TylerandClaude Fable 5
2c0b8b021e
Template tests / tests (pull_request) Failing after 33s
Phase 3 of the improvement plan (PR 10 of the sequence): honest Wayland behavior and a least-privilege alternative to the broad `input` group the audit flagged as a keylogging surface. Least-privilege input access: - packaging/linux/common/60-stepforge-input.rules grants the ACTIVE session read access to MOUSE devices only (ID_INPUT_MOUSE, excluding ID_INPUT_KEYBOARD) via a systemd uaccess ACL — session-scoped, device- scoped, and never keyboards. This replaces `usermod -aG input`, which grants every input device (keyboards included) to the user permanently. - scripts/linux/enable-click-capture.sh installs it opt-in: it prints the exact rule, requires confirmation, and documents the security tradeoff. It never runs the broad-group command. Honest trigger reporting: - New chooseCaptureTrigger() (app/platform/linux/diagnostics.js, re-exported from app/platform/index.js) maps a capability profile to the real trigger: per-click with a marker on X11+xinput; per-click WITHOUT coordinates or a marker on Wayland evdev (the platform exposes no pointer position); and an honest hotkey/interval fallback otherwise. It never promises per-click capture with coordinates on Wayland. - platform:capabilities now includes the active trigger for the machine and the user's fallback setting, for the diagnostics UI. Docs: - GETTING_STARTED_WITH_LINUX.md no longer instructs every Wayland user to join the `input` group; it presents that as a warning, documents the least- privilege script, corrects the capability table (per-click is opt-in, mice only; hotkey/interval is the default Wayland trigger), and points at Settings → Diagnostics. Tests: trigger decisions for X11/xinput, Wayland evdev (no coordinates/marker), Wayland fallback (interval/hotkey with an honest note), the platform facade wiring, Windows; the udev rule (mouse-only, excludes keyboards, uaccess); the opt-in enable script (confirms, installs the rule, never runs usermod -aG input as a command); and docs guards. 289 unit tests pass; startup smoke and click self-test unchanged (stream, markers 3/3, burst 8/8). Co-Authored-By: Claude Fable 5 <[email protected]>
20 lines
1.0 KiB
Plaintext
20 lines
1.0 KiB
Plaintext
# StepForge least-privilege input access (OPTIONAL, opt-in).
|
|
#
|
|
# Grants the user at the ACTIVE local session read/write access to MOUSE input
|
|
# devices only, via systemd-logind's `uaccess` ACL. This is the least-privilege
|
|
# alternative to joining the broad `input` group, which would grant access to
|
|
# ALL input devices — including keyboards — for the user permanently, on every
|
|
# session. StepForge never needs keystrokes, so this rule deliberately EXCLUDES
|
|
# keyboards.
|
|
#
|
|
# Scope of what this grants:
|
|
# * only devices udev classifies as a mouse (ID_INPUT_MOUSE=1),
|
|
# * only when they are NOT also a keyboard (ID_INPUT_KEYBOARD!=1),
|
|
# * only to whoever is logged in at the physical seat (uaccess is
|
|
# session-scoped, not a permanent group membership).
|
|
#
|
|
# StepForge uses this only for the optional Wayland per-click *trigger* (button
|
|
# presses, no coordinates). It is not required — the safe default is a global
|
|
# hotkey or interval capture.
|
|
SUBSYSTEM=="input", KERNEL=="event*", ENV{ID_INPUT_MOUSE}=="1", ENV{ID_INPUT_KEYBOARD}!="1", TAG+="uaccess"
|