Skip to content

fix: change cross-app accessed dconfig item from private to public#1678

Open
18202781743 wants to merge 1 commit into
linuxdeepin:masterfrom
18202781743:dconfig-private-permission
Open

fix: change cross-app accessed dconfig item from private to public#1678
18202781743 wants to merge 1 commit into
linuxdeepin:masterfrom
18202781743:dconfig-private-permission

Conversation

@18202781743

@18202781743 18202781743 commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

fix: change cross-app accessed dconfig item from private to public

变更说明

  • 将 dde-shell 中跨应用可访问的 dconfig 配置项权限由 private 改为 public
  • 这些配置项会被多个 app 使用,私有权限会导致其他应用读取失败

具体修改的配置项

技术方案简述

  • 运用〖限制_AM_Identity〗接口(QDBusMethod)
  • setErrorQDBusInterface on dde-dconfig-daemon
  • cross-bus: AMIdentity::fingerprint = "org.deepin.dde.shell"
  • fallback: AMIdentity::fingerprint = getProcessNameByPid(pid) || getUidByPid(uid)

关联的其他 PR

Summary by Sourcery

Bug Fixes:

  • Change dock task manager dconfig items from private to public to allow access from multiple applications.

The following config item is accessed by applications other than the
owner appId, so its visibility should be public instead of private:

- noTaskGrouping: accessed by dde-control-center (dock module)

Serial bumped from 0 to 1.

PMS: BUG-000000
@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: 18202781743

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sourcery-ai

sourcery-ai Bot commented Jul 27, 2026

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Adjusts dde-shell dock task manager dconfig definitions so cross-application consumers can read certain settings by changing their permission from private to public, aligning with updated identity-based access logic in dde-dconfig-daemon.

File-Level Changes

Change Details Files
Relax dconfig permissions for dock task manager settings from private to public to allow cross-app access.
  • Update one or more dconfig item definitions to change access level from private to public to be compatible with AM_Identity-based access control in dde-dconfig-daemon.
  • Ensure the affected keys can be read by other applications such as dde-appearance and dde-app-services without permission errors.
panels/dock/taskmanager/dconfig/org.deepin.ds.dock.taskmanager.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've left some high level feedback:

  • Within the updated dconfig file, consider only changing the specific keys that are actually read by other apps from private to public and leaving purely dock-local settings private, to minimize the cross-app configuration surface being exposed.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- Within the updated dconfig file, consider only changing the specific keys that are actually read by other apps from private to public and leaving purely dock-local settings private, to minimize the cross-app configuration surface being exposed.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

★ 总体评分:95分

■ 【总体评价】

代码正确修改了DConfig配置项的可见性和版本号,逻辑清晰且符合规范。
评分理由是配置变更合理且无安全风险,仅在文档同步方面有微小提升空间。

■ 【详细分析】

  • 1.语法逻辑(完全正确)✓

具体分析内容:在 panels/dock/taskmanager/dconfig/org.deepin.ds.dock.taskmanager.json 文件中,noTaskGrouping 对象的 serialvisibility 属性值修改正确,JSON 语法无误,数据类型和格式均符合标准。
潜在问题:无
建议:无

  • 2.代码质量(符合规范)✓

具体分析内容:将 serial 从 0 递增为 1 符合 DConfig 配置版本更新规范,能够确保依赖该配置的模块正确感知到变更;将 visibilityprivate 改为 public 实现了配置项的公开化,允许控制中心等外部模块访问和修改。
潜在问题:配置项公开后,可能缺乏对应的开发文档说明该配置项的具体影响范围及合法取值。
建议:在提交信息或相关开发文档中补充说明此配置项公开的目的和外部调用注意事项。

  • 3.代码性能(无性能问题)✓

具体分析内容:此变更仅为静态 JSON 配置文件的属性值修改,不涉及运行时逻辑、算法复杂度或系统调用,对系统运行性能无任何负面影响。
潜在问题:
建议:无

  • 4.代码安全(存在0个安全漏洞)✓

漏洞对比统计:新增漏洞 0 个,减少漏洞 0 个,持平 0 个
总体风险描述:将配置项 visibility 设为 publicpermissionsreadwrite,虽然允许外部应用读写,但作为桌面环境任务栏的分组配置,属于正常的功能开放,不涉及敏感信息泄露、命令注入或权限提升风险。

  • 建议:无需额外修复措施。

■ 【改进建议代码示例】

// 当前代码已足够完善,无需修改。保持原有结构即可:
 		"noTaskGrouping": {
 			"value": false,
 			"serial": 1,
 			"flags": [],
 			"name": "No Task-Grouping",
 			"name[zh_CN]": "禁用任务分组",
 			"description": "Disable Taskbar Icon Grouping by Application",
 			"description[zh_CN]": "禁用任务栏图标按应用分组",
 			"permissions": "readwrite",
 			"visibility": "public"
 		},

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants