specialworld83/BastionGuard
1
0
Fork 0
Code Issues Activity

Fix cef Ubuntu

Browse source
This commit is contained in:
specialworld83 2026-07-15 12:59:39 +02:00
commit ef00ba9b42
3 changed files with 222 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

124
debian/change_cmake/CMakeLists.txt vendored
View file

@ -1,6 +1,85 @@
cmake_minimum_required(VERSION 3.16)
project(BastionGuard LANGUAGES CXX)
# ============================================================
# CEF feature policy
# ============================================================
# IMPORTANT:
# ENABLE_CEF controls only the optional standalone CEF proxy and the
# system-wide CA installer. It does NOT control the embedded CEF runtime
# used by SecureBrowser, BankPage, BankOpener, BankGUI or Secure Payments.
# Those components are always built and installed.
option(ENABLE_CEF
"Enable optional standalone CEF proxy/system-CA integration; embedded Secure Browser remains enabled"
ON)
option(ENABLE_CEF_DAEMON
"Build and install the standalone bastionguard-cef proxy and user service"
ON)
option(ENABLE_SYSTEM_CA_INSTALL
"Install the system CA policy and install-ca-system.sh helper"
ON)
set(BG_OS_RELEASE_FILE "/etc/os-release" CACHE FILEPATH
"os-release file used for distro-specific build decisions")
set(BG_OS_ID "")
set(BG_UBUNTU_LINUXMINT FALSE)
# Match the exact distribution ID only. ID_LIKE is deliberately ignored,
# therefore Debian (ID=debian) is never treated as Ubuntu/Linux Mint.
if(EXISTS "${BG_OS_RELEASE_FILE}")
file(STRINGS "${BG_OS_RELEASE_FILE}" BG_OS_ID_LINE REGEX "^ID=")
if(BG_OS_ID_LINE)
list(GET BG_OS_ID_LINE 0 BG_OS_ID_LINE_FIRST)
string(REGEX REPLACE "^ID=[\\\"']?([^\\\"']+)[\\\"']?$" "\\1"
BG_OS_ID "${BG_OS_ID_LINE_FIRST}")
string(TOLOWER "${BG_OS_ID}" BG_OS_ID)
endif()
endif()
if(BG_OS_ID STREQUAL "ubuntu" OR BG_OS_ID STREQUAL "linuxmint")
set(BG_UBUNTU_LINUXMINT TRUE)
set(ENABLE_CEF OFF CACHE BOOL
"Disable only standalone CEF proxy/system-CA integration on Ubuntu/Linux Mint"
FORCE)
endif()
# ENABLE_CEF=OFF must never disable the embedded browser stack.
# It only turns off the standalone proxy daemon and system CA installer.
if(NOT ENABLE_CEF)
set(ENABLE_CEF_DAEMON OFF CACHE BOOL
"Build and install the standalone bastionguard-cef proxy and user service"
FORCE)
set(ENABLE_SYSTEM_CA_INSTALL OFF CACHE BOOL
"Install the system CA policy and install-ca-system.sh helper"
FORCE)
endif()
# Embedded CEF is intentionally unconditional.
add_compile_definitions(
BASTIONGUARD_HAS_CEF=1
BASTIONGUARD_HAS_EMBEDDED_CEF=1
)
if(ENABLE_CEF_DAEMON)
add_compile_definitions(BASTIONGUARD_HAS_CEF_DAEMON=1)
else()
add_compile_definitions(BASTIONGUARD_HAS_CEF_DAEMON=0)
endif()
if(ENABLE_SYSTEM_CA_INSTALL)
add_compile_definitions(BASTIONGUARD_ALLOW_SYSTEM_CA_INSTALL=1)
else()
add_compile_definitions(BASTIONGUARD_ALLOW_SYSTEM_CA_INSTALL=0)
endif()
message(STATUS "BG_OS_ID = ${BG_OS_ID}")
message(STATUS "BG_UBUNTU_LINUXMINT = ${BG_UBUNTU_LINUXMINT}")
message(STATUS "ENABLE_CEF = ${ENABLE_CEF} (optional proxy/CA only)")
message(STATUS "ENABLE_CEF_DAEMON = ${ENABLE_CEF_DAEMON}")
message(STATUS "ENABLE_SYSTEM_CA_INSTALL = ${ENABLE_SYSTEM_CA_INSTALL}")
message(STATUS "Embedded Secure Browser / Bank = ALWAYS ENABLED")
# ============================================================
# Packaging: disable privileged install-time actions (DEB/RPM/CI)
# ============================================================
@ -166,7 +245,11 @@ endfunction()
option(ENABLE_SYSTEMD_SERVICES "Enable and start systemd services at install time" OFF)
# --- Percorso dati installati (es: /usr/share/BastionGuard/data) ---
install(DIRECTORY data/ DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data)
install(DIRECTORY data/
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data
PATTERN "scripts/install-ca-system.sh" EXCLUDE
PATTERN "service/BastionGuard-cef.service" EXCLUDE
)
set(INSTALL_DATA_DIR "${CMAKE_INSTALL_FULL_DATAROOTDIR}/BastionGuard/data")
@ -690,10 +773,9 @@ endif()
message(STATUS "✔ Wrapper statico CEF trovato: ${CEF_WRAPPER}")
# ------------------------------------------------------------
# Aggiungi SecureBrowser
# SecureBrowser is already part of BastionGuard_SOURCES above and remains
# unconditional even when ENABLE_CEF=OFF.
# ------------------------------------------------------------
list(APPEND BastionGuard_SOURCES src/SecureBrowser.cpp)
include_directories(${CEF_ROOT} ${CEF_ROOT}/include)
target_link_libraries(BastionGuard
@ -1297,6 +1379,7 @@ target_compile_features(bastionguard-pacd PRIVATE cxx_std_17)
install(TARGETS bastionguard-pacd RUNTIME DESTINATION bin)
if(ENABLE_CEF_DAEMON)
# ======================
# BastionGuard CEF Proxy (bastionguard-cef)
# ======================
@ -1371,6 +1454,8 @@ bg_set_rpath(bastionguard-cef)
install(TARGETS bastionguard-cef RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
endif()
# ======================
# BastionGuard Secure Payments
# - BastionGuard-secure (CLI opener)
@ -2195,13 +2280,20 @@ endif()
install(FILES data/service/org.BastionGuard.RansomwareAlert.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/dbus-1/services)
install(FILES actions/policy/org.BastionGuard.policy
FILES actions/policy/org.BastionGuard.ransomware.policy
FILES actions/policy/org.BastionGuard.USBD.policy
FILES actions/policy/eu.bastionguard.install-ca.policy
install(FILES
actions/policy/org.BastionGuard.policy
actions/policy/org.BastionGuard.ransomware.policy
actions/policy/org.BastionGuard.USBD.policy
DESTINATION /usr/share/polkit-1/actions
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
if(ENABLE_SYSTEM_CA_INSTALL)
install(FILES actions/policy/eu.bastionguard.install-ca.policy
DESTINATION /usr/share/polkit-1/actions
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
)
endif()
install(FILES actions/dbus/org.BastionGuard.USBD.conf
DESTINATION /usr/share/dbus-1/system.d
PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
@ -2273,13 +2365,19 @@ install(FILES
data/service/BastionGuard-ransomware-realtime-alert.service
data/service/BastionGuard-ransomware-scanner.service
data/service/BastionGuard-pacd.service
data/service/BastionGuard-cef.service
data/service/BastionGuard-mailproxy.service
data/service/BastionGuard-user-session-watch.service
DESTINATION /usr/lib/systemd/user
)
if(ENABLE_CEF_DAEMON)
install(FILES data/service/BastionGuard-cef.service
DESTINATION /usr/lib/systemd/user
)
install(FILES data/service/BastionGuard-cef.service
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/service
)
endif()
# helper script to enable user agents for logged-in users
install(PROGRAMS
@ -2293,6 +2391,12 @@ install(PROGRAMS
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
if(ENABLE_SYSTEM_CA_INSTALL)
install(PROGRAMS data/scripts/install-ca-system.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/scripts
)
endif()
install(PROGRAMS
data/extension/bastionguard-tb-extension/install-tb-extension.sh
DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/BastionGuard/data/extension/bastionguard-tb-extension

141
src/DistroUtils.hpp
View file

@ -17,52 +17,113 @@
namespace BastionGuard::Platform {
inline std::string normalize_os_release_value(std::string value) {
if (value.size() >= 2 && value.front() == '"' && value.back() == '"') {
value = value.substr(1, value.size() - 2);
}
std::transform(value.begin(), value.end(), value.begin(), [](unsigned char c) {
return static_cast<char>(std::tolower(c));
});
return value;
}
inline std::string normalize_os_release_value(std::string value) {
if (value.size() >= 2 && value.front() == '"' && value.back() == '"') {
value = value.substr(1, value.size() - 2);
}
inline std::unordered_map<std::string, std::string> read_os_release() {
std::unordered_map<std::string, std::string> values;
std::ifstream input("/etc/os-release");
std::string line;
while (std::getline(input, line)) {
if (line.empty() || line.front() == '#') continue;
const auto sep = line.find('=');
if (sep == std::string::npos) continue;
values[line.substr(0, sep)] = normalize_os_release_value(line.substr(sep + 1));
}
return values;
}
std::transform(
value.begin(),
value.end(),
value.begin(),
[](unsigned char c) {
return static_cast<char>(std::tolower(c));
}
);
inline bool is_fedora_rhel_family() {
const auto values = read_os_release();
const auto id_it = values.find("ID");
const std::string id = id_it == values.end() ? std::string{} : id_it->second;
if (id == "fedora" || id == "rhel" || id == "almalinux" || id == "alma" ||
id == "rocky" || id == "rockylinux") {
return true;
return value;
}
return false;
}
inline std::unordered_map<std::string, std::string> read_os_release() {
std::unordered_map<std::string, std::string> values;
#ifndef BASTIONGUARD_HAS_CEF
#define BASTIONGUARD_HAS_CEF 1
#endif
std::ifstream input("/etc/os-release");
std::string line;
inline bool cef_supported() {
return !is_fedora_rhel_family();
}
while (std::getline(input, line)) {
if (line.empty() || line.front() == '#') {
continue;
}
inline bool cef_available() {
return BASTIONGUARD_HAS_CEF != 0 && cef_supported();
}
const auto separator = line.find('=');
if (separator == std::string::npos) {
continue;
}
values[line.substr(0, separator)] =
normalize_os_release_value(line.substr(separator + 1));
}
return values;
}
inline std::string distribution_id() {
const auto values = read_os_release();
const auto iterator = values.find("ID");
if (iterator == values.end()) {
return {};
}
return iterator->second;
}
inline bool is_fedora_rhel_family() {
const std::string id = distribution_id();
return id == "fedora" ||
id == "rhel" ||
id == "redhat" ||
id == "centos" ||
id == "almalinux" ||
id == "alma" ||
id == "rocky" ||
id == "rockylinux" ||
id == "ol";
}
inline bool is_ubuntu_family() {
const std::string id = distribution_id();
return id == "ubuntu" ||
id == "linuxmint";
}
/*
* Il daemon CEF e l'installazione della CA di sistema sono disabilitati
* su Fedora/RHEL, Ubuntu e Linux Mint.
*
* Debian non viene incluso.
*/
inline bool cef_daemon_supported() {
return !is_fedora_rhel_family() &&
!is_ubuntu_family();
}
#ifndef BASTIONGUARD_HAS_EMBEDDED_CEF
#define BASTIONGUARD_HAS_EMBEDDED_CEF 1
#endif
#ifndef BASTIONGUARD_HAS_CEF_DAEMON
#define BASTIONGUARD_HAS_CEF_DAEMON 1
#endif
/*
* CEF embedded:
* Secure Browser, Bank GUI, Bank Opener e Secure Payments.
*
* Non dipende dalla distribuzione.
*/
inline bool cef_available() {
return BASTIONGUARD_HAS_EMBEDDED_CEF != 0;
}
/*
* Solo daemon proxy CEF e funzionalità collegate alla CA.
*/
inline bool cef_daemon_available() {
return BASTIONGUARD_HAS_CEF_DAEMON != 0 &&
cef_daemon_supported();
}
} // namespace BastionGuard::Platform

15
src/wizard/wizard_window.cpp
View file

@ -374,10 +374,11 @@ WizardWindow::WizardWindow()
build_pages();
if (BastionGuard::Platform::is_fedora_rhel_family()) {
if ((BastionGuard::Platform::is_fedora_rhel_family() ||
BastionGuard::Platform::is_ubuntu_family())) {
m_chk_certs.set_active(false);
m_chk_certs.set_sensitive(false);
m_desc_certs.set_text(_("Installazione dei certificati di sistema disabilitata su Fedora, RHEL, AlmaLinux e Rocky Linux. CEF non è disponibile su queste distribuzioni."));
m_desc_certs.set_text(_("Installazione della CA di sistema e del daemon CEF disabilitata su Fedora, RHEL, AlmaLinux, Rocky Linux, Ubuntu e Linux Mint. Secure Browser e Bank GUI restano disponibili."));
}
set_page(0);
@ -654,8 +655,9 @@ void WizardWindow::set_page(int idx) {
? Glib::ustring("✔ ") + _("Firewall avanzato nftables (installazione e configurazione automatica)") + "\n"
: Glib::ustring("✘ ") + _("Firewall avanzato nftables") + "\n";
if (BastionGuard::Platform::is_fedora_rhel_family()) {
summary += Glib::ustring("⊘ ") + _("Certificati CA e CEF non disponibili su questa distribuzione") + "\n";
if ((BastionGuard::Platform::is_fedora_rhel_family() ||
BastionGuard::Platform::is_ubuntu_family())) {
summary += Glib::ustring("⊘ ") + _("Installazione CA di sistema e daemon CEF disabilitati su questa distribuzione; Secure Browser e Bank GUI restano disponibili") + "\n";
} else {
summary += m_chk_certs.get_active()
? Glib::ustring("✔ ") + _("Certificati CA (generazione + installazione)") + "\n"
@ -823,10 +825,11 @@ void WizardWindow::worker_run() {
}
}
if (m_chk_certs.get_active() && !BastionGuard::Platform::is_fedora_rhel_family()) {
if (m_chk_certs.get_active() && !(BastionGuard::Platform::is_fedora_rhel_family() ||
BastionGuard::Platform::is_ubuntu_family())) {
gen_cert_commands(cmds);
} else if (m_chk_certs.get_active()) {
append_log(_("Certificati ignorati: funzione disabilitata su Fedora/RHEL/Alma/Rocky."));
append_log(_("Certificati ignorati: installazione CA di sistema disabilitata su Fedora/RHEL/Alma/Rocky e Ubuntu/Linux Mint."));
}
if (m_chk_webconf.get_active()) {