7: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-content-trust
Security Misconfiguration (CWE-829): Inclusion of Functionality from Untrusted Control Sphere
Reachability: External
Pin job container images to reviewed digests.
GitHub Actions runs container steps with tag-only images such as ubuntu:22.04 and fedora:latest. Replace these tag-only references with immutable image digests, and use the same Ubuntu 22.04 digest across CI and release workflows.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 193-193: unpinned image references (unpinned-images): container image is pinned to latest
(unpinned-images)
📍 Affects 2 files
.github/workflows/ci.yml#L193-L193(this comment).github/workflows/ci.yml#L122-L122.github/workflows/release.yml#L24-L24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 193, Replace the tag-only container images
at .github/workflows/ci.yml:122, .github/workflows/ci.yml:193, and
.github/workflows/release.yml:24 with reviewed immutable digests; use a
consistent Ubuntu 22.04 digest at the Ubuntu sites and pin the Fedora image at
the Fedora site.
Source: Linters/SAST tools
| "${LINUXBUILD_EXTRA_ARGS[@]}" | ||
| popd >/dev/null | ||
|
|
||
| check_glibc_symbols "${app_dir}" "${MAX_GLIBC_VERSION}" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate build script and relevant symbols =="
if [ -f scripts/build-release.sh ]; then
wc -l scripts/build-release.sh
rg -n "check_glibc_symbols|appimage_path|appimage_output_dir|find .*AppImage|AppDir" scripts/build-release.sh
echo "== around lines 200-260 =="
sed -n '200,265p' scripts/build-release.sh | nl -ba -v200
fi
echo "== inspect check_glibc_symbols implementation/usages =="
rg -n "function check_glibc_symbols|check_glibc_symbols\\(" scripts/build-release.shRepository: Jvr2022/seb-linux
Length of output: 998
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== sed excerpts with line numbers =="
sed -n '170,260p' scripts/build-release.sh | awk '{printf "%d\t%s\n", NR+169, $0}'
echo "== repository text search for glibc check and AppImage references =="
rg -n "check_glibc_symbols|MAX_GLIBC_VERSION|AppImage|appimage|runtime|linuxdeploy" . \
--glob '!/.git/**' --glob '!/dist/**' --glob '!/build/**' || true
echo "== deterministic order check from scripts/build-release.sh =="
python3 - <<'PY'
from pathlib import Path
text = Path("scripts/build-release.sh").read_text()
lines = text.splitlines()
for i,l in enumerate(lines, 1):
if "check_glibc_symbols" in l or "appimage_path=" in l or "find .*AppImage" in l:
print(i, l)
print("check_before_find=", next((i for i,l in enumerate(lines,1) if "check_glibc_symbols" in l), None), "<", next((i for i,l in enumerate(lines,1) if "appimage_path=" in l), None), "=", next((i,l in enumerate(lines,1) if "appimage_path=" in l and "find" in l), None))
PYRepository: Jvr2022/seb-linux
Length of output: 10534
🌐 Web query:
AppImage architecture runtime AppDir fuse mount docs.appimage.org
💡 Result:
An AppImage is structured as a single executable file containing two primary components: a runtime and a file system image (typically SquashFS) [1][2]. Its architecture is designed to provide a self-contained, portable application environment [2][3]. The Runtime and FUSE When an AppImage is executed, the runtime (a small ELF binary prepended to the image) is responsible for the launch process [1][4]. Its core task is to use FUSE (Filesystem in Userspace) to mount the embedded file system image as a read-only directory [1][3]. This allows the application to access its bundled dependencies and resources as if they were part of a standard, local file system tree, independent of what is installed on the host OS [2][5]. Once the application process terminates, the runtime unmounts the SquashFS image and cleans up the temporary mount point [4][5]. AppDir The AppDir is the "source" directory from which an AppImage is built [6][7]. It contains the application's executable (entrypoint), libraries, and resources (such as icons and desktop files) [6][4]. When packaging an application, tools like appimagetool or linuxdeploy take this directory, create a compressed SquashFS image from it, and prepend the runtime to produce the final AppImage file [1][4][2]. Every AppDir must contain an executable file named AppRun, which serves as the entrypoint that the runtime invokes to start the payload application [4][5][8]. Fallback Mechanisms If FUSE is unavailable on the host system (e.g., in certain containerized or restricted environments), the AppImage runtime supports an "extract-and-run" feature [9][10]. This mechanism extracts the contents of the AppImage into a temporary directory, runs the application from there, and performs cleanup upon exit, effectively bypassing the requirement for FUSE mounting [9][2]. Top Results: [1], [4], [9], [2]
Citations:
- 1: https://docs.appimage.org/reference/architecture.html
- 2: https://appimage.readthedocs.io/en/latest/internals.html
- 3: https://kevinboone.me/appimage.html
- 4: https://docs.appimage.org/introduction/software-overview.html
- 5: https://github.com/AppImage/docs.appimage.org/blob/master/source/introduction/software-overview.rst
- 6: https://docs.appimage.org/reference/appdir.html
- 7: https://docs.appimage.org/introduction/concepts.html
- 8: https://github.com/AppImage/AppImageSpec/blob/28a79bb0e626de2d61485982f99e0ee6eed63721/draft.md
- 9: https://docs.appimage.org/user-guide/troubleshooting/fuse.html
- 10: https://github.com/AppImage/AppImageKit/wiki/FUSE
Validate the generated AppImage runtime.
scripts/build-release.sh:242 checks only AppDir, while the final .AppImage path is discovered afterward. The AppImage runtime is outside AppDir and executes before mounting the embedded AppDir; scan appimage_path too so a newer-runtime requirement cannot bypass this check.
Proposed change
- check_glibc_symbols "${app_dir}" "${MAX_GLIBC_VERSION}"
-
appimage_path="$(find "${appimage_output_dir}" -maxdepth 1 -type f -name '*.AppImage' -print -quit)"
if [[ -z "${appimage_path}" ]]; then
echo "linuxdeploy did not produce an AppImage" >&2
exit 1
fi
+ check_glibc_symbols "${app_dir}" "${MAX_GLIBC_VERSION}"
+ check_glibc_symbols "${appimage_path}" "${MAX_GLIBC_VERSION}"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/build-release.sh` at line 242, Update the release validation around
check_glibc_symbols to scan both app_dir and the discovered appimage_path,
ensuring the generated AppImage runtime is checked before release completion.
Preserve the existing MAX_GLIBC_VERSION constraint and invoke validation for the
final .AppImage after its path is available.
| if (qtPlatformPluginAvailable(QStringLiteral("linuxfb")) && setup_barebones_vt()) { | ||
| qputenv("QT_QPA_PLATFORM", "linuxfb"); | ||
| qputenv("QT_QUICK_BACKEND", "software"); | ||
| } else { | ||
| qWarning() << "VT/linuxfb lockdown unavailable; continuing with the default Qt platform " | ||
| "(xcb). Rebuild the AppImage with EXTRA_PLATFORM_PLUGINS=libqlinuxfb.so " | ||
| "for full bare-VT lockdown."; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## repo files around src/main.cpp and related symbols"
git ls-files | rg '(^src/main\.cpp$|src/.*controller|seb|lockdown|anti-cheat|pkexec|protected)' || true
echo
echo "## src/main.cpp outline (focused)"
ast-grep outline src/main.cpp --view compact | sed -n '1,220p' || true
echo
echo "## targeted lines around protected-mode branches"
nl -ba src/main.cpp | sed -n '280,350p'
echo "---"
nl -ba src/main.cpp | sed -n '480,610p'
echo
echo "## protected/lockdown/anti-cheat/pkexec references in src/main.cpp"
rg -n 'menu-lockdown|anti-cheat|Protected|protected|pkexec|applyProtectedSessionSettings|apply.*Session|launchResolved|setup_barebones_vt|qtPlatformPluginAvailable|linuxfb|QT_QPA_PLATFORM|QT_QUICK_BACKEND|anti_cheat|antiCheat|lockdown' src/main.cppRepository: Jvr2022/seb-linux
Length of output: 1136
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p = Path('src/main.cpp')
text = p.read_text()
checks = {
"lines_320_326": 320 <= next((i for i,s in enumerate(text.splitlines(),1) if "\"VT/linuxfb lockdown unavailable\"" in s), 0) <= 326,
"else_continue_no_exit": "qWarning()" in text[
text.find("QT_QPA_PLATFORM\", \"linuxfb\"\");"):text.find("applyProtectedSessionSettings", text.find("QT_QPA_PLATFORM\", \"linuxfb\""))]
and ("qCritical" in text[
text.find("QT_QPA_PLATFORM\", \"linuxfb\"\");"):text.find("applyProtectedSessionSettings", text.find("QT_QPA_PLATFORM\", \"linuxfb\""))]
or "return" in text[
text.find("QT_QPA_PLATFORM\", \"linuxfb\"\");"):text.find("applyProtectedSessionSettings", text.find("QT_QPA_PLATFORM\", \"linuxfb\""))]) == False,
}
for name,val in checks.items():
print(f"{name}={val}")
PYRepository: Jvr2022/seb-linux
Length of output: 203
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## line numbers for relevant patterns in src/main.cpp"
python3 - <<'PY'
from pathlib import Path
p = Path('src/main.cpp')
lines = p.read_text().splitlines()
patterns = [
"QT_QPA_PLATFORM\", \"linuxfb\"",
"QT_QUICK_BACKEND",
"applyProtectedSessionSettings",
"menu-lockdown",
"anti-cheat",
"pkexec",
"launchResolved",
"QT_QPA_PLATFORM",
]
for i, line in enumerate(lines, 1):
if any(pl in line for pl in patterns):
print(f"{i:05}: {line.strip()}")
PY
echo
echo "## src/main.cpp sections around linuxfb/protected mode (bash-compatible)"
python3 - <<'PY'
from pathlib import Path
p = Path('src/main.cpp')
lines = p.read_text().splitlines()
def section(first, last, title):
print(f"\n--- {title} ---")
for i in range(first, last+1):
print(f"{i:05}: {lines[i-1]}")
section(300, 345, "linuxfb/protected setup")
section(460, 540, "pkexec/elevation handling")
section(570, 605, "controller launch")
PY
echo
echo "## related protected/elevation flags in src/main.cpp"
python3 - <<'PY'
from pathlib import Path
p = Path('src/main.cpp')
lines = p.read_text().splitlines()
patterns = [
"protected",
"Protected",
"menuLockdown",
"menu-lockdown",
"antiChe",
"anti-cheat",
"lockdown",
"pkexec",
]
for i, line in enumerate(lines, 1):
if any(pl in line for pl in patterns):
print(f"{i:05}: {line.strip()}")
PYRepository: Jvr2022/seb-linux
Length of output: 14347
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "## applyEarlyEnvironment call path"
python3 - <<'PY'
from pathlib import Path
lines = Path('src/main.cpp').read_text().splitlines()
for i, line in enumerate(lines, 1):
if 'applyEarlyEnvironment' in line or 'QCoreApplication::exec' in line or 'QApplication a' in line:
print(f"{i:05}: {line.strip()}")
PY
echo
echo "## applyProtectedSessionSettings definition"
python3 - <<'PY'
from pathlib import Path
lines = Path('src/main.cpp').read_text().splitlines()
start = next(i for i,l in enumerate(lines,1) if 'void applyProtectedSessionSettings(' in l)
print("---")
for i in range(start, min(start+35, len(lines))+1):
print(f"{i:05}: {lines[i-1]}")
PY
echo
echo "## lock/terminal/process control in protected session settings"
python3 - <<'PY'
from pathlib import Path
lines = Path('src/main.cpp').read_text().splitlines()
start = next(i for i,l in enumerate(lines,1) if 'void applyProtectedSessionSettings(' in l)
lines = lines[start-1:]
print("---")
for i, line in enumerate(lines, start, int(''.join(f"{i}" for i in range(start, start+len(lines))))):
if 'QProcess' in lines[i-start] or 'kill' in lines[i-start].lower() or 'session' in lines[i-start].lower() or 'lock' in lines[i-start].lower():
print(f"{i:05}: {lines[i-start].strip()}")
PYRepository: Jvr2022/seb-linux
Length of output: 2297
Authorization Bypass (CWE-863): Incorrect Authorization
Reachability: External
Fail closed when protected-mode setup fails.
When --menu-lockdown or --anti-cheat with a resource requests protected mode, VT/linuxfb setup can fail here and the code falls back to xcb without returning from applyEarlyEnvironment(). The later launch path then skips elevated pkexec because --menu-lockdown/--anti-cheat is already present, so the controller launches without privileged isolation. Exit before launch when protected-mode setup cannot proceed, or treat the fallback path as unprotected and reject protected exam resources.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/main.cpp` around lines 320 - 326, Update applyEarlyEnvironment’s
protected-mode setup branch so a failure of qtPlatformPluginAvailable("linuxfb")
or setup_barebones_vt() cannot continue to launch with the default xcb platform.
Fail closed by terminating or returning an error before launch, or explicitly
mark the mode unprotected and reject the protected resource; preserve normal
fallback behavior only when protected mode was not requested.
| QStringList extraEnv; | ||
| if (usedPassword) { | ||
| pkexecArgs << (QStringLiteral("SEB_PASSWORD=") + userPassword); | ||
| extraEnv << (QStringLiteral("SEB_PASSWORD=") + userPassword); | ||
| } | ||
| pkexecArgs << QCoreApplication::applicationFilePath(); | ||
| pkexecArgs << args; | ||
|
|
||
| child.setArguments(pkexecArgs); | ||
|
|
||
| QProcess child; | ||
| child.setProgram(QStringLiteral("pkexec")); | ||
| child.setArguments(buildPkexecArguments(args, extraEnv)); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^|/)src/main\.cpp$|(^|/)Main\.(h|hpp|cpp)$|(^|/)app_controller\.h$|(^|/)security_service\.h$|(^|/)pkexec|(^|/)buildPkexecArguments' || true
echo "== main.cpp outline around target =="
if [ -f src/main.cpp ]; then
wc -l src/main.cpp
ast-grep outline src/main.cpp --match pkexec --view expanded || true
echo "-- lines 520-620 --"
sed -n '520,620p' src/main.cpp | nl -ba -v520
fi
echo "== search buildPkexecArguments/userPassword/pkexec/SEB_PASSWORD =="
rg -n "buildPkexecArguments|SEB_PASSWORD|userPassword|QInputDialog|pkexec|setRead" src || true
echo "== deterministic Qt argument/env constructor probe via source inspection if unavailable =="
python3 - <<'PY'
from pathlib import Path
p=Path('src/main.cpp')
if p.exists():
text=p.read_text()
for needle in ['buildPkexecArguments(', 'SEB_PASSWORD=', 'userPassword', 'pkexec']:
print(needle, 'count=', text.count(needle))
PYRepository: Jvr2022/seb-linux
Length of output: 375
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target lines =="
sed -n '520,620p' src/main.cpp
echo "== relevant symbol search =="
grep -nE "buildPkexecArguments|SEB_PASSWORD|userPassword|QInputDialog|pkexec|setRead|write" src/main.cpp src/app_controller.h src/security/security_service.h || true
echo "== full pkexec/build helper context =="
grep -nE "buildPkexecArguments|pkexec|SEB_PASSWORD|QProcess|QInputDialog|userPassword|usedPassword" src/main.cpp src/app_controller.h src/security/security_service.h || trueRepository: Jvr2022/seb-linux
Length of output: 10983
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== appendPkexecEnvironmentVariable implementation =="
sed -n '150,180p' src/main.cpp
echo "== deterministic argv construction model =="
python3 - <<'PY'
appArgs = ["--anti-cheat", "./seb"]
extraEnvAssigments = "--pass-env", "SEB_PASSWORD=secret"
execArgs = ("env", "--pass-env", "SEB_PASSWORD=secret", "/bin/sh", "-c",
"cd -- \"$1\" && shift && exec \"$@\"", "sh", "/PWD", "./seb", "--anti-cheat", "./seb")
print("pkexec argv will contain:", " ".join(execArgs))
print("contains SEB_PASSWORD assignment:", "SEB_PASSWORD=secret" in execArgs)
print("contains command-line password:", "secret" in execArgs)
PYRepository: Jvr2022/seb-linux
Length of output: 1590
Sensitive Data Exposure (CWE-526)
Reachability: External
Do not pass SEB_PASSWORD through pkexec arguments.
buildPkexecArguments() appends each extra environment assignment as argv, so the command line includes SEB_PASSWORD=<userPassword>. A local process with command-line visibility, audit logging, or diagnostic collection can capture the secret during elevation. Move password entry after the privilege prompt, or use protected IPC that does not pass the secret through argv or environment variables.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/main.cpp` around lines 563 - 570, Remove the SEB_PASSWORD entry from
extraEnv and stop passing the userPassword through buildPkexecArguments() or any
pkexec environment/argv value. Preserve the elevated authentication flow by
collecting or transferring the password only after privilege escalation through
protected IPC or another mechanism that prevents command-line and environment
exposure.
|
Will take a look next week! Thanks! |
2 participants
Summary
What Changed
Verification
Summary by CodeRabbit
Release Notes
New Features
Improvements
Documentation