Closed donadigo closed 4 years ago
@danrabbit @tintou updated the description & resolved the issues. This is now ready to review.
Can you split this out into multiple branches? It's a bit too much to review all at once.
Specifically regarding web restrictions, I think we did IP addresses so that it couldn't be circumvented with a proxy, no?
@danrabbit I've removed the changes that affect how web restrictions work and will do a pull request separately. I don't think that I'll be able to revert any more changes in this branch tbh. Master isn't even comparable to this branch because it doesn't really work or it's a hit or miss.
It's now ready to review again.
I need to find where this is in the code, but it looks like the icon might be broken in this dialog?
Somehow when enabling "Allow access to these apps with admin permission", I get many launches of apps after I authenticate. I.e. block Calculator, then try to launch it, authenticate, and 7 copies pop up. Same with a web browser trying to open a link, authenticate, then several windows or tabs open.
Sorry guys, but I'm rather new to this so please bear with me. It seems like the parental control not working issue dates back to at least February of 2019 and when I freshly downloaded the OS earlier this month, it still wasn't working with a native installation of the most up-to-date OS image. Unfortunately, I don't have the Linux or coding experience to understand how to implement the changes indicated above myself.
But with parental controls as part of the basic feature set of the OS, does anyone know if this issue is being addressed in the official OS release? Or is it up to each person who downloads the OS to implement the work-arounds on their own?
This PR overhauls how currently restrictions work within the daemon and how the app restriction works internally. There's a lot of changes but they are needed to progress further and fix #75 and #78.
I would like to mention that this PR does not touch UI code at all and so it doesn't fix any issues currently present in the plug code, those will be fixed separately.
Here's what's changed:
In this branch the C library was completely removed and replaced with the following:
when an admin blocks an app, the daemon gets a request and uses a built-in
setfacl
(TODO: check if this exists on other distros) command to revoke access to the executable for the specific user e.g:setfacl -m u:user:--- /path/to/exec
This blocks the user from executing the file.To provide the UI when the user wants to launch a restricted exec, the daemon finds the .desktop file for the exec, copies it to the
.local/share/application
directory of the user and replaces the Path field with a path to the PC client that handles showing the not available / authentication dialog (the copying part is done once when the admin sets the restrictions) This way the app menu or plank don't require any changes.2. Web restriction command was changed to use URL's instead of IP addresses:iptables
iptables
and let it handle stuff out automaticallyLogic fixes:
Restriction class simplification:
UserConfig
they handle and they can just listen to updates to apply new settings on the flyAdmins now get an entry in the config file too:
Restriction
class, if an account doesn't have an entry in the config file, it will be automatically created so that when an admin restricts itself, the changes can be applied to an already existing config and sessionOverall, after this branch, the plug should feel much better and actually work the way it's meant to be. Currently, master has a lot of problems applying the settings to the current user and handling restrictions for different users correctly.
Fixes #28. Fixes #55.