From 33276029e70013e7f759dd77a327821fab003fc2 Mon Sep 17 00:00:00 2001 From: wubowen Date: Wed, 19 Apr 2023 13:11:57 +0800 Subject: [PATCH 1/8] chore: add Permissions type of AuthorizedReadOnly and AuthorizedReadWrite MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 添加管控类型 Log: 添加管控类型 Influence: 管控进程 Task: https://pms.uniontech.com/task-view-260335.html Change-Id: I2b8725aecd36ca5e0dac0a80fa43b86796e26141 (cherry picked from commit 80b59ee4cb35ea083ec7f5158c0e31e30f4ff740) (cherry picked from commit 7f00fdc3b408b89ff2993ac151c5c1bd6997d13a) --- .../dde-dconfig-daemon/dconfig_global.h | 47 ++++++++++++++ .../dde-dconfig-daemon/dconfigconn.cpp | 64 ++++++++++++++++++- .../dde-dconfig-daemon/dconfigconn.h | 3 + 3 files changed, 111 insertions(+), 3 deletions(-) diff --git a/dconfig-center/dde-dconfig-daemon/dconfig_global.h b/dconfig-center/dde-dconfig-daemon/dconfig_global.h index f2423a3..7f89216 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfig_global.h +++ b/dconfig-center/dde-dconfig-daemon/dconfig_global.h @@ -14,6 +14,14 @@ #include #include "helper.hpp" +#ifdef Q_OS_LINUX +#include +#include +#include +#include +#include +#endif + Q_DECLARE_LOGGING_CATEGORY(cfLog); // /appid/filename/subpath/userid @@ -26,8 +34,11 @@ using ConnServiceName = QString; using ConnRefCount = int; // user: u-${ConnKey}, global: g-${ResourceKey} using ConfigCacheKey = QString; + static constexpr int TestUid = 0U; static const QString VirtualInterAppId = "_"; +const QString authorizedreadonly = QString("authorizedreadonly"); +const QString authorizedreadwrite = QString("authorizedreadwrite"); inline QString formatDBusObjectPath(QString path) { @@ -231,3 +242,39 @@ inline QString configPrefixPath() } return path; } + +inline int check_caller_sid2(pid_t caller_pid) +{ + char sid2_attr_path[PATH_MAX] = {0}; + snprintf(sid2_attr_path, PATH_MAX, "/proc/%d/attr/sid2", caller_pid); + FILE* fp_sid2_attr = fopen(sid2_attr_path, "r"); + if(fp_sid2_attr == NULL){ + qWarning() << QString("process %1 has no sid2\n").arg(caller_pid); + return -EPERM; + } + + char sid2[256] = {0}; + size_t nread = fread( sid2, 1, 256, fp_sid2_attr); + fclose(fp_sid2_attr); + if(nread < 1){ + qWarning() << QString("process %1 %2 has no sid2\n").arg(caller_pid).arg(sid2_attr_path); + return -EPERM; + } + + // [APPID_TYPE] = "deepin_app", + // [SYSID_TYPE] = "deepin_sys", + // [SECID_TYPE] = "deepin_sec", + // [安全服务] "deepin_perm_manager_sidtwo_t" + // cat /proc/[pid_t]/attr/sid2 -> system_u:object_r:deepin_sec_1_t:s0 + // 只有签名的安全厂商应用运行才有此selinux2 label。 + if( strstr(sid2, "deepin_app") == NULL && + strstr(sid2, "deepin_sys") == NULL && + strstr(sid2, "deepin_sec") == NULL && + strstr(sid2, "perm_manager_sidtwo_t") == NULL + ) { + qWarning() << QString("process %1 has [%2] no sid2 app label\n").arg(caller_pid).arg(sid2); + return -EPERM; + } + + return 0; +} diff --git a/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp b/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp index bacf7df..113e09b 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp +++ b/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp @@ -112,7 +112,7 @@ void DSGConfigConn::release() */ void DSGConfigConn::setValue(const QString &key, const QDBusVariant &value) { - if (!contains(key)) + if (!checkValid(key)) return; if (!hasPermissionByUid(key)) @@ -132,7 +132,7 @@ void DSGConfigConn::setValue(const QString &key, const QDBusVariant &value) void DSGConfigConn::reset(const QString &key) { - if (!contains(key)) + if (!checkValid(key)) return; qCDebug(cfLog) << "Reset value, key:" << key << ", old value:" << file()->value(key, cache()); @@ -230,7 +230,17 @@ QString DSGConfigConn::permissions(const QString &key) if (!contains(key)) return QString(); - return meta()->permissions(key) == DTK_CORE_NAMESPACE::DConfigFile::ReadWrite ? QString("readwrite") : QString("readonly"); + switch (meta()->permissions(key)) { + case DTK_CORE_NAMESPACE::DConfigFile::ReadOnly: + return QString("readonly"); + case DTK_CORE_NAMESPACE::DConfigFile::ReadWrite: + return QString("readwrite"); + case DTK_CORE_NAMESPACE::DConfigFile::AuthorizedReadOnly: + return authorizedreadonly; + case DTK_CORE_NAMESPACE::DConfigFile::AuthorizedReadWrite: + return authorizedreadwrite; + } + return QString("readonly"); } int DSGConfigConn::flags(const QString &key) @@ -251,6 +261,36 @@ QString DSGConfigConn::getAppid() const return QString("testappid"); } +QString DSGConfigConn::getPermissions(const QString &key) +{ + switch (meta()->permissions(key)) { + case DTK_CORE_NAMESPACE::DConfigFile::ReadOnly: + return QString("readonly"); + case DTK_CORE_NAMESPACE::DConfigFile::ReadWrite: + return QString("readwrite"); + case DTK_CORE_NAMESPACE::DConfigFile::AuthorizedReadOnly: + return authorizedreadonly; + case DTK_CORE_NAMESPACE::DConfigFile::AuthorizedReadWrite: + return authorizedreadwrite; + } + return QString("readonly"); +} + +bool DSGConfigConn::checkDBusSender(const QString &key) +{ + QString permission = getPermissions(key); + if (permission == authorizedreadonly || permission == authorizedreadwrite) { + if (!calledFromDBus()) { + qWarning() << "[checkDBusSender] not called by dbus."; + return false; + } + uint pid = connection().interface()->servicePid(message().service()); + qInfo() << "[checkDBusSender] dbus sender pid : " << pid; + return check_caller_sid2(static_cast(pid)) == 0; + } + return true; +} + bool DSGConfigConn::contains(const QString &key) { if (containsWithoutProp(key)) @@ -301,3 +341,21 @@ bool DSGConfigConn::hasPermissionByUid(const QString &key) const } return hasPermission; } + +bool DSGConfigConn::checkValid(const QString &key) +{ + bool ret = false; + if (!contains(key)) { + return ret; + } + + ret = checkDBusSender(key); + if (!ret) { + QString errorMsg = QString("[%1] requires Non-sid2 configure item [%2] in [%3].").arg(getAppid()).arg(key).arg(m_key); + if (calledFromDBus()) + sendErrorReply(QDBusError::Failed, errorMsg); + qWarning() << errorMsg; + } + + return ret; +} diff --git a/dconfig-center/dde-dconfig-daemon/dconfigconn.h b/dconfig-center/dde-dconfig-daemon/dconfigconn.h index 67d12a6..2381ea0 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigconn.h +++ b/dconfig-center/dde-dconfig-daemon/dconfigconn.h @@ -62,11 +62,14 @@ public Q_SLOTS: // METHODS private: QString getAppid() const; + QString getPermissions(const QString &key); + bool checkDBusSender(const QString &key); bool contains(const QString &key); DTK_CORE_NAMESPACE::DConfigMeta *meta() const; DTK_CORE_NAMESPACE::DConfigFile *file() const; DTK_CORE_NAMESPACE::DConfigCache *cache() const; bool hasPermissionByUid(const QString &key) const; + bool checkValid(const QString &key); private: ConnKey m_key; From 00e708540d76c3153f05e3bc04086f857b7da47c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=A6=83=E6=9C=AC=E5=AD=A6?= Date: Tue, 7 Nov 2023 15:04:26 +0800 Subject: [PATCH 2/8] =?UTF-8?q?fix:=20OEM=E5=AF=B9=E8=AF=9D=E6=A1=86?= =?UTF-8?q?=E8=A1=A8=E5=A4=B4=E6=94=B9=E4=B8=BA=E5=8F=AF=E8=B0=83=E6=95=B4?= =?UTF-8?q?=E5=A4=A7=E5=B0=8F,=E5=A2=9E=E5=8A=A0=E6=9C=80=E5=B0=8F?= =?UTF-8?q?=E6=9C=80=E5=A4=A7=E5=8C=96=E6=8C=89=E9=92=AE,=E7=BB=93?= =?UTF-8?q?=E6=9E=9C=E6=94=B9=E5=8F=98=E7=AA=97=E5=8F=A3=E6=A8=AA=E5=90=91?= =?UTF-8?q?=E6=BB=9A=E5=8A=A8=E6=9D=A1=E8=AE=BE=E4=B8=BA=E4=B8=80=E7=9B=B4?= =?UTF-8?q?=E6=98=BE=E7=A4=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OEM对话框表头改为可调整大小,增加最小最大化按钮,结果改变窗口横向滚动条设为一直显示 Log: OEM对话框表头改为可调整大小,增加最小最大化按钮,结果改变窗口横向滚动条设为一直显示 Task: https://pms.uniontech.com/task-view-303031.html Influence: dde-dconfig-editor的OEM对话框 Change-Id: I542861e38845f2ebc45ce175f011fb5a1946f577 (cherry picked from commit 721cb5a3aedc7ac57a13d79fe443ccd3afd420ef) --- dconfig-center/dde-dconfig-editor/mainwindow.cpp | 2 +- dconfig-center/dde-dconfig-editor/oemdialog.cpp | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/dconfig-center/dde-dconfig-editor/mainwindow.cpp b/dconfig-center/dde-dconfig-editor/mainwindow.cpp index baa6570..08ebbc6 100644 --- a/dconfig-center/dde-dconfig-editor/mainwindow.cpp +++ b/dconfig-center/dde-dconfig-editor/mainwindow.cpp @@ -200,7 +200,7 @@ MainWindow::MainWindow(QWidget *parent) : oemView->show(); }); oemView = new OEMDialog(this); - oemView->setFixedSize(QSize(800, 600)); + oemView->setMinimumSize(QSize(800, 600)); installTranslate(); diff --git a/dconfig-center/dde-dconfig-editor/oemdialog.cpp b/dconfig-center/dde-dconfig-editor/oemdialog.cpp index b784cee..626669c 100644 --- a/dconfig-center/dde-dconfig-editor/oemdialog.cpp +++ b/dconfig-center/dde-dconfig-editor/oemdialog.cpp @@ -21,6 +21,7 @@ OEMDialog::OEMDialog(QWidget *parent) : DDialog( parent) { + setWindowFlags(windowFlags() | Qt::WindowMinMaxButtonsHint); m_exportView = new QTreeView(); m_exportView->setEditTriggers(QAbstractItemView::NoEditTriggers); m_exportView->header()->setMinimumSectionSize(400); @@ -51,6 +52,8 @@ void OEMDialog::loadData(const QString &language) m_model = new QStandardItemModel(this); m_model->setHorizontalHeaderLabels(QStringList() << QStringLiteral("项") << QStringLiteral("值")); m_exportView->setModel(m_model); + m_exportView->header()->setSectionResizeMode(QHeaderView::Interactive); + m_exportView->header()->resizeSection(0, 250); const auto &apps = applications(); for (auto app : apps) { @@ -249,6 +252,7 @@ void OEMDialog::displayChangedResult() d->setAttribute(Qt::WA_DeleteOnClose, true); QTableView *view = new QTableView(this); + view->setHorizontalScrollBarPolicy(Qt::ScrollBarAlwaysOn); view->setEditTriggers(QAbstractItemView::NoEditTriggers); view->horizontalHeader()->setStretchLastSection(true); view->horizontalHeader()->setSectionResizeMode(QHeaderView::ResizeToContents); From 6be9d4091c8db7a4897239259b014b84732adc6e Mon Sep 17 00:00:00 2001 From: wangshaojun Date: Tue, 25 Feb 2025 10:02:59 +0800 Subject: [PATCH 3/8] =?UTF-8?q?fix:=20oem=E5=AF=BC=E5=87=BA=E7=9A=84?= =?UTF-8?q?=E6=95=B0=E7=BB=84=E7=B1=BB=E5=9E=8B=E4=B8=8D=E5=AF=B9=E5=AF=BC?= =?UTF-8?q?=E8=87=B4overrides=E5=A4=B1=E6=95=88?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 导出数据做一步数组判断和转换 Log: oem导出的数组类型不对导致overrides失效 Influence: 导出配置 Change-Id: I101777e7e917acb44a358b3095ad11663f2c5e60 (cherry picked from commit a699f1c209b17369f0d492847850cd79f227bd81) --- dconfig-center/dde-dconfig-editor/oemdialog.cpp | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/dconfig-center/dde-dconfig-editor/oemdialog.cpp b/dconfig-center/dde-dconfig-editor/oemdialog.cpp index 626669c..9f2a041 100644 --- a/dconfig-center/dde-dconfig-editor/oemdialog.cpp +++ b/dconfig-center/dde-dconfig-editor/oemdialog.cpp @@ -17,6 +17,7 @@ #include #include #include +#include OEMDialog::OEMDialog(QWidget *parent) : DDialog( parent) @@ -321,7 +322,17 @@ void OEMDialog::createJsonFile(const QString &fileName, const QListdata(ValueRole))); + QVariant variant = item->data(ValueRole); + QJsonValue val = QJsonValue::fromVariant(variant); + if (variant.canConvert()) { + QString str = variant.toString(); + QJsonDocument doc = QJsonDocument::fromJson(str.toUtf8()); + if (!doc.isNull() && doc.isArray()) { + val = doc.array(); + } + } + + keyObject.insert("value", val); keyObject.insert("serial", 0); keyObject.insert("permissions", "readwrite"); contentsObject.insert(item->data(KeyRole).toString(), keyObject); From 1f62df49c40b145a6cdba9a32009fc001d16c00e Mon Sep 17 00:00:00 2001 From: wubowen Date: Tue, 30 Jun 2026 10:34:43 +0800 Subject: [PATCH 4/8] =?UTF-8?q?fix:=20=E9=99=90=E5=88=B6D-Bus=E6=8E=A5?= =?UTF-8?q?=E5=8F=A3=E4=BB=85=E5=85=81=E8=AE=B8root=E7=94=A8=E6=88=B7?= =?UTF-8?q?=E8=B0=83=E7=94=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. 修改 check_caller_sid2 函数，增加 uid 参数，并在函数入口处增加权限拦 截，仅允许 root 用户（uid为0）继续执行后续的安全上下文检查，非 root 用户 直接返回 EPERM 错误 2. 更新 checkDBusSender 函数中的 D-Bus 调用者信息获取逻辑，从仅获取 pid 改为同步获取调用者的 uid 和 pid 3. 增加 D-Bus 获取 uid 和 pid 返回值的有效性校验，防止因获取失败导致的潜 在异常或越权 4. 此改动修复了原先仅依赖进程 sid2 属性校验而忽略用户身份导致的权限控制 不严格问题，提升了 dconfig 守护进程的安全防护能力 Influence: 1. 测试非 root 用户通过 D-Bus 触发权限校验逻辑，验证是否被正确拦截并返回 权限错误 2. 测试 root 用户通过 D-Bus 调用相关接口，验证原有功能是否正常执行 3. 模拟 D-Bus 底层获取 uid 或 pid 失败的异常情况，验证接口是否安全降级返 回失败 4. 检查 dconfig-daemon 运行日志，确认非 root 用户调用时打印了预期的 uid != 0 告警信息 5. 验证普通应用正常的 dconfig 配置读取流程是否受到异常影响 Bug: https://pms.uniontech.com/bug-view-367861.html Change-Id: I7d56594e1a255af87590697986af02f85962dc54 (cherry picked from commit 29198c6f15e6194842c737cdf3d41ec07a6be6ad) --- dconfig-center/dde-dconfig-daemon/dconfig_global.h | 6 +++++- dconfig-center/dde-dconfig-daemon/dconfigconn.cpp | 13 +++++++++++-- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/dconfig-center/dde-dconfig-daemon/dconfig_global.h b/dconfig-center/dde-dconfig-daemon/dconfig_global.h index 7f89216..be95e07 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfig_global.h +++ b/dconfig-center/dde-dconfig-daemon/dconfig_global.h @@ -243,8 +243,12 @@ inline QString configPrefixPath() return path; } -inline int check_caller_sid2(pid_t caller_pid) +inline int check_caller_sid2(uint uid, pid_t caller_pid) { + if (uid != 0) { + qWarning() << "[check_caller_sid2] uid != 0, uid : " << uid; + return -EPERM; + } char sid2_attr_path[PATH_MAX] = {0}; snprintf(sid2_attr_path, PATH_MAX, "/proc/%d/attr/sid2", caller_pid); FILE* fp_sid2_attr = fopen(sid2_attr_path, "r"); diff --git a/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp b/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp index 113e09b..e9ed5ed 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp +++ b/dconfig-center/dde-dconfig-daemon/dconfigconn.cpp @@ -284,9 +284,18 @@ bool DSGConfigConn::checkDBusSender(const QString &key) qWarning() << "[checkDBusSender] not called by dbus."; return false; } - uint pid = connection().interface()->servicePid(message().service()); + auto service = message().service(); + const auto uidReply = connection().interface()->serviceUid(service); + const auto pidReply = connection().interface()->servicePid(service); + if (!uidReply.isValid() || !pidReply.isValid()) { + qWarning() << "[checkDBusSender] failed to get dbus sender uid or pid."; + return false; + } + + uint uid = uidReply.value(); + uint pid = pidReply.value(); qInfo() << "[checkDBusSender] dbus sender pid : " << pid; - return check_caller_sid2(static_cast(pid)) == 0; + return check_caller_sid2(uid, static_cast(pid)) == 0; } return true; } From 8b5663185e2e5954413c60b1712b4ca5ad133daf Mon Sep 17 00:00:00 2001 From: wangshaojun Date: Tue, 8 Jul 2025 15:28:25 +0800 Subject: [PATCH 5/8] =?UTF-8?q?refactor:=20=E4=BD=BF=E7=94=A8=20qAsConst?= =?UTF-8?q?=20=E6=9B=BF=E6=8D=A2=20std::as=5Fconst=20=E5=B9=B6=E6=9B=B4?= =?UTF-8?q?=E6=96=B0=E6=96=87=E4=BB=B6=E6=97=B6=E9=97=B4=E6=88=B3=E5=A4=84?= =?UTF-8?q?=E7=90=86?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. 将所有 std::as_const 实例替换为 Qt 的 qAsConst 以提高与 Qt 容器的兼 容性 2. 通过移除 QTimeZone::UTC 参数将文件元数据时间戳处理从 UTC 改为本地时间 3. 在头文件中添加缺失的 QDateTime 包含以支持时间戳操作 4. 在实现文件中添加 DConfigFile 包含以确保功能完整性 这些更改提高了与 Qt 容器的兼容性，简化了时间戳处理，同时确保包含了所有必 需的头文件。qAsConst 更适合 Qt 容器，而本地时间戳足以满足文件变更检测的 需求。 Change-Id: I8d503fdc06876a9eb891eaa7384e6f0827968ac0 (cherry picked from commit e809ff37a2ec1b924905a722fa09e2ffe9d84cb1) --- dconfig-center/dde-dconfig-daemon/dconfigserver.cpp | 11 ++++++----- dconfig-center/dde-dconfig-daemon/dconfigserver.h | 1 + 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp b/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp index ad9f68d..f236f2d 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp +++ b/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp @@ -14,6 +14,7 @@ #include #include #include +#include #include "configmanager_adaptor.h" @@ -542,7 +543,7 @@ void DSGConfigServer::reload() // Find changed files auto diffConfigureFiles = [] (const QVector &s1, const QVector &s2) { QStringList diffs; - for (const auto& item : std::as_const(s1)) { + for (const auto& item : qAsConst(s1)) { auto iter = std::find_if(s2.cbegin(), s2.cend(), [&item](const FileSignature& other) { return item.filePath == other.filePath; }); @@ -566,7 +567,7 @@ void DSGConfigServer::reload() // Process changed files int failedCount = 0; - for (const auto &file : std::as_const(changedFiles)) { + for (const auto &file : qAsConst(changedFiles)) { const auto errorMsg = updateInternal(file); if (errorMsg) { qCWarning(cfLog()) << "Reload failed to update file:" << file << ", reason:" << *errorMsg; @@ -592,12 +593,12 @@ QVector DSGConfigServer::allConfigureFileSignatu QStringList overrideDirs { QString("%1/etc/dsg/configs/overrides").arg(localPrefix) }; - for (const auto &dir : std::as_const(metaDirs)) { + for (const auto &dir : qAsConst(metaDirs)) { overrideDirs << QString("%1/overrides").arg(dir); } dirs << overrideDirs; - for (const QString &dir : std::as_const(dirs)) { + for (const QString &dir : qAsConst(dirs)) { if (!QDir(dir).exists()) continue; @@ -612,7 +613,7 @@ QVector DSGConfigServer::allConfigureFileSignatu DSGConfigServer::FileSignature signature; signature.filePath = filePath; signature.size = fileInfo.size(); - signature.changeTime = fileInfo.metadataChangeTime(QTimeZone::UTC); + signature.changeTime = fileInfo.metadataChangeTime(); signatures << signature; } diff --git a/dconfig-center/dde-dconfig-daemon/dconfigserver.h b/dconfig-center/dde-dconfig-daemon/dconfigserver.h index f4127da..4abc9bb 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigserver.h +++ b/dconfig-center/dde-dconfig-daemon/dconfigserver.h @@ -10,6 +10,7 @@ #include #include #include +#include class DSGConfigResource; class RefManager; From b57576687af06644f879c6a046a6ca7e7fb2fa57 Mon Sep 17 00:00:00 2001 From: yeshanshan Date: Wed, 2 Sep 2026 17:23:43 +0800 Subject: [PATCH 6/8] feat: support dual Qt5/Qt6 builds with separated runtime resources MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Bump C++ standard from C++14 to C++17 to resolve std::optional compilation failures 2. Replace qAsConst with std::as_const to eliminate Qt6 deprecation warnings 3. Add Qt5-specific systemd service, D-Bus config/activation, and PolicyKit policy files 4. Update CMake installation logic to select runtime resources based on QT_VERSION_MAJOR 5. Rename installed resource files to canonical names for consistent packaging regardless of Qt version 6. Use timezone-agnostic QFileInfo::metadataChangeTime() for Qt5/Qt6 compatibility 7. Include documentation for v20/v25 code integration strategy Log: Added Qt5-compatible runtime resources and unified build configuration for dual Qt version support Influence: 1. Verify Qt5 build compiles successfully without warnings 2. Verify Qt6 build compiles successfully without regressions 3. Verify Qt5 installation places service/config/policy files in correct destinations 4. Verify Qt6 installation places service/config files in correct destinations without PolicyKit policy 5. Verify installed D-Bus service activation and config allow correct daemon access 6. Verify installed systemd service file has proper sandboxing options and starts daemon successfully 7. Run unit tests on both Qt5 and Qt6 builds to confirm all pass feat: 支持 Qt5/Qt6 双版本构建并分离运行时资源 1. 将 C++ 标准从 C++14 提升至 C++17，解决 std::optional 编译失败问题 2. 用 std::as_const 替换 qAsConst，消除 Qt6 弃用警告 3. 新增 Qt5 专用的 systemd 服务、D-Bus 配置/激活和 PolicyKit 策略文件 4. 更新 CMake 安装逻辑，根据 QT_VERSION_MAJOR 选择运行时资源 5. 将安装的资源文件重命名为规范名称，使不同 Qt 版本的打包保持一致 6. 使用不带时区参数的 QFileInfo::metadataChangeTime()，兼容 Qt5/Qt6 7. 添加 v20/v25 代码整合策略的文档说明 Log: 新增 Qt5 兼容运行时资源并统一双 Qt 版本构建配置 Influence: 1. 验证 Qt5 构建无警告地编译通过 2. 验证 Qt6 构建无回归地编译通过 3. 验证 Qt5 安装时将服务/配置/策略文件放在正确目录 4. 验证 Qt6 安装时将服务/配置文件放在正确目录且不安装 PolicyKit 策略 5. 验证安装后的 D-Bus 服务激活和配置允许守护进程被正确访问 6. 验证安装后的 systemd 服务文件具有正确的沙箱选项并能成功启动守护进程 7. 在 Qt5 和 Qt6 构建上运行单元测试，确认全部通过 --- dconfig-center/CMakeLists.txt | 2 +- .../dde-dconfig-daemon/CMakeLists.txt | 29 ++- .../dde-dconfig-daemon/dconfigserver.cpp | 10 +- .../services/qt5/dde-dconfig-daemon.service | 46 ++++ .../qt5/org.desktopspec.ConfigManager.conf | 39 ++++ .../qt5/org.desktopspec.ConfigManager.policy | 30 +++ .../qt5/org.desktopspec.ConfigManager.service | 4 + .../docs/v20-v25-integration-plan.md | 210 ++++++++++++++++++ 8 files changed, 362 insertions(+), 8 deletions(-) create mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service create mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf create mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy create mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service create mode 100644 dconfig-center/docs/v20-v25-integration-plan.md diff --git a/dconfig-center/CMakeLists.txt b/dconfig-center/CMakeLists.txt index aa8d8a3..9dad635 100644 --- a/dconfig-center/CMakeLists.txt +++ b/dconfig-center/CMakeLists.txt @@ -4,7 +4,7 @@ project(dconfig-center) -set(CMAKE_CXX_STANDARD 14) +set(CMAKE_CXX_STANDARD 17) set(CMAKE_INCLUDE_CURRENT_DIR ON) include(GNUInstallDirs) diff --git a/dconfig-center/dde-dconfig-daemon/CMakeLists.txt b/dconfig-center/dde-dconfig-daemon/CMakeLists.txt index 4a22a8b..92f0c64 100644 --- a/dconfig-center/dde-dconfig-daemon/CMakeLists.txt +++ b/dconfig-center/dde-dconfig-daemon/CMakeLists.txt @@ -33,12 +33,35 @@ set(DCONFIG_XMLS_FILES ) install (FILES ${DCONFIG_XMLS_FILES} DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/interfaces) +if (QT_VERSION_MAJOR EQUAL 5) + set(DBUS_CONFIG_FILE services/qt5/org.desktopspec.ConfigManager.conf) + set(DBUS_SERVICE_FILE services/qt5/org.desktopspec.ConfigManager.service) + set(SYSTEMD_SERVICE_FILE services/qt5/dde-dconfig-daemon.service) + set(POLKIT_POLICY_FILE services/qt5/org.desktopspec.ConfigManager.policy) +else() + set(DBUS_CONFIG_FILE services/org.desktopspec.ConfigManager.conf) + set(DBUS_SERVICE_FILE services/org.desktopspec.ConfigManager.service) + set(SYSTEMD_SERVICE_FILE services/dde-dconfig-daemon.service) +endif() + ## dbus config file -install (FILES services/org.desktopspec.ConfigManager.conf DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system.d) +install(FILES ${DBUS_CONFIG_FILE} + DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system.d + RENAME org.desktopspec.ConfigManager.conf) ## services files -install(FILES services/org.desktopspec.ConfigManager.service DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system-services) -install(FILES services/dde-dconfig-daemon.service DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/systemd/system) +install(FILES ${DBUS_SERVICE_FILE} + DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system-services + RENAME org.desktopspec.ConfigManager.service) +install(FILES ${SYSTEMD_SERVICE_FILE} + DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/systemd/system + RENAME dde-dconfig-daemon.service) + +if (POLKIT_POLICY_FILE) + install(FILES ${POLKIT_POLICY_FILE} + DESTINATION ${CMAKE_INSTALL_DATADIR}/polkit-1/actions + RENAME org.desktopspec.ConfigManager.policy) +endif() ## bin install(TARGETS dde-dconfig-daemon DESTINATION ${CMAKE_INSTALL_BINDIR}) diff --git a/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp b/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp index f236f2d..c9ea155 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp +++ b/dconfig-center/dde-dconfig-daemon/dconfigserver.cpp @@ -16,6 +16,8 @@ #include #include +#include + #include "configmanager_adaptor.h" #define DSG_CONFIG "org.desktopspec.ConfigManager" @@ -543,7 +545,7 @@ void DSGConfigServer::reload() // Find changed files auto diffConfigureFiles = [] (const QVector &s1, const QVector &s2) { QStringList diffs; - for (const auto& item : qAsConst(s1)) { + for (const auto& item : std::as_const(s1)) { auto iter = std::find_if(s2.cbegin(), s2.cend(), [&item](const FileSignature& other) { return item.filePath == other.filePath; }); @@ -567,7 +569,7 @@ void DSGConfigServer::reload() // Process changed files int failedCount = 0; - for (const auto &file : qAsConst(changedFiles)) { + for (const auto &file : std::as_const(changedFiles)) { const auto errorMsg = updateInternal(file); if (errorMsg) { qCWarning(cfLog()) << "Reload failed to update file:" << file << ", reason:" << *errorMsg; @@ -593,12 +595,12 @@ QVector DSGConfigServer::allConfigureFileSignatu QStringList overrideDirs { QString("%1/etc/dsg/configs/overrides").arg(localPrefix) }; - for (const auto &dir : qAsConst(metaDirs)) { + for (const auto &dir : std::as_const(metaDirs)) { overrideDirs << QString("%1/overrides").arg(dir); } dirs << overrideDirs; - for (const QString &dir : qAsConst(dirs)) { + for (const QString &dir : std::as_const(dirs)) { if (!QDir(dir).exists()) continue; diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service b/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service new file mode 100644 index 0000000..82529b8 --- /dev/null +++ b/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service @@ -0,0 +1,46 @@ +[Unit] +Description=deepin dconfig daemon service + +# Ask for the dbus socket. +Wants=dbus.socket +After=dbus.socket + +[Service] +Type=dbus +User=root +BusName=org.desktopspec.ConfigManager +ExecStart=/usr/bin/dde-dconfig-daemon +Restart=always +StartLimitBurst=0 +RestartSec=5 +OOMScoreAdjust=-250 +Environment=DSG_DATA_DIRS=/usr/share/dsg:/persistent/linglong/entries/share/dsg + +ProtectSystem=strict +# 创建/var/dsg目录 +ReadWritePaths=/var/dsg +ReadWritePaths=/home + +InaccessiblePaths=/etc/shadow +InaccessiblePaths=-/etc/NetworkManager/system-connections +InaccessiblePaths=-/etc/pam.d +InaccessiblePaths=-/usr/share/uadp/ + +NoNewPrivileges=true +# 非gloable数据存储在/home +#ProtectHome=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +PrivateMounts=yes +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +# 需要读取/proc的exe uid字段数据 +#PrivateUsers=yes +RestrictNamespaces=yes +LockPersonality=yes +RestrictRealtime=yes +RemoveIPC=yes +MemoryDenyWriteExecute=yes +#MemoryLimit=100M diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf new file mode 100644 index 0000000..5d1183d --- /dev/null +++ b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf @@ -0,0 +1,39 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy new file mode 100644 index 0000000..31977ad --- /dev/null +++ b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy @@ -0,0 +1,30 @@ + + + + + + + Check Authentication + Authentication is required to perform this action + + no + no + auth_admin + + Check Authentication + Authentication is required to perform this action + Check Authentication + Autenticazione richiesta per eseguire questa operazione + Check Authentication + 当前操作需要密码认证 + Hitelesítés ellenőrzése + Hitelesítés szükséges a művelet végrehajtásához + Check Authentication + 目前操作需要密碼認證 + Check Authentication + 當前操作需要密碼認證 + Check Authentication + Tämän toiminnon suorittaminen edellyttää todennusta + + diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service new file mode 100644 index 0000000..985ad22 --- /dev/null +++ b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service @@ -0,0 +1,4 @@ +[D-BUS Service] +Name=org.desktopspec.ConfigManager +Exec=/usr/bin/dde-dconfig-daemon +SystemdService=dde-dconfig-daemon.service diff --git a/dconfig-center/docs/v20-v25-integration-plan.md b/dconfig-center/docs/v20-v25-integration-plan.md new file mode 100644 index 0000000..1e9e9f2 --- /dev/null +++ b/dconfig-center/docs/v20-v25-integration-plan.md @@ -0,0 +1,210 @@ +# dde-app-services v20/v25 代码整合方案 + +## 1. 目标 + +将 `gerrit/develop/eagle` 中仍需保留的功能整合到 +`origin/master`，使同一套 dde-app-services 源码能够使用 DTK5/Qt5 +或 DTK6/Qt6 编译。 + +Qt6 的 systemd service、D-Bus activation 和 D-Bus policy 沿用 v25 +版本；Qt5 构建安装 eagle 对应的运行环境文件。本次不验证 v20 系统运行及 +Debian 打包，只验证 DTK5、DTK6 编译、安装清单和现有单元测试。 + +缓存兼容逻辑在 dtkcore 中实现。DConfig 设置新缓存路径后，每次加载均以 +旧缓存为基础，再使用新缓存覆盖同名键；缓存保存继续使用 dtkcore 已有的 +`DConfigCache::save()` 实现。 + +## 2. 基线与 worktree + +### dde-app-services + +- 原始仓库：`/home/work/dde-app-services` +- worktree：`/tmp/dde-app-services-unified` +- 基线：`origin/master` +- 工作分支：`feat/v20-v25-unification` +- 对比分支：`gerrit/develop/eagle` +- 共同祖先：`687af602410343bc89f915e567d6dcecd20dacc6` + +### dtkcore + +- 原始仓库：`/home/work/dtkcore` +- worktree：`/tmp/dtkcore-cache-compat` +- 基线：本地 `master` +- 工作分支：`feat/dconfig-cache-compat` +- eagle 来源：`gerrit/develop/eagle` + +dtkcore 使用本地 master 而不是重置到 origin/master，以保留本地已有的 +开发包依赖提交。 + +## 3. 分支差异处理原则 + +`origin/master` 作为统一主线，不直接合并 eagle 分支。eagle 中需要保留的 +提交使用 `git cherry-pick -x` 按原顺序摘取，以保留作者、提交说明、 +Change-Id 和来源 commit hash。 + +发生冲突时，在 cherry-pick 过程中基于 origin 当前实现解决冲突，然后执行 +`git cherry-pick --continue`。不得将原提交改写成无来源信息的新提交，也不将 +多个 eagle 提交 squash。 + +### 3.1 dtkcore 摘取列表 + +1. `b1e3ac4c547682544474102e9acd078e026e23f4` + `chore: add Permissions function` + +该提交增加 `AuthorizedReadOnly`、`AuthorizedReadWrite` 枚举，并解析 +`authorizedreadonly`、`authorizedreadwrite` 权限字符串。 + +### 3.2 dde-app-services 摘取列表 + +按以下顺序执行： + +1. `7f00fdc3b408b89ff2993ac151c5c1bd6997d13a` + `chore: add Permissions type of AuthorizedReadOnly and AuthorizedReadWrite` +2. `721cb5a3aedc7ac57a13d79fe443ccd3afd420ef` + `fix: OEM 对话框交互修复` +3. `a699f1c209b17369f0d492847850cd79f227bd81` + `fix: oem 导出的数组类型不对导致 overrides 失效` +4. `29198c6f15e6194842c737cdf3d41ec07a6be6ad` + `fix: 限制 D-Bus 接口仅允许 root 用户调用` +5. `e809ff37a2ec1b924905a722fa09e2ffe9d84cb1` + `refactor: 使用 qAsConst 替换 std::as_const 并更新文件时间戳处理` + +第 5 个提交解决 `QFileInfo::metadataChangeTime(QTimeZone::UTC)` 无法在 +Qt5 编译的问题。整合分支启用 C++17 后，容器遍历最终仍使用 +`std::as_const`，避免 Qt6 的 `qAsConst` 弃用警告；时间戳 API 和必要头文件 +保留该 cherry-pick 的兼容修复。 + +### 3.3 不重复摘取的提交 + +以下改动已经被 origin 中的等价或更新实现覆盖，只在差异审计中记录： + +- 配置重新解析的 UAF 修复。 +- 负浮点值修复。 +- 编辑器空索引崩溃修复。 +- 全局缓存同步资源键转换修复。 +- 配置 reload 和 Debian trigger 系列提交。 +- systemd 加固和服务身份相关提交不直接覆盖 v25 文件；eagle 最终资源作为 + Qt5 专用变体保留。 + +## 4. dtkcore 缓存兼容设计 + +### 4.1 加载规则 + +保持 `DConfigCache` 公共方法和缓存 JSON 格式不变。 + +- 未调用 `setCachePathPrefix()`：只加载原默认路径，行为不变。 +- 已调用 `setCachePathPrefix()`： + 1. 按原默认路径加载旧缓存。 + 2. 按 `cachePathPrefix` 加载新缓存。 + 3. 先写入旧缓存的 `contents`，再写入新缓存的 `contents`。 + 4. 同名键无条件由新缓存覆盖，不比较 serial 或时间。 + +旧缓存解析失败时只记录告警，继续尝试新缓存；新缓存解析失败时保持当前 +`load()` 失败语义。旧缓存文件始终只读，不删除、不改名、不修改。 + +### 4.2 保存规则 + +- 新缓存缺少旧缓存中的键时，将内存缓存标记为 dirty。 +- 后续由现有 `DConfigCache::save()` 将合并结果写入 prefix 指向的新路径。 +- 不在 dde-app-services 中复制缓存文件或实现 JSON 合并。 +- 不创建迁移状态文件，不记录已接管键。 + +无状态叠加存在一个明确限制：如果新缓存删除了某键、旧缓存仍保存该键， +下次加载时旧值会再次进入内存并写回新缓存。本方案接受这一行为。 + +### 4.3 路径范围 + +兼容以下缓存形态： + +- 用户缓存。 +- 全局缓存。 +- 全局缓存不可用时的 fake-global 缓存。 +- 空 appid 的通用配置。 +- 带 subpath 的配置。 +- 测试使用的 `localPrefix`。 + +## 5. dde-app-services 适配 + +- 保留现有 `DTK_VERSION=5|6` 构建入口和 Qt/DTK 映射。 +- C++ 标准调整为 C++17，解决 `std::optional` 在 C++14 下编译失败。 +- 使用无时区参数的 `QFileInfo::metadataChangeTime()`，兼容 Qt5/Qt6。 +- Authorized 权限继续使用 eagle 的 SID2、D-Bus UID/PID 和 root 校验逻辑。 +- CMake 根据 `QT_VERSION_MAJOR` 选择运行环境文件：Qt5 安装 eagle 的 root + 服务、D-Bus activation/config 和 PolicyKit policy；Qt6 安装 + origin/master 的 deepin-daemon 服务及 D-Bus 文件，且不额外安装 v20 + PolicyKit policy。 +- 两个版本安装时均重命名为相同 canonical 文件名，因此 Debian 安装清单 + 无需区分源文件名。 +- 新增 include 只使用 Qt、DTK或系统公共头文件。 + +## 6. 提交规则 + +- eagle 原提交一律使用 `git cherry-pick -x`，不重建、不 squash。 +- cherry-pick 冲突解决包含在对应的 cherry-pick 提交内。 +- 缓存双加载、DTK5适配、测试和本文档属于新改动，使用 + `git-commit-helper` 分仓库提交。 +- 默认不推送远端，不创建 PR。 + +## 7. 测试与验收 + +所有编译最多使用 6 个 CPU 核心。 + +### dtkcore + +- DTK5：`cmake -DDTK5=ON`，全量编译并运行相关 `ut-DtkCore` 测试。 +- DTK6：`cmake -DDTK5=OFF`，全量编译并运行相关测试。 +- 缓存定向测试覆盖：旧/新缓存加载、不同键合并、同键新值覆盖、合并后 + 使用现有 `save()` 写新路径、用户/全局/空 appid/subpath。 +- 权限测试覆盖 Authorized 枚举及两个权限字符串的解析。 + +### dde-app-services + +- 使用本次修改的 dtkcore DTK5 staging 构建，执行 + `cmake -DDTK_VERSION=5` 和全量编译。 +- 使用本次修改的 dtkcore DTK6 staging 构建，执行 + `cmake -DDTK_VERSION=6` 和回归编译。 +- 运行现有单元测试；Authorized 权限字符串解析由 dtkcore 新增测试覆盖。 + +本次不执行 v20 服务启动、系统升级或 Debian 包构建验收。 + +## 8. 实施结果 + +### 8.1 已保留的 cherry-pick + +dtkcore： + +- `1486870` ← `b1e3ac4c547682544474102e9acd078e026e23f4` + +dde-app-services： + +- `3327602` ← `7f00fdc3b408b89ff2993ac151c5c1bd6997d13a` +- `00e7085` ← `721cb5a3aedc7ac57a13d79fe443ccd3afd420ef` +- `6be9d40` ← `a699f1c209b17369f0d492847850cd79f227bd81` +- `1f62df4` ← `29198c6f15e6194842c737cdf3d41ec07a6be6ad` +- `8b56631` ← `e809ff37a2ec1b924905a722fa09e2ffe9d84cb1` + +上述提交均保留原作者、提交说明、Change-Id，并带 +`(cherry picked from commit ...)` 来源记录。 + +Qt5 运行环境资源取自 eagle 最终树；其关键来源提交包括 policy +`17f8464`、systemd 最终调整 `bea808b`、activation 最终调整 `727b25a` +以及 D-Bus config 最终调整 `383ebe5`。这些资源以 Qt5 专用路径加入，不覆盖 +v25 canonical 源文件。 + +### 8.2 新增提交 + +- dtkcore `b1800e7`：旧/新缓存双加载、新缓存覆盖、保存到新路径及测试。 +- dde-app-services 的 CMake、Qt5 资源和本文档在同一整合提交中提交。 + +### 8.3 验证结果 + +- dtkcore DTK5 Release：全量编译通过；5 个定向 DConfigFile 用例通过。 +- dtkcore DTK6 Release：全量编译通过；相同 5 个定向用例通过。 +- dde-app-services DTK5 Release：使用本次 dtkcore staging，全量编译通过。 +- dde-app-services DTK6 Release：使用本次 dtkcore staging，全量编译通过。 +- DTK5、DTK6 的 dde-app-services 非环境依赖用例各 27 个，全部通过。 +- 完整 dde-app-services 测试共 34 个；当前容器不存在 UID 1001～1004，导致 + 5 个 `removeUserData*` 用例无法建立测试资源而失败，属于测试环境前置条件， + 与本次改动无关。 +- 安装清单已核对：DTK5 安装 Qt5 systemd/D-Bus/policy 文件；DTK6 安装 + v25 systemd/D-Bus 文件且不安装 v20 policy。安装结果与各自源文件内容一致。 From 6bb85a1f99ba11f3b7e1581320dc30aa0e3e7160 Mon Sep 17 00:00:00 2001 From: yeshanshan Date: Wed, 2 Sep 2026 17:25:35 +0800 Subject: [PATCH 7/8] docs: update v2.5 integration plan to include PR workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Update the v2.0-v2.5 integration plan document 2. Change the 'no push/no PR' rule to push to personal GitHub fork and create PRs upstream 3. Add request for code review by BLumia and mhduiy Influence: 1. Verify the README/documentation accurately reflects the new contribution workflow 2. Confirm the updated instructions are clear for developers reading the plan docs: 更新 v2.5 集成计划中的 PR 工作流 1. 更新 v2.0-v2.5 集成计划文档 2. 将"默认不推送、不创建 PR"的规则改为推送到个人 GitHub fork，并向上游创 建 PR 3. 新增请求 BLumia 和 mhduiy 进行代码审查的说明 Influence: 1. 验证文档准确反映了新的贡献工作流 2. 确认开发者在阅读计划时能清楚理解更新后的操作指引 --- dconfig-center/docs/v20-v25-integration-plan.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dconfig-center/docs/v20-v25-integration-plan.md b/dconfig-center/docs/v20-v25-integration-plan.md index 1e9e9f2..8e224bb 100644 --- a/dconfig-center/docs/v20-v25-integration-plan.md +++ b/dconfig-center/docs/v20-v25-integration-plan.md @@ -143,7 +143,8 @@ Qt5 编译的问题。整合分支启用 C++17 后，容器遍历最终仍使用 - cherry-pick 冲突解决包含在对应的 cherry-pick 提交内。 - 缓存双加载、DTK5适配、测试和本文档属于新改动，使用 `git-commit-helper` 分仓库提交。 -- 默认不推送远端，不创建 PR。 +- 提交后推送到个人 GitHub fork，并分别向上游仓库创建 PR，请求 + `BLumia`、`mhduiy` review。 ## 7. 测试与验收 From 5d130bfb180007b0a8093d538c7eccafc386f2d1 Mon Sep 17 00:00:00 2001 From: yeshanshan Date: Wed, 9 Sep 2026 11:29:29 +0800 Subject: [PATCH 8/8] refactor: unify dconfig-daemon service files across Qt versions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. Remove Qt5-specific systemd, D-Bus, and policy files from dconfig- daemon 2. Simplify CMakeLists to install only v25 service files regardless of Qt version 3. Remove conditional file selection logic based on QT_VERSION_MAJOR 4. Fix buffer overflow in SID2 reading by limiting read size to buffer capacity minus one, ensuring NUL termination 5. Update integration plan documentation to reflect unified service file approach Log: Unified dconfig-daemon service files across Qt5/Qt6 builds, removed Qt5-specific variants and simplified installation logic. Fixed SID2 buffer boundary. Influence: 1. Build dconfig-daemon with both Qt5 and Qt6, verify CMake configuration succeeds 2. Verify installed service files match v25 versions in both builds 3. Test systemd service startup and D-Bus activation 4. Verify D-Bus permission policies are applied correctly 5. Test SID2 reading with long security labels to confirm no buffer overrun 6. Run existing unit tests for dconfig-daemon refactor: 统一不同 Qt 版本的 dconfig-daemon 服务文件 1. 移除 dconfig-daemon 中 Qt5 专用的 systemd、D-Bus 和 policy 文件 2. 简化 CMakeLists，无论 Qt 版本均只安装 v25 服务文件 3. 移除基于 QT_VERSION_MAJOR 的条件文件选择逻辑 4. 修复 SID2 读取时的缓冲区溢出问题，限制读取大小为缓冲区容量减一，确保 NUL 终止符 5. 更新集成计划文档，反映统一服务文件方案 Log: 统一下 Qt5/Qt6 构建中的 dconfig-daemon 服务文件，移除 Qt5 专用变体 并简化安装逻辑。修复 SID2 缓冲区边界问题。 Influence: 1. 使用 Qt5 和 Qt6 分别构建 dconfig-daemon，确认 CMake 配置成功 2. 验证两次构建中安装的服务文件均与 v25 版本一致 3. 测试 systemd 服务启动和 D-Bus 激活功能 4. 验证 D-Bus 权限策略是否正确应用 5. 使用超长安全标签测试 SID2 读取，确认无缓冲区越界 6. 运行 dconfig-daemon 现有单元测试 --- .../dde-dconfig-daemon/CMakeLists.txt | 29 ++---------- .../dde-dconfig-daemon/dconfig_global.h | 2 +- .../services/qt5/dde-dconfig-daemon.service | 46 ------------------- .../qt5/org.desktopspec.ConfigManager.conf | 39 ---------------- .../qt5/org.desktopspec.ConfigManager.policy | 30 ------------ .../qt5/org.desktopspec.ConfigManager.service | 4 -- .../docs/v20-v25-integration-plan.md | 31 +++++-------- 7 files changed, 16 insertions(+), 165 deletions(-) delete mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service delete mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf delete mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy delete mode 100644 dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service diff --git a/dconfig-center/dde-dconfig-daemon/CMakeLists.txt b/dconfig-center/dde-dconfig-daemon/CMakeLists.txt index 92f0c64..4a22a8b 100644 --- a/dconfig-center/dde-dconfig-daemon/CMakeLists.txt +++ b/dconfig-center/dde-dconfig-daemon/CMakeLists.txt @@ -33,35 +33,12 @@ set(DCONFIG_XMLS_FILES ) install (FILES ${DCONFIG_XMLS_FILES} DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/interfaces) -if (QT_VERSION_MAJOR EQUAL 5) - set(DBUS_CONFIG_FILE services/qt5/org.desktopspec.ConfigManager.conf) - set(DBUS_SERVICE_FILE services/qt5/org.desktopspec.ConfigManager.service) - set(SYSTEMD_SERVICE_FILE services/qt5/dde-dconfig-daemon.service) - set(POLKIT_POLICY_FILE services/qt5/org.desktopspec.ConfigManager.policy) -else() - set(DBUS_CONFIG_FILE services/org.desktopspec.ConfigManager.conf) - set(DBUS_SERVICE_FILE services/org.desktopspec.ConfigManager.service) - set(SYSTEMD_SERVICE_FILE services/dde-dconfig-daemon.service) -endif() - ## dbus config file -install(FILES ${DBUS_CONFIG_FILE} - DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system.d - RENAME org.desktopspec.ConfigManager.conf) +install (FILES services/org.desktopspec.ConfigManager.conf DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system.d) ## services files -install(FILES ${DBUS_SERVICE_FILE} - DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system-services - RENAME org.desktopspec.ConfigManager.service) -install(FILES ${SYSTEMD_SERVICE_FILE} - DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/systemd/system - RENAME dde-dconfig-daemon.service) - -if (POLKIT_POLICY_FILE) - install(FILES ${POLKIT_POLICY_FILE} - DESTINATION ${CMAKE_INSTALL_DATADIR}/polkit-1/actions - RENAME org.desktopspec.ConfigManager.policy) -endif() +install(FILES services/org.desktopspec.ConfigManager.service DESTINATION ${CMAKE_INSTALL_DATADIR}/dbus-1/system-services) +install(FILES services/dde-dconfig-daemon.service DESTINATION ${CMAKE_INSTALL_PREFIX}/lib/systemd/system) ## bin install(TARGETS dde-dconfig-daemon DESTINATION ${CMAKE_INSTALL_BINDIR}) diff --git a/dconfig-center/dde-dconfig-daemon/dconfig_global.h b/dconfig-center/dde-dconfig-daemon/dconfig_global.h index be95e07..7635e98 100644 --- a/dconfig-center/dde-dconfig-daemon/dconfig_global.h +++ b/dconfig-center/dde-dconfig-daemon/dconfig_global.h @@ -258,7 +258,7 @@ inline int check_caller_sid2(uint uid, pid_t caller_pid) } char sid2[256] = {0}; - size_t nread = fread( sid2, 1, 256, fp_sid2_attr); + size_t nread = fread(sid2, 1, sizeof(sid2) - 1, fp_sid2_attr); fclose(fp_sid2_attr); if(nread < 1){ qWarning() << QString("process %1 %2 has no sid2\n").arg(caller_pid).arg(sid2_attr_path); diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service b/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service deleted file mode 100644 index 82529b8..0000000 --- a/dconfig-center/dde-dconfig-daemon/services/qt5/dde-dconfig-daemon.service +++ /dev/null @@ -1,46 +0,0 @@ -[Unit] -Description=deepin dconfig daemon service - -# Ask for the dbus socket. -Wants=dbus.socket -After=dbus.socket - -[Service] -Type=dbus -User=root -BusName=org.desktopspec.ConfigManager -ExecStart=/usr/bin/dde-dconfig-daemon -Restart=always -StartLimitBurst=0 -RestartSec=5 -OOMScoreAdjust=-250 -Environment=DSG_DATA_DIRS=/usr/share/dsg:/persistent/linglong/entries/share/dsg - -ProtectSystem=strict -# 创建/var/dsg目录 -ReadWritePaths=/var/dsg -ReadWritePaths=/home - -InaccessiblePaths=/etc/shadow -InaccessiblePaths=-/etc/NetworkManager/system-connections -InaccessiblePaths=-/etc/pam.d -InaccessiblePaths=-/usr/share/uadp/ - -NoNewPrivileges=true -# 非gloable数据存储在/home -#ProtectHome=yes -ProtectKernelTunables=yes -ProtectKernelModules=yes -ProtectControlGroups=yes -PrivateMounts=yes -PrivateTmp=yes -PrivateDevices=yes -PrivateNetwork=yes -# 需要读取/proc的exe uid字段数据 -#PrivateUsers=yes -RestrictNamespaces=yes -LockPersonality=yes -RestrictRealtime=yes -RemoveIPC=yes -MemoryDenyWriteExecute=yes -#MemoryLimit=100M diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf deleted file mode 100644 index 5d1183d..0000000 --- a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.conf +++ /dev/null @@ -1,39 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy deleted file mode 100644 index 31977ad..0000000 --- a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.policy +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - - Check Authentication - Authentication is required to perform this action - - no - no - auth_admin - - Check Authentication - Authentication is required to perform this action - Check Authentication - Autenticazione richiesta per eseguire questa operazione - Check Authentication - 当前操作需要密码认证 - Hitelesítés ellenőrzése - Hitelesítés szükséges a művelet végrehajtásához - Check Authentication - 目前操作需要密碼認證 - Check Authentication - 當前操作需要密碼認證 - Check Authentication - Tämän toiminnon suorittaminen edellyttää todennusta - - diff --git a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service b/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service deleted file mode 100644 index 985ad22..0000000 --- a/dconfig-center/dde-dconfig-daemon/services/qt5/org.desktopspec.ConfigManager.service +++ /dev/null @@ -1,4 +0,0 @@ -[D-BUS Service] -Name=org.desktopspec.ConfigManager -Exec=/usr/bin/dde-dconfig-daemon -SystemdService=dde-dconfig-daemon.service diff --git a/dconfig-center/docs/v20-v25-integration-plan.md b/dconfig-center/docs/v20-v25-integration-plan.md index 8e224bb..6908a9b 100644 --- a/dconfig-center/docs/v20-v25-integration-plan.md +++ b/dconfig-center/docs/v20-v25-integration-plan.md @@ -6,9 +6,9 @@ `origin/master`，使同一套 dde-app-services 源码能够使用 DTK5/Qt5 或 DTK6/Qt6 编译。 -Qt6 的 systemd service、D-Bus activation 和 D-Bus policy 沿用 v25 -版本；Qt5 构建安装 eagle 对应的运行环境文件。本次不验证 v20 系统运行及 -Debian 打包，只验证 DTK5、DTK6 编译、安装清单和现有单元测试。 +systemd service、D-Bus activation/config 和 policy 不随 Qt 主版本切换， +全部沿用 v25 文件及安装规则。本次不验证 v20 系统运行及 Debian 打包，只 +验证 DTK5、DTK6 编译、安装清单和现有单元测试。 缓存兼容逻辑在 dtkcore 中实现。DConfig 设置新缓存路径后，每次加载均以 旧缓存为基础，再使用新缓存覆盖同名键；缓存保存继续使用 dtkcore 已有的 @@ -83,8 +83,8 @@ Qt5 编译的问题。整合分支启用 C++17 后，容器遍历最终仍使用 - 编辑器空索引崩溃修复。 - 全局缓存同步资源键转换修复。 - 配置 reload 和 Debian trigger 系列提交。 -- systemd 加固和服务身份相关提交不直接覆盖 v25 文件；eagle 最终资源作为 - Qt5 专用变体保留。 +- systemd 加固、D-Bus policy 和服务身份相关提交；运行环境统一保留 v25 + 实现，不摘取 eagle 资源文件。 ## 4. dtkcore 缓存兼容设计 @@ -129,12 +129,9 @@ Qt5 编译的问题。整合分支启用 C++17 后，容器遍历最终仍使用 - C++ 标准调整为 C++17，解决 `std::optional` 在 C++14 下编译失败。 - 使用无时区参数的 `QFileInfo::metadataChangeTime()`，兼容 Qt5/Qt6。 - Authorized 权限继续使用 eagle 的 SID2、D-Bus UID/PID 和 root 校验逻辑。 -- CMake 根据 `QT_VERSION_MAJOR` 选择运行环境文件：Qt5 安装 eagle 的 root - 服务、D-Bus activation/config 和 PolicyKit policy；Qt6 安装 - origin/master 的 deepin-daemon 服务及 D-Bus 文件，且不额外安装 v20 - PolicyKit policy。 -- 两个版本安装时均重命名为相同 canonical 文件名，因此 Debian 安装清单 - 无需区分源文件名。 +- SID2 最多读取缓冲区容量减一，确保安全标签始终有 NUL 终止符。 +- Qt5、Qt6 构建均使用 origin/master 的 v25 systemd、D-Bus 和 policy + 文件及原有 CMake 安装规则，不增加运行环境分支。 - 新增 include 只使用 Qt、DTK或系统公共头文件。 ## 6. 提交规则 @@ -187,15 +184,11 @@ dde-app-services： 上述提交均保留原作者、提交说明、Change-Id，并带 `(cherry picked from commit ...)` 来源记录。 -Qt5 运行环境资源取自 eagle 最终树；其关键来源提交包括 policy -`17f8464`、systemd 最终调整 `bea808b`、activation 最终调整 `727b25a` -以及 D-Bus config 最终调整 `383ebe5`。这些资源以 Qt5 专用路径加入，不覆盖 -v25 canonical 源文件。 - ### 8.2 新增提交 - dtkcore `b1800e7`：旧/新缓存双加载、新缓存覆盖、保存到新路径及测试。 -- dde-app-services 的 CMake、Qt5 资源和本文档在同一整合提交中提交。 +- dde-app-services：C++17/Qt5 兼容、SID2 边界修复和本文档；运行环境文件 + 保持 v25 基线。 ### 8.3 验证结果 @@ -207,5 +200,5 @@ v25 canonical 源文件。 - 完整 dde-app-services 测试共 34 个；当前容器不存在 UID 1001～1004，导致 5 个 `removeUserData*` 用例无法建立测试资源而失败，属于测试环境前置条件， 与本次改动无关。 -- 安装清单已核对：DTK5 安装 Qt5 systemd/D-Bus/policy 文件；DTK6 安装 - v25 systemd/D-Bus 文件且不安装 v20 policy。安装结果与各自源文件内容一致。 +- 安装清单已核对：DTK5、DTK6 均安装相同的 v25 systemd 和 D-Bus 文件， + 不安装 eagle 的 PolicyKit policy。