AskaEth/MeowOS-For-R3P2
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sec): 签名鉴权 2B (agent-221) — meow_verify 多公钥数组+v2签名块(含ts,未来宽限,兼容v1)+meow_sign verify子命令+产签README; svc_power 面板身份精确路径绑定(删启发式,3反例验证)

Browse Source 
meow_verify→6c2e8ed2; svc_power→306df962; qemu+宿主全过
This commit is contained in:
MeowOS committed 2026-08-31 15:36:45 +08:00
1 parent 249b6224ab
commit 05a19a9ea3
13 files changed
+497 -78
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

patch_v2/meow_svc_power/svc_power_authtest.c
+14 -1
View File
@@ -45,9 +45,22 @@ int main(void)
classify_exe("/usr/bin/meow_svc_power", &c);
CHECK(c.kind == CALL_SYS); /* /usr/bin/meow_* 前缀批准 */
/* 2B 精确绑定：仅精确命中登记路径（meowpanel.conf 的 exec）才予 os.meow.panel。
* 旧启发式（路径含 /MeowPanel/ 或 meowpanel 子串）会被过宽放行，今已收紧为精确路径登记。 */
memset(&c, 0, sizeof c);
classify_exe("/usr/data/mnt/sd_0/MeowOS/opt/MeowPanel/meowpanel", &c);
CHECK(c.kind == CALL_SYS && strcmp(c.pkg, "os.meow.panel") == 0);
/* 反例：路径含 /MeowPanel/ 或 meowpanel 子串但并非精确登记路径 → 不再放行（CALL_OTHER） */
memset(&c, 0, sizeof c);
classify_exe("/usr/data/mnt/sd_0/MeowOS/opt/MeowPanel/backend/meowpanel", &c);
CHECK(c.kind == CALL_SYS && strcmp(c.pkg, "os.meow.panel") == 0);
CHECK(c.kind == CALL_OTHER);
memset(&c, 0, sizeof c);
classify_exe("/usr/data/mnt/sd_0/MeowOS/opt/MeowPanel/evil", &c);
CHECK(c.kind == CALL_OTHER);
memset(&c, 0, sizeof c);
classify_exe("/usr/bin/meowpanel_fake", &c);
CHECK(c.kind == CALL_OTHER); /* 含 "meowpanel" 但非 /usr/bin/meow_* 精确前缀、非登记路径 */
memset(&c, 0, sizeof c);
classify_exe("/usr/data/meow/settings_tool", &c);