From 5608fed6f49a1f6f0daa2c72dd114124409f9ea9 Mon Sep 17 00:00:00 2001 From: Bernd Schoolmann Date: Thu, 21 Dec 2023 12:59:32 +0100 Subject: [PATCH 1/4] Update PKGBUILD --- PKGBUILD | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PKGBUILD b/PKGBUILD index 8660d7f..389ee7b 100644 --- a/PKGBUILD +++ b/PKGBUILD @@ -1,6 +1,6 @@ pkgname=goldwarden -pkgver=0.1.9 -pkgrel=2 +pkgver=0.1.10 +pkgrel=1 pkgdesc='A feature-packed Bitwarden compatible desktop integration' arch=('x86_64') url="https://github.com/quexten/$pkgname" From 706263c6199bdc541576c876b3705b15541958ba Mon Sep 17 00:00:00 2001 From: Bernd Schoolmann Date: Fri, 22 Dec 2023 12:30:50 +0100 Subject: [PATCH 2/4] Add arm and x86 builds --- .github/workflows/release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3ad2c0f..75462cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,11 +25,15 @@ jobs: - name: Build with All features run: go build -o goldwarden_linux_x86_64 -v . - - name: Build minimal featureset + - name: Build minimal x86_64 featureset run: go build -tags nofido2 -tags noautofill -o goldwarden_linux_minimal_x86_64 -v . + - name: Build minimal x86 featureset + run: GOARCH=386 go build -tags nofido2 -tags noautofill -o goldwarden_linux_x86 -v . + - name: Build minimal arm64 featureset + run: GOARCH=arm64 go build -tags nofido2 -tags noautofill -o goldwarden_linux_arm64 -v . - uses: AButler/upload-release-assets@v2.0 with: - files: './goldwarden_linux_x86_64;./goldwarden_linux_x86_64_minimal' + files: './goldwarden_linux_x86_64;./goldwarden_linux_x86_64_minimal;./goldwarden_linux_x86;./goldwarden_linux_arm64' repo-token: ${{ secrets.GITHUB_TOKEN }} - name: Validate ArchLinux PKGBUILD uses: hapakaien/archlinux-package-action@v2 From c0367b2c759dea366b09a1fd373630f6951cd924 Mon Sep 17 00:00:00 2001 From: Bernd Schoolmann Date: Sat, 23 Dec 2023 08:37:17 +0100 Subject: [PATCH 3/4] Add lock on screensaver --- agent/processsecurity/unimplemented.go | 4 ++ agent/processsecurity/unix.go | 52 +++++++++++++++++++++++++- agent/unixsocketagent.go | 9 +++++ agent/virtualagent.go | 9 +++++ 4 files changed, 73 insertions(+), 1 deletion(-) diff --git a/agent/processsecurity/unimplemented.go b/agent/processsecurity/unimplemented.go index 0774dea..9c5dafa 100644 --- a/agent/processsecurity/unimplemented.go +++ b/agent/processsecurity/unimplemented.go @@ -6,3 +6,7 @@ func DisableDumpable() error { // no additional dumping protection return nil } + +func MonitorLocks(onlock func) error { + return nil +} diff --git a/agent/processsecurity/unix.go b/agent/processsecurity/unix.go index f3579fc..d14704d 100644 --- a/agent/processsecurity/unix.go +++ b/agent/processsecurity/unix.go @@ -2,8 +2,58 @@ package processsecurity -import "golang.org/x/sys/unix" +import ( + "fmt" + + "github.com/godbus/dbus/v5" + "golang.org/x/sys/unix" +) func DisableDumpable() error { return unix.Prctl(unix.PR_SET_DUMPABLE, 0, 0, 0, 0) } + +func MonitorLocks(onlock func()) error { + bus, err := dbus.SessionBus() + if err != nil { + return err + } + err = bus.AddMatchSignal(dbus.WithMatchInterface("org.gnome.ScreenSaver")) + if err != nil { + return err + } + err = bus.AddMatchSignal(dbus.WithMatchMember("org.freedesktop.ScreenSaver")) + if err != nil { + return err + } + + signals := make(chan *dbus.Signal, 10) + bus.Signal(signals) + for { + select { + case message := <-signals: + fmt.Println("Message:", message) + fmt.Println("name ", message.Name) + if message.Name == "org.gnome.ScreenSaver.ActiveChanged" { + if len(message.Body) == 0 { + continue + } + locked, err := message.Body[0].(bool) + if err || locked { + onlock() + } + } + if message.Name == "org.freedesktop.ScreenSaver.ActiveChanged" { + if len(message.Body) == 0 { + continue + } + locked, err := message.Body[0].(bool) + if err || locked { + onlock() + } + } + } + } + + return nil +} diff --git a/agent/unixsocketagent.go b/agent/unixsocketagent.go index b4e48e1..76a7303 100644 --- a/agent/unixsocketagent.go +++ b/agent/unixsocketagent.go @@ -153,6 +153,15 @@ func StartUnixAgent(path string, runtimeConfig config.RuntimeConfig) error { } processsecurity.DisableDumpable() + err = processsecurity.MonitorLocks(func() { + cfg.Lock() + vault.Clear() + vault.Keyring.Lock() + }) + if err != nil { + log.Warn("Could not monitor screensaver: %s", err.Error()) + } + if !runtimeConfig.WebsocketDisabled { go bitwarden.RunWebsocketDaemon(ctx, vault, &cfg) } diff --git a/agent/virtualagent.go b/agent/virtualagent.go index f8b3e33..156db4a 100644 --- a/agent/virtualagent.go +++ b/agent/virtualagent.go @@ -116,6 +116,15 @@ func StartVirtualAgent(runtimeConfig config.RuntimeConfig) (chan []byte, chan [] } } processsecurity.DisableDumpable() + err = processsecurity.MonitorLocks(func() { + cfg.Lock() + vault.Clear() + vault.Keyring.Lock() + }) + if err != nil { + log.Warn("Could not monitor screensaver: %s", err.Error()) + } + go func() { for { time.Sleep(TokenRefreshInterval) From d93bbfde73740587da27916a1e6eb5a85e21820b Mon Sep 17 00:00:00 2001 From: Bernd Schoolmann Date: Sat, 23 Dec 2023 09:01:51 +0100 Subject: [PATCH 4/4] Fix typo in unimplemented processsecurity --- agent/processsecurity/unimplemented.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/processsecurity/unimplemented.go b/agent/processsecurity/unimplemented.go index 9c5dafa..d3ce08c 100644 --- a/agent/processsecurity/unimplemented.go +++ b/agent/processsecurity/unimplemented.go @@ -7,6 +7,6 @@ func DisableDumpable() error { return nil } -func MonitorLocks(onlock func) error { +func MonitorLocks(onlock func()) error { return nil }