From a9e1c34e27bed4ec0f3d0301168849df1aa12994 Mon Sep 17 00:00:00 2001 From: vasilito Date: Mon, 27 Jul 2026 20:08:25 +0900 Subject: [PATCH] round 11: libclc.pc verify + redbear-passwd [source] + sessiond can_* probe + dnsd no hardcoded upstreams + stale redbear-kde-session refs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round 11 audit cleanup. Six fixes across six files: 1. local/recipes/system/redbear-passwd/recipe.toml — CRITICAL: was missing the [source] block entirely. The recipe had only [package] and [build] with template=cargo, which the cookbook cannot fetch. Added [source] path = "source" so the cookbook locates the local Rust crate. Also added a one-line description. 2. local/recipes/dev/libclc/recipe.toml — MEDIUM: the build script installs via cmake but never verifies that libclc.pc (Mesa's pkg-config dependency) and the .bc bitcode files actually landed. Without these, Mesa's 3D driver cook fails opaquely with 'Dependency libclc not found (tried pkg-config)'. Added three post-install test -f checks that fail the build with a precise error pointing at the missing path. 3. local/recipes/system/redbear-sessiond/source/src/manager.rs — HIGH: the D-Bus login1 can_power_off / can_reboot / can_suspend methods were returning 'yes' unconditionally — the archetype lie-grade-ok pattern (probe says success, then the real action fails because /scheme/sys/kstop is missing). Replaced with a kstop_writable() probe that fs::metadata()s the path. Used metadata() rather than an actual write because writing 'shutdown'/'reset'/'s3' to /scheme/sys/kstop would trigger the action. The actual power_off/ reboot/suspend methods still report granular errors when the write is refused. 4. local/recipes/system/redbear-dnsd/source/src/transport.rs — MEDIUM: UpstreamConfig::default() hardcoded 8.8.8.8 + 1.1.1.1 as fallback upstream DNS. Hardcoding third-party DNS bypasses netcfg integration and leaks user queries without consent on first boot. Replaced with an empty Vec — main() reads the upstream list from netcfg before any query is dispatched; upstream queries SERVFAIL until netcfg populates the list (honest default). 5. local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md — MEDIUM: 16 references to the non-existent binary 'redbear-kde-session' (now 'redbear-session-launch'). Global s/redbear-kde-session/redbear- session-launch/g. Also updated two 'redbear-kde' profile-name references to reflect the 2026-07-24 retirement and the current 'redbear-full' ownership of the desktop path. 6. local/docs/DBUS-INTEGRATION-PLAN.md — LOW: 7 references to 'redbear-kde-session' renamed to 'redbear-session-launch' (same binary rename). 6 files changed, +68/-28. Note: Mesa 04-sys-ioccom-stub-header.patch migration to relibc proper (sys/ioccom.h with Linux-style IOC encoding) is deferred — the patch is a genuine gap-filler (relibc's sys/ioctl.h has the basic macros but sys/ioccom.h is the BSD include path DRM UAPI expects). That work belongs in the relibc fork with a prefix rebuild and should be coordinated with the operator's prefix-staleness policy. --- local/docs/DBUS-INTEGRATION-PLAN.md | 14 ++++---- .../docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md | 34 +++++++++---------- local/recipes/dev/libclc/recipe.toml | 15 ++++++++ .../redbear-dnsd/source/src/transport.rs | 5 ++- .../recipes/system/redbear-passwd/recipe.toml | 4 +++ .../redbear-sessiond/source/src/manager.rs | 24 +++++++++++-- 6 files changed, 68 insertions(+), 28 deletions(-) diff --git a/local/docs/DBUS-INTEGRATION-PLAN.md b/local/docs/DBUS-INTEGRATION-PLAN.md index 808703d98c..23c4212db7 100644 --- a/local/docs/DBUS-INTEGRATION-PLAN.md +++ b/local/docs/DBUS-INTEGRATION-PLAN.md @@ -109,7 +109,7 @@ specific schemes it needs. This keeps the architecture honest and avoids a leaky | **QtDBus** | `local/recipes/qt/qtbase/` | ✅ Enabled | `FEATURE_dbus=ON` for target build, Qt6DBus module present | | **kf6-kdbusaddons** | `local/recipes/kde/kf6-kdbusaddons/` | ✅ Builds | KF6 D-Bus convenience wrappers, provides qdbus tool integration | | **D-Bus system bus** | `config/redbear-full.toml` | ✅ Wired | `12_dbus.service` launches `dbus-daemon --system`, `messagebus` user (uid=100), `/var/lib/dbus` + `/run/dbus` directories | -| **D-Bus session bus** | `local/recipes/system/redbear-greeter/source/redbear-kde-session` | ✅ Scripted | `redbear-kde-session` launches `dbus-launch --sh-syntax` before KWin | +| **D-Bus session bus** | `local/recipes/system/redbear-greeter/source/redbear-session-launch` | ✅ Scripted | `redbear-session-launch` launches `dbus-launch --sh-syntax` before KWin | | **seatd** | `config/redbear-full.toml` | ✅ Wired | `13_seatd.service`, `LIBSEAT_BACKEND=seatd`, `SEATD_SOCK=/run/seatd.sock` | | **kf6-kservice** | `local/recipes/kde/kf6-kservice/` | ✅ Builds | Depends on kf6-kdbusaddons | | **kf6-kglobalaccel** | `local/recipes/kde/kf6-kglobalaccel/` | ✅ Builds | Depends on kf6-kdbusaddons | @@ -160,7 +160,7 @@ specific schemes it needs. This keeps the architecture honest and avoids a leaky ``` KWin needs: dbus-daemon --system ✅ exists, wired - dbus-daemon --session ✅ exists, wired in redbear-kde-session + dbus-daemon --session ✅ exists, wired in redbear-session-launch org.freedesktop.login1 ✅ scaffold exists — session/device brokering implemented minimally org.kde.KWin (self-register) ✅ KWin does this itself (dbusinterface.cpp) ``` @@ -224,7 +224,7 @@ Complete Plasma needs (after re-enabling disabled components): │ plasmashell, kwin_wayland, kded6, kglobalaccel, plasma applets │ ├──────────────────────────────────────────────────────────────────────────┤ │ Session Bus (per-user) │ -│ Started by: redbear-kde-session via dbus-launch or dbus-run-session │ +│ Started by: redbear-session-launch via dbus-launch or dbus-run-session │ │ Policy: /etc/dbus-1/session.conf │ │ Services: /usr/share/dbus-1/session-services/ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ @@ -277,7 +277,7 @@ Boot: (registers org.freedesktop.login1 on system bus) 3. Redox init starts 13_seatd.service → seatd -Session launch (redbear-kde-session): +Session launch (redbear-session-launch): 4. dbus-daemon --system already running 5. eval $(dbus-launch --sh-syntax) → session bus started 6. export DBUS_SESSION_BUS_ADDRESS, XDG_SESSION_ID, XDG_SEAT, XDG_RUNTIME_DIR @@ -292,7 +292,7 @@ Session launch (redbear-kde-session): | System bus core (login1) | **Redox init** | Must be running before any desktop session | | System bus compat (UPower, NM) | **Redox init** or **D-Bus activation** | Can be started lazily, but init is simpler | | Session bus KDE services (kglobalaccel, kded6) | **D-Bus activation** (classic `.service` files) | KDE expects this, standard pattern | -| Session bus KDE shell (KWin, plasmashell) | **Explicit launch** in `redbear-kde-session` | Must start in specific order with env vars | +| Session bus KDE shell (KWin, plasmashell) | **Explicit launch** in `redbear-session-launch` | Must start in specific order with env vars | | Session bus compat (notifications, tray) | **D-Bus activation** | Standard freedesktop pattern | --- @@ -1321,7 +1321,7 @@ ListNames` returns a non-empty list, or that `org.freedesktop.login1` registers The validation commands in section 12.1 above are aspirational, not yet executed. **Session bus:** Build-wired via a shell script. The file -`local/recipes/system/redbear-greeter/source/redbear-kde-session` (line 127) conditionally +`local/recipes/system/redbear-greeter/source/redbear-session-launch` (line 127) conditionally runs `eval "$(dbus-launch --sh-syntax)"` and exports `DBUS_SESSION_BUS_ADDRESS`. This is scripted, not init-managed, and has never been runtime-validated. No test confirms that the session bus starts, that `DBUS_SESSION_BUS_ADDRESS` is set in the KDE process environment, @@ -1361,7 +1361,7 @@ for D-Bus runtime validation — the session-bus and activation gaps (F6) remain |------------------------|-------------|-----------------|----------| | dbus-daemon 1.16.2 builds | Yes | No (QEMU pending) | `recipe.toml` + meson template | | System bus wired in config | Yes | No | `config/redbear-full.toml` 12_dbus.service | -| Session bus scripted | Yes (shell script) | No | `redbear-kde-session` line 127 | +| Session bus scripted | Yes (shell script) | No | `redbear-session-launch` line 127 | | redbear-sessiond registers login1 | Yes (source builds, host tests pass) | No | 32 unit tests host-only; QEMU pending | | D-Bus activation files staged | Yes | No | `redbear-dbus-services/files/` | | StatusNotifierWatcher in image | No (not in config) | No | F5 above | diff --git a/local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md b/local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md index 317502a80b..a1a3a84fb0 100644 --- a/local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md +++ b/local/docs/GREETER-LOGIN-IMPLEMENTATION-PLAN.md @@ -18,7 +18,7 @@ What exists today: - `dbus-daemon` on the system bus - `redbear-sessiond` exposing a minimal `org.freedesktop.login1` subset for KWin - `seatd` as the seat/libseat backend -- a direct session launcher (`redbear-kde-session`) that now starts `redbear-compositor --drm` +- a direct session launcher (`redbear-session-launch`) that now starts `redbear-compositor --drm` - fallback text `getty` surfaces on VT2 and `/scheme/debug/no-preserve` What does **not** exist today: @@ -50,7 +50,7 @@ not a multi-session desktop-manager framework. - One graphical login surface for the Red Bear KDE-on-Wayland desktop path - A Red Bear-native greeter daemon, greeter UI, authentication daemon, and session launcher -- Integration with existing `dbus-daemon`, `redbear-sessiond`, `seatd`, `inputd`, and `redbear-kde-session` +- Integration with existing `dbus-daemon`, `redbear-sessiond`, `seatd`, `inputd`, and `redbear-session-launch` - Explicit VT ownership and handoff on the desktop VT - A narrow local-user authentication model backed by `/etc/passwd`, `/etc/shadow`, and `/etc/group` - Branding integration using Red Bear assets from `local/Assets/` @@ -75,9 +75,9 @@ recovery model. This plan assumes the Red Bear desktop direction converges on **one KDE-on-Wayland path**. -Current implementation answer: the first tracked owner is `redbear-full`. Older names such -as `redbear-kde` may still appear in historical or staging material, but they are not the -supported compile-target surface for this plan. +Current implementation answer: the first tracked owner is `redbear-full`. The historical +`redbear-kde` profile name was retired alongside the operator's 2026-07-24 cutover and is not +the supported compile-target surface for this plan. --- @@ -115,7 +115,7 @@ Rules: | display VT activation | `29_activate_console.service` in desktop configs | ✅ usable (bounded) | `inputd -A 3` activates desktop VT | | fallback text login | `30_console.service` | ✅ boots | `getty 2` on VT2 | | debug console | `31_debug_console.service` | ✅ boots | `getty /scheme/debug/no-preserve -J` | -| direct KDE session launcher | `/usr/bin/redbear-kde-session` | ✅ builds, experimental | Starts session bus if needed, then `exec redbear-compositor --drm` | +| direct KDE session launcher | `/usr/bin/redbear-session-launch` | ✅ builds, experimental | Starts session bus if needed, then `exec redbear-compositor --drm` | | authentication daemon | `local/recipes/system/redbear-authd/` | ✅ builds, experimental | Local-user auth boundary with `/etc/passwd` / `/etc/shadow` / `/etc/group` parsing plus SHA-crypt and Argon2 verification | | session launcher boundary | `local/recipes/system/redbear-session-launch/` | ✅ builds, experimental | User-session bootstrap with bounded environment/runtime-dir setup | | greeter daemon scaffold | `local/recipes/system/redbear-greeter/` | ✅ builds, experimental | Root-owned greeter orchestrator, socket protocol, bounded restart policy | @@ -230,7 +230,7 @@ Reuse existing pieces rather than replacing them: - `redbear-sessiond` - `seatd` - `inputd` -- `redbear-kde-session` +- `redbear-session-launch` The greeter layer sits **above** them. @@ -287,7 +287,7 @@ At runtime, the greeter must use **installed asset paths**, not source-tree path ```text ┌────────────────────────────────────────────────────────────────────┐ │ KDE Wayland user session │ -│ redbear-kde-session → kwin_wayland → later Plasma services │ +│ redbear-session-launch → kwin_wayland → later Plasma services │ ├────────────────────────────────────────────────────────────────────┤ │ redbear-session-launch │ │ drop privileges, set env, start session bus, exec session │ @@ -327,7 +327,7 @@ boot > on serio/0 (keyboard) and serio/1 (mouse)` startup log lines. The > greeter service can now rely on those lines being present to confirm > the input stack is alive before `inputd -A 3` runs. - → dbus-run-session -- redbear-kde-session + → dbus-run-session -- redbear-session-launch → kwin_wayland ``` @@ -421,10 +421,10 @@ user session exits or crashes - drop to target uid/gid and supplementary groups, - construct a minimal KDE/Wayland environment, - launch the user session bus, -- exec `redbear-kde-session`. +- exec `redbear-session-launch`. `redbear-session-launch` is intentionally thin. It must not duplicate KDE session policy already owned -by `redbear-kde-session`. +by `redbear-session-launch`. ### 8.5 `redbear-sessiond` @@ -532,7 +532,7 @@ elsewhere, but the greeter/auth path must interact only with installed runtime a Preferred launch form: ```text -dbus-run-session -- redbear-kde-session +dbus-run-session -- redbear-session-launch ``` If `dbus-run-session` proves unreliable on Red Bear, use the current `dbus-launch` pattern as a bounded @@ -598,7 +598,7 @@ greeter path. |---|---|---| | G1.1 | Create recipe skeletons | `redbear-greeter`, `redbear-authd`, `redbear-session-launch`, and shared `redbear-login-protocol` build and stage | | G1.2 | Add config fragment | A tracked config fragment wires `20_greeter.service` and supporting files | -| G1.3 | Replace direct display launch in the chosen profile | Desktop profile starts `redbear-greeterd` instead of directly starting `redbear-kde-session` | +| G1.3 | Replace direct display launch in the chosen profile | Desktop profile starts `redbear-greeterd` instead of directly starting `redbear-session-launch` | | G1.4 | Keep text/debug recovery path | VT2 `getty` and debug `getty` still boot | **Exit criteria:** @@ -661,7 +661,7 @@ greeter path. **Exit criteria:** -- successful login reaches `redbear-kde-session`, +- successful login reaches `redbear-session-launch`, - session uses intended env/runtime dir, - session exit returns to greeter, - fallback VT2 login still works. @@ -723,7 +723,7 @@ The first bounded integration proofs should answer these questions in order: 1. does the image boot to a graphical greeter surface on VT3? 2. does invalid login return to the greeter surface? -3. does valid login reach `redbear-kde-session`? +3. does valid login reach `redbear-session-launch`? 4. does session exit return to the greeter? 5. do VT2 and debug login remain available as recovery paths? 6. does greeter failure still leave a recoverable console path instead of looping forever? @@ -756,7 +756,7 @@ This plan is only substantially complete when **all** of the following are true: **Current status against this bar:** the bounded QEMU greeter proof now satisfies the greeter/login implementation bar in this plan. The remaining blocker to stronger desktop-session claims reproduces -under direct `dbus-run-session -- redbear-kde-session` as well, so it no longer points to a missing +under direct `dbus-run-session -- redbear-session-launch` as well, so it no longer points to a missing greeter/auth/session-boundary implementation inside this plan. --- @@ -867,7 +867,7 @@ The greeter **recipe**, not the config fragment, should own staged runtime artif ## 15. Open Questions 1. Which tracked profile should own the canonical desktop greeter path first: - `redbear-kde`, `redbear-full`, or a unified future target? + `redbear-full`, `redbear-mini` (post-cutover desktop handover), or a unified future target? 2. Which password-hash scheme should Red Bear standardize on for v1 local users? 3. Should reboot/shutdown requests go through `redbear-authd` or a separate narrow power helper? 4. Is `dbus-run-session` reliable enough on Red Bear, or should the current `dbus-launch` path remain the first shipped session-bus strategy? diff --git a/local/recipes/dev/libclc/recipe.toml b/local/recipes/dev/libclc/recipe.toml index aac562a1a1..8842d7f3cc 100644 --- a/local/recipes/dev/libclc/recipe.toml +++ b/local/recipes/dev/libclc/recipe.toml @@ -133,6 +133,21 @@ fi # libexecdir is /share/clc (per the libclc.pc.in template). # The cmake install above places them at $COOKBOOK_STAGE/usr/share/clc # which is the right path; no further action needed. + +if [ ! -f "${COOKBOOK_STAGE}/usr/lib/pkgconfig/libclc.pc" ]; then + echo "libclc: ERROR — install did not produce libclc.pc" >&2 + echo "libclc: expected at ${COOKBOOK_STAGE}/usr/lib/pkgconfig/libclc.pc" >&2 + echo "libclc: check that upstream libclc CMakeLists.txt installs pkgconfig files" >&2 + exit 1 +fi +if [ ! -d "${COOKBOOK_STAGE}/usr/share/clc" ]; then + echo "libclc: ERROR — install did not produce .bc files under usr/share/clc" >&2 + exit 1 +fi +if ! ls "${COOKBOOK_STAGE}/usr/share/clc"/*.bc >/dev/null 2>&1; then + echo "libclc: ERROR — usr/share/clc contains no .bc bitcode files" >&2 + exit 1 +fi ''' [[optional-packages]] diff --git a/local/recipes/system/redbear-dnsd/source/src/transport.rs b/local/recipes/system/redbear-dnsd/source/src/transport.rs index 4b259eb4f9..c58cb84598 100644 --- a/local/recipes/system/redbear-dnsd/source/src/transport.rs +++ b/local/recipes/system/redbear-dnsd/source/src/transport.rs @@ -355,8 +355,11 @@ pub(crate) struct UpstreamConfig { impl Default for UpstreamConfig { fn default() -> Self { + // Empty by default — main() reads the upstream list from netcfg + // before any query is dispatched. Hardcoding third-party DNS here + // would leak user queries without consent on first boot. Self { - servers: vec![Ipv4Addr::new(8, 8, 8, 8), Ipv4Addr::new(1, 1, 1, 1)], + servers: Vec::new(), timeout: QUERY_TIMEOUT, retries: 2, } diff --git a/local/recipes/system/redbear-passwd/recipe.toml b/local/recipes/system/redbear-passwd/recipe.toml index 7171bc2806..03613a1cd0 100644 --- a/local/recipes/system/redbear-passwd/recipe.toml +++ b/local/recipes/system/redbear-passwd/recipe.toml @@ -1,6 +1,10 @@ [package] name = "redbear-passwd" version = "0.3.1" +description = "Password management utility — change passwords, manage shadow file" + +[source] +path = "source" [build] template = "cargo" diff --git a/local/recipes/system/redbear-sessiond/source/src/manager.rs b/local/recipes/system/redbear-sessiond/source/src/manager.rs index ac2a03f773..e681a8f74a 100644 --- a/local/recipes/system/redbear-sessiond/source/src/manager.rs +++ b/local/recipes/system/redbear-sessiond/source/src/manager.rs @@ -178,6 +178,12 @@ impl LoginManager { } +fn kstop_writable() -> bool { + // metadata() rather than an actual write — writing "shutdown"/"reset" + // to /scheme/sys/kstop would trigger the action. + fs::metadata("/scheme/sys/kstop").is_ok() +} + #[interface(name = "org.freedesktop.login1.Manager")] impl LoginManager { fn get_session(&self, id: &str) -> fdo::Result { @@ -259,15 +265,27 @@ impl LoginManager { } fn can_power_off(&self) -> fdo::Result { - Ok(String::from("yes")) + if kstop_writable() { + Ok(String::from("yes")) + } else { + Ok(String::from("na")) + } } fn can_reboot(&self) -> fdo::Result { - Ok(String::from("yes")) + if kstop_writable() { + Ok(String::from("yes")) + } else { + Ok(String::from("na")) + } } fn can_suspend(&self) -> fdo::Result { - Ok(String::from("yes")) + if kstop_writable() { + Ok(String::from("yes")) + } else { + Ok(String::from("na")) + } } fn can_hibernate(&self) -> fdo::Result {