Revert "feat: 集成 security-loader 加强安全" 及相关提交 — 回退安全启动方案 - #1215
Closed
fly602 wants to merge 1 commit into
Closed
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Reviewer's GuideThis PR removes the security-loader–based secure startup scheme and reverts related authorization and installation changes, restoring simpler direct Polkit usage, DBus policies, and daemon wiring while keeping the newer short-idle and power-management behavior functional via direct power1 integration. Sequence diagram for SetIdleState with direct power1 integrationsequenceDiagram
actor Client
participant SystemDaemon as dde_system_daemon.Daemon
participant Power as power1.Manager
participant KernelFile as idle_state_file
Client->>SystemDaemon: SetIdleState(state bool)
SystemDaemon->>SystemDaemon: setState(file, state)
SystemDaemon->>Power: ShortIdleState().Get(0)
Power-->>SystemDaemon: shortIdleState bool, error
alt shortIdleState != state
SystemDaemon->>Power: SetShortIdleState(state)
else shortIdleState == state
SystemDaemon->>SystemDaemon: return errors.New("Short idle state not exchange.")
end
SystemDaemon->>KernelFile: ioutil.ReadFile(file)
KernelFile-->>SystemDaemon: content []byte
SystemDaemon->>KernelFile: ioutil.WriteFile(file, newContent, 0644)
KernelFile-->>SystemDaemon: write result
SystemDaemon-->>Client: dbus.Error (nil or error)
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin pr auto review★ 总体评分：20分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 // system/power1/manager_ifc.go - 恢复polkit授权检查
package power
import (
dbus "github.com/godbus/dbus/v5"
polkit "github.com/linuxdeepin/go-dbus-factory/system/org.freedesktop.policykit1"
"github.com/linuxdeepin/go-lib/dbusutil"
)
func (m *Manager) checkAuthorization(actionId string, sender dbus.Sender) error {
authority := polkit.NewAuthority(m.service.Conn())
subject := polkit.MakeSubject(polkit.SubjectKindSystemBusName)
subject.SetDetail("name", string(sender))
ret, err := authority.CheckAuthorization(0, subject, actionId,
nil, polkit.CheckAuthorizationFlagsAllowUserInteraction, "")
if err != nil {
return err
}
if !ret.IsAuthorized {
return dbusutil.ToError(nil)
}
return nil
}
func (m *Manager) SetTlpMode(sender dbus.Sender, mode string) *dbus.Error {
if err := m.checkAuthorization("org.deepin.dde.power.doAction", sender); err != nil {
logger.Warningf("SetTlpMode authorization failed: %q", err.Error())
return dbusutil.ToError(err)
}
logger.Info("SetTlpMode : ", mode)
return dbusutil.ToError(m.setTlpMode(mode))
}
func (m *Manager) SetShortIdleState(sender dbus.Sender, state bool) *dbus.Error {
if err := m.checkAuthorization("org.deepin.dde.daemon.set-idle-state", sender); err != nil {
logger.Warningf("SetShortIdleState authorization failed: %q", err.Error())
return dbusutil.ToError(err)
}
logger.Info(" SetShortIdleState : ", state)
m.setShortIdleState(state)
return nil
}// system/power1/manager.go - 恢复互斥锁保护
type Manager struct {
// ... 其他字段
ShortIdleState bool
ShortIdleStateMu sync.RWMutex
shortIdleEnableMu sync.RWMutex
shortIdleEnable bool
}
func (m *Manager) setShortIdleState(state bool) {
logger.Info(" setShortIdleState state : ", state)
m.shortIdleEnableMu.RLock()
enabled := m.shortIdleEnable
m.shortIdleEnableMu.RUnlock()
if !enabled {
logger.Info("System not open dsg of shortIdleEnable.")
return
}
m.ShortIdleStateMu.Lock()
defer m.ShortIdleStateMu.Unlock()
if m.ShortIdleState != state {
m.ShortIdleState = state
// ... 其余逻辑保持不变
}
// 使用 m.ShortIdleState 进行判断（已修复的bug）
if !m.ShortIdleState {
// 退出短idle逻辑
}
} |
zccrs
previously approved these changes
Aug 19, 2026
回退 security-loader 安全启动方案及其相关提交，包括： - 集成 security-loader 及 AllowCaller 权限控制 - 输入设备、飞行模式、LocaleHelper、lastore Agent 等接口的鉴权改造 - polkit 提权回退机制 - 启动流程修复及 authorization 修复 原因 该方案影响范围过广，涉及 dde-session-daemon、dde-system-daemon、 langselector、polkit 策略、systemd 服务等多处改动，且与 V25 项目 当前架构存在不匹配之处，不适合在此阶段落地。如果上层应用适配会 影响其项目架构。 后续计划 需重新评估安全方案的整体设计，制定更契合 V25 架构的分阶段实施方案。
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
回退 security-loader 安全启动方案及其相关提交，包括：
原因
该方案影响范围过广，涉及 dde-session-daemon、dde-system-daemon、 langselector、polkit 策略、systemd 服务等多处改动，且与 V25 项目
当前架构存在不匹配之处，不适合在此阶段落地。如果上层应用适配会
影响其项目架构。
后续计划
需重新评估安全方案的整体设计，制定更契合 V25 架构的分阶段实施方案。
Summary by Sourcery
Revert the broad security-loader integration and restore the previous daemon startup, D-Bus authorization, power control, and packaging behavior.
Enhancements:
Build:
Deployment:
Tests:
Chores: