fix(service): pass ISO file descriptor instead of path over D-Bus - #133
Merged
Merged
Conversation
Reviewer's GuideThe PR hardens ISO access under ProtectHome=true and PrivateTmp=true by opening files in the front end, passing Unix file descriptors over D-Bus, and resolving them through /proc/self/fd in the service. It updates the D-Bus contract, service implementation, ownership/inheritance handling, deployment configuration, and tests. Sequence diagram for D-Bus ISO file descriptor transfersequenceDiagram
participant Frontend
participant Dbus as D-Bus
participant Service as BootMakerService
participant Worker as BootMaker
participant Child as 7z_or_isoinfo
Frontend->>Frontend: openReadOnlyFd(image)
Frontend->>Dbus: Install(device, partition, formatDevice, fd)
Dbus->>Service: Install(..., QDBusUnixFileDescriptor)
Service->>Service: fcntl(fd, F_SETFD, 0)
Service->>Service: imageFd = fd
Service->>Worker: startInstall(/proc/self/fd/n, device, partition, formatDevice)
Worker->>Child: Open /proc/self/fd/n
Child-->>Worker: Read ISO through inherited descriptor
Sequence diagram for D-Bus file validationsequenceDiagram
participant Frontend
participant Dbus as D-Bus
participant Service as BootMakerService
participant Worker as BootMaker
Frontend->>Frontend: openReadOnlyFd(filepath)
Frontend->>Dbus: CheckFile(fd)
Dbus->>Service: CheckFile(QDBusUnixFileDescriptor)
Service->>Service: fcntl(fd, F_SETFD, 0)
Service->>Worker: checkfile(/proc/self/fd/n)
Worker-->>Service: Validation result
Service-->>Frontend: bool
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 2 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="src/libdbm/backend/bmdbusinterface.h" line_range="49-51" />
<code_context>
+ // paths. Open the ISO here (in the caller's process, which can) and
+ // pass only the descriptor over D-Bus; the service reopens it via
+ // /proc/self/fd/<n>. The path itself never crosses the bus.
+ QDBusUnixFileDescriptor fd = openReadOnlyFd(image);
QList<QVariant> argumentList;
- argumentList << QVariant::fromValue(image) << QVariant::fromValue(device) << QVariant::fromValue(partition) << QVariant::fromValue(formatDevice);
+ argumentList << QVariant::fromValue(device) << QVariant::fromValue(partition) << QVariant::fromValue(formatDevice) << QVariant::fromValue(fd);
return asyncCallWithArgumentList(QStringLiteral("Install"), argumentList);
}
</code_context>
<issue_to_address>
**issue (bug_risk):** The D-Bus proxy changes `Install` and `CheckFile` to require file descriptors, but `BMDbusHandler::install` and `BMDbusHandler::checkfile` still pass the old path-based arguments. These callers no longer match the proxy signatures, so the Linux frontend fails to compile.
**Triggers:** When building the Linux frontend.
**Suggested fix:** Update `BMDbusHandler` and the higher-level frontend APIs to open the image path and pass a `QDBusUnixFileDescriptor`, or provide a complete path-to-descriptor conversion before calling the proxy.
</issue_to_address>
### Comment 2
<location path="src/libdbm/backend/bmdbusinterface.h" line_range="49-51" />
<code_context>
+ // paths. Open the ISO here (in the caller's process, which can) and
+ // pass only the descriptor over D-Bus; the service reopens it via
+ // /proc/self/fd/<n>. The path itself never crosses the bus.
+ QDBusUnixFileDescriptor fd = openReadOnlyFd(image);
QList<QVariant> argumentList;
- argumentList << QVariant::fromValue(image) << QVariant::fromValue(device) << QVariant::fromValue(partition) << QVariant::fromValue(formatDevice);
+ argumentList << QVariant::fromValue(device) << QVariant::fromValue(partition) << QVariant::fromValue(formatDevice) << QVariant::fromValue(fd);
return asyncCallWithArgumentList(QStringLiteral("Install"), argumentList);
}
</code_context>
<issue_to_address>
**issue (bug_risk):** The proxy silently converts any failed path open into an invalid descriptor, and the asynchronous D-Bus call is still sent. The service then rejects the request as a generic invalid-descriptor failure, so callers lose the original open error and receive no immediate indication that the ISO path was unreadable.
**Triggers:** When the frontend cannot open the ISO, including a nonexistent path, permission denial, or an empty path.
**Suggested fix:** Check `fd.isValid()` in the proxy or caller before sending the request and propagate a specific local error instead of issuing a doomed D-Bus call.
</issue_to_address>
The bootmaker service runs with ProtectHome=true and PrivateTmp=true, so it cannot reach /home or /tmp by path. Open the ISO in the front-end and pass only the descriptor over D-Bus; the service reopens it via /proc/self/fd. 启用ProtectHome和PrivateTmp加固服务，D-Bus接口改为传递文件描述符而非 路径，服务通过/proc/self/fd访问ISO文件。 Log: 加固bootmaker服务，使用文件描述符替代路径传递 PMS: BUG-376053 Influence: Install和CheckFile接口参数从路径改为文件描述符，需配合前端同步更新调用方式。
wangrong1069
force-pushed
the
pr0903
branch
from
September 14, 2026 08:01
a4f2e8b to
e044015
Compare
lzwind
approved these changes
Sep 14, 2026
Contributor
Author
|
/merge |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: lzwind, wangrong1069 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bootmaker service runs with ProtectHome=true and PrivateTmp=true, so it cannot reach /home or /tmp by path. Open the ISO in the front-end and pass only the descriptor over D-Bus; the service reopens it via /proc/self/fd.
启用ProtectHome和PrivateTmp加固服务，D-Bus接口改为传递文件描述符而非
路径，服务通过/proc/self/fd访问ISO文件。
Log: 加固bootmaker服务，使用文件描述符替代路径传递
PMS: BUG-376053
Influence: Install和CheckFile接口参数从路径改为文件描述符，需配合前端同步更新调用方式。
Summary by Sourcery
Replace path-based ISO transfer with file-descriptor passing across the bootmaker D-Bus interface.
Bug Fixes:
Enhancements:
Deployment:
Tests: