feat: dde-api安全整改 #146
Merged
feat: dde-api安全整改 #146
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Reviewer's GuideThis PR enforces security improvements by migrating polkit rules, tightening service installation defaults, replacing the deepin-sound-player user with deepin-daemon, removing GSettings-based config loading, and updating Go dependencies and packaging scripts accordingly. Class diagram for config loading changes in sound-theme-playerclassDiagram
class config {
+bool Enabled
+bool DesktopLoginEnabled
+bool SystemShutdownEnabled
+string Theme
}
class ConfigLoader {
+saveUserConfig(uid int, cfg config) error
+loadConfig(filename string, cfg config) error
}
config <.. ConfigLoader
%% Removed: GSettings-based loading logic
%% Removed: _loadDefaultCfgFromGSettings
%% Removed: soundutils dependency
%% Removed: gio dependency
Flow diagram for conditional installation of deepin-locale-helper.serviceflowchart TD
A[Start install] --> B{INSTALL_LOCALE_HELPER == 1?}
B -- Yes --> C[Install deepin-locale-helper.service and related files]
B -- No --> D[Remove deepin-locale-helper.service and related files]
C --> E[Continue install]
D --> E[Continue install]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @fly602 - I've reviewed your changes - here's some feedback:
- Verify that removing the GSettings fallback for loading defaults still provides sensible initial configuration for fresh installs and tests.
- After changing the service user to ‘deepin-daemon’, audit all scripts and service files to ensure there are no leftover references to ‘deepin-sound-player’.
- Confirm that migrating from the old .pkla file to the new rules.d approach preserves the intended polkit permissions across all target distributions.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Verify that removing the GSettings fallback for loading defaults still provides sensible initial configuration for fresh installs and tests.
- After changing the service user to ‘deepin-daemon’, audit all scripts and service files to ensure there are no leftover references to ‘deepin-sound-player’.
- Confirm that migrating from the old .pkla file to the new rules.d approach preserves the intended polkit permissions across all target distributions.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
fly602
force-pushed
the
master
branch
5 times, most recently
from
68ed894 to
23b1697
Compare
/lib/systemd/system/deepin-locale-helper.service 应该默认仅deepin和uos打包； Log: dde-api安全整改 PMS: TASK-369021
/lib/systemd/system/deepin-sound-theme-player.service User不应该再使用deepin-sound-player Log: dde-api安全整改 PMS: TASK-369021
/var/lib/polkit-1/localauthority/10-vendor.d/org.deepin.dde.device.pkla 应该改用rules实现； Log: dde-api安全整改 PMS: TASK-369021
Contributor
|
TAG Bot New tag: 6.0.23 |
makefile中入参改用ifneq判断，dde-api安装时创建deepin-daemon用户 Log: dde-api安全整改 PMS: TASK-369021
KT-lcz
approved these changes
Aug 18, 2025
deepin pr auto review根据提供的git diff，我来分析一下代码的改进点：
潜在问题：
建议：
总体来说，这些改进提高了系统的安全性和可维护性，但需要确保充分测试以避免引入问题。 |
robertkill
approved these changes
Aug 19, 2025
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: fly602, KT-lcz, robertkill The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Log: dde-api安全整改
PMS: TASK-369021
Summary by Sourcery
Implement security hardening for dde-api by restricting default service installations, migrating polkit policies to rules, switching service users, updating dependencies, and cleaning up obsolete packaging.
New Features:
Enhancements:
Build:
Deployment:
Chores: