Restriction rewrite

[donadigo]

This PR overhauls how currently restrictions work within the daemon and how the app restriction works internally. There's a lot of changes but they are needed to progress further and fix #75 and #78.

I would like to mention that this PR does not touch UI code at all and so it doesn't fix any issues currently present in the plug code, those will be fixed separately.

Here's what's changed:

1. App restriction was reworked:
   • In master we currently have a C library that constantly listens to incoming messages from the kernel and then if a process is launched that is blocked on an account, it is forcefully killed by the daemon. This has a few downsides mainly:
   • a while loop running and filtering messages constantly
   • the process actually starts but is killed by the daemon which isn't ideal
   • maintaining a C library separately

• In this branch the C library was completely removed and replaced with the following:

  • when an admin blocks an app, the daemon gets a request and uses a built-in setfacl (TODO: check if this exists on other distros) command to revoke access to the executable for the specific user e.g: setfacl -m u:user:--- /path/to/exec This blocks the user from executing the file.

  • To provide the UI when the user wants to launch a restricted exec, the daemon finds the .desktop file for the exec, copies it to the .local/share/application directory of the user and replaces the Path field with a path to the PC client that handles showing the not available / authentication dialog (the copying part is done once when the admin sets the restrictions) This way the app menu or plank don't require any changes.

2. Web restriction command was changed to use URL's instead of IP addresses:

• In master the daemon has to resolve restricted URL's into IP addresses before sending them off to iptables
• In this branch we just directly send the URL string into iptables and let it handle stuff out automatically

3. Logic fixes:

   • Some of the if condititions were just plain wrong like the one here: https://github.com/elementary/switchboard-plug-parental-controls/pull/87/files#diff-87672994b6dd06aa556a9488454c10b1R100, this one was fixed

4. Restriction class simplification:

   • The restriction subclasses now directly receive the UserConfig they handle and they can just listen to updates to apply new settings on the fly

5. Admins now get an entry in the config file too:

   • Because of the simplifications in the Restriction class, if an account doesn't have an entry in the config file, it will be automatically created so that when an admin restricts itself, the changes can be applied to an already existing config and session

Overall, after this branch, the plug should feel much better and actually work the way it's meant to be. Currently, master has a lot of problems applying the settings to the current user and handling restrictions for different users correctly.

Fixes #28. Fixes #55.

[donadigo]

@danrabbit @tintou updated the description & resolved the issues. This is now ready to review.

[danirabbit]

Can you split this out into multiple branches? It's a bit too much to review all at once.

Specifically regarding web restrictions, I think we did IP addresses so that it couldn't be circumvented with a proxy, no?

[donadigo]

@danrabbit I've removed the changes that affect how web restrictions work and will do a pull request separately. I don't think that I'll be able to revert any more changes in this branch tbh. Master isn't even comparable to this branch because it doesn't really work or it's a hit or miss.

It's now ready to review again.

[cassidyjames]

I need to find where this is in the code, but it looks like the icon might be broken in this dialog?

[cassidyjames]

Somehow when enabling "Allow access to these apps with admin permission", I get many launches of apps after I authenticate. I.e. block Calculator, then try to launch it, authenticate, and 7 copies pop up. Same with a web browser trying to open a link, authenticate, then several windows or tabs open.

[mwoyak]

Sorry guys, but I'm rather new to this so please bear with me. It seems like the parental control not working issue dates back to at least February of 2019 and when I freshly downloaded the OS earlier this month, it still wasn't working with a native installation of the most up-to-date OS image. Unfortunately, I don't have the Linux or coding experience to understand how to implement the changes indicated above myself.

But with parental controls as part of the basic feature set of the OS, does anyone know if this issue is being addressed in the official OS release? Or is it up to each person who downloads the OS to implement the work-arounds on their own?