[PATCH 2/3] img/app: dbus: don't listen on VSOCK

[Alyssa Ross <hi@alyssa.is>]

After working on it for a while, I decided that it complicated the
D-Bus security model too much to upstream VSOCK support for the bus.
Proxying D-Bus with socat will allow us to drop the D-Bus VSOCK
patches.

The new dbus-vsock service starts before dbus-daemon to ensure that
VSOCK connections can be received as soon as
org.freedesktop.impl.portal.desktop.spectrum is started.  When a
connection is received (which should only be after the bus is up and
has started org.freedesktop.impl.portal.desktop.spectrum), it will be
relayed to the bus.

Sadly we do still need to allow ANONYMOUS authentication for now[1].

Signed-off-by: Alyssa Ross <hi@alyssa.is>
Link: https://github.com/z-galaxy/zbus/issues/1003#issuecomment-3523214990 [1]
---
 img/app/default.nix                           |  4 +-
 img/app/file-list.mk                          |  5 +++
 img/app/image/etc/dbus-1/session.conf         |  1 -
 .../XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT    |  1 +
 ...DESKTOP_PORTAL_SPECTRUM_GUEST_PORT.license |  2 +
 .../etc/s6-rc/dbus-vsock/notification-fd      |  1 +
 .../s6-rc/dbus-vsock/notification-fd.license  |  2 +
 img/app/image/etc/s6-rc/dbus-vsock/run        | 17 +++++++
 img/app/image/etc/s6-rc/dbus-vsock/type       |  1 +
 .../image/etc/s6-rc/dbus-vsock/type.license   |  2 +
 .../etc/s6-rc/dbus/dependencies.d/dbus-vsock  |  0
 img/app/image/etc/s6-rc/dbus/run              |  2 -
 tools/default.nix                             |  5 +--
 tools/xdg-desktop-portal-spectrum/meson.build |  3 --
 .../xdg-desktop-portal-spectrum.c             | 45 ++++++-------------
 15 files changed, 49 insertions(+), 42 deletions(-)
 create mode 100644 img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT
 create mode 100644 img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT.license
 create mode 100644 img/app/image/etc/s6-rc/dbus-vsock/notification-fd
 create mode 100644 img/app/image/etc/s6-rc/dbus-vsock/notification-fd.license
 create mode 100755 img/app/image/etc/s6-rc/dbus-vsock/run
 create mode 100644 img/app/image/etc/s6-rc/dbus-vsock/type
 create mode 100644 img/app/image/etc/s6-rc/dbus-vsock/type.license
 create mode 100644 img/app/image/etc/s6-rc/dbus/dependencies.d/dbus-vsock

diff --git a/img/app/default.nix b/img/app/default.nix
index 08cb2cd..6490ac2 100644
--- a/img/app/default.nix
+++ b/img/app/default.nix
@@ -71,6 +71,8 @@ let
       pkgs.s6
       pkgs.s6-linux-init
       pkgs.s6-rc
+      pkgs.socat
+      pkgs.systemd
       pkgs.wayland-proxy-virtwl
       pkgs.wireplumber
       pkgs.xdg-desktop-portal
@@ -88,7 +90,7 @@ let
   } ''
     mkdir $out
     lndir -ignorelinks -silent ${appimageFhsenv} $out
-    rm $out/etc/dbus-1/session.conf
+    rm $out/etc/dbus-1/session.conf $out/usr/bin/init
   '';
 in
 
diff --git a/img/app/file-list.mk b/img/app/file-list.mk
index 0b4d3d1..6934975 100644
--- a/img/app/file-list.mk
+++ b/img/app/file-list.mk
@@ -17,6 +17,7 @@ FILES = \
 	image/etc/s6-linux-init/env/GTK_USE_PORTAL \
 	image/etc/s6-linux-init/env/NIX_XDG_DESKTOP_PORTAL_DIR \
 	image/etc/s6-linux-init/env/WAYLAND_DISPLAY \
+	image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT \
 	image/etc/s6-linux-init/env/XDG_RUNTIME_DIR \
 	image/etc/s6-linux-init/run-image/service/getty-hvc0/run \
 	image/etc/s6-linux-init/run-image/service/s6-linux-init-shutdownd/notification-fd \
@@ -39,6 +40,10 @@ S6_RC_FILES = \
 	image/etc/s6-rc/app/dependencies.d/wayland-proxy-virtwl \
 	image/etc/s6-rc/app/run \
 	image/etc/s6-rc/app/type \
+	image/etc/s6-rc/dbus-vsock/notification-fd \
+	image/etc/s6-rc/dbus-vsock/run \
+	image/etc/s6-rc/dbus-vsock/type \
+	image/etc/s6-rc/dbus/dependencies.d/dbus-vsock \
 	image/etc/s6-rc/dbus/notification-fd \
 	image/etc/s6-rc/dbus/run \
 	image/etc/s6-rc/dbus/type \
diff --git a/img/app/image/etc/dbus-1/session.conf b/img/app/image/etc/dbus-1/session.conf
index 751a788..d31f4b9 100644
--- a/img/app/image/etc/dbus-1/session.conf
+++ b/img/app/image/etc/dbus-1/session.conf
@@ -19,7 +19,6 @@
        default config file with an address override on the command
        line, because command line address can only be given once.
        So that's why we need a whole custom session.conf. -->
-  <listen>vsock:</listen>
   <listen>unix:path=/run/session-bus</listen>
 
   <auth>EXTERNAL</auth>
diff --git a/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT b/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT
new file mode 100644
index 0000000..037ba97
--- /dev/null
+++ b/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT
@@ -0,0 +1 @@
+219
diff --git a/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT.license b/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/img/app/image/etc/s6-linux-init/env/XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/img/app/image/etc/s6-rc/dbus-vsock/notification-fd b/img/app/image/etc/s6-rc/dbus-vsock/notification-fd
new file mode 100644
index 0000000..00750ed
--- /dev/null
+++ b/img/app/image/etc/s6-rc/dbus-vsock/notification-fd
@@ -0,0 +1 @@
+3
diff --git a/img/app/image/etc/s6-rc/dbus-vsock/notification-fd.license b/img/app/image/etc/s6-rc/dbus-vsock/notification-fd.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/img/app/image/etc/s6-rc/dbus-vsock/notification-fd.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/img/app/image/etc/s6-rc/dbus-vsock/run b/img/app/image/etc/s6-rc/dbus-vsock/run
new file mode 100755
index 0000000..37fae7d
--- /dev/null
+++ b/img/app/image/etc/s6-rc/dbus-vsock/run
@@ -0,0 +1,17 @@
+#!/bin/execlineb -P
+# SPDX-License-Identifier: EUPL-1.2+
+# SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
+
+if { modprobe vsock }
+
+export LISTEN_FDS 1
+getpid LISTEN_PID
+export SYSTEMD_LOG_LEVEL notice
+
+systemd-socket-activate -l vsock::219 --now
+
+# Notify readiness.
+if { fdmove 1 3 echo }
+fdclose 3
+
+socat ACCEPT-FD:4,fork UNIX-CONNECT:/run/session-bus
diff --git a/img/app/image/etc/s6-rc/dbus-vsock/type b/img/app/image/etc/s6-rc/dbus-vsock/type
new file mode 100644
index 0000000..5883cff
--- /dev/null
+++ b/img/app/image/etc/s6-rc/dbus-vsock/type
@@ -0,0 +1 @@
+longrun
diff --git a/img/app/image/etc/s6-rc/dbus-vsock/type.license b/img/app/image/etc/s6-rc/dbus-vsock/type.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/img/app/image/etc/s6-rc/dbus-vsock/type.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/img/app/image/etc/s6-rc/dbus/dependencies.d/dbus-vsock b/img/app/image/etc/s6-rc/dbus/dependencies.d/dbus-vsock
new file mode 100644
index 0000000..e69de29
diff --git a/img/app/image/etc/s6-rc/dbus/run b/img/app/image/etc/s6-rc/dbus/run
index a226abf..75e9cab 100644
--- a/img/app/image/etc/s6-rc/dbus/run
+++ b/img/app/image/etc/s6-rc/dbus/run
@@ -2,8 +2,6 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2023 Alyssa Ross <hi@alyssa.is>
 
-if { modprobe vsock }
-
 dbus-daemon
   --config-file /etc/dbus-1/session.conf
   --nofork
diff --git a/tools/default.nix b/tools/default.nix
index 18d4dd6..0492f98 100644
--- a/tools/default.nix
+++ b/tools/default.nix
@@ -6,7 +6,7 @@ import ../lib/call-package.nix (
 { src, lib, stdenv, fetchCrate, fetchurl, runCommand, buildPackages
 , meson, ninja, pkg-config, rustc
 , clang-tools, clippy, jq
-, dbus, linuxHeaders
+, linuxHeaders
 , clang, libbpf
 , buildSupport ? false
 , appSupport ? true
@@ -88,8 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals (appSupport || driverSupport) [ pkg-config ]
     ++ lib.optionals hostSupport [ rustc ]
     ++ lib.optionals driverSupport [ clang.cc ];
-  buildInputs = lib.optionals appSupport [ dbus ]
-    ++ lib.optionals driverSupport [ libbpf linuxHeaders ];
+  buildInputs = lib.optionals driverSupport [ libbpf linuxHeaders ];
 
   postPatch = lib.optionals hostSupport (lib.concatMapStringsSep "\n" (crate: ''
     mkdir -p subprojects/packagecache
diff --git a/tools/xdg-desktop-portal-spectrum/meson.build b/tools/xdg-desktop-portal-spectrum/meson.build
index 7c2716f..a99c66d 100644
--- a/tools/xdg-desktop-portal-spectrum/meson.build
+++ b/tools/xdg-desktop-portal-spectrum/meson.build
@@ -1,8 +1,6 @@
 # SPDX-License-Identifier: EUPL-1.2+
 # SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
 
-dbus = dependency('dbus-1')
-
 install_data('spectrum.portal',
   install_dir : get_option('datadir') / 'xdg-desktop-portal/portals')
 
@@ -21,5 +19,4 @@ configure_file(
   configuration : exe_conf_data)
 
 executable('xdg-desktop-portal-spectrum', 'xdg-desktop-portal-spectrum.c',
-  dependencies : dbus,
   install : true)
diff --git a/tools/xdg-desktop-portal-spectrum/xdg-desktop-portal-spectrum.c b/tools/xdg-desktop-portal-spectrum/xdg-desktop-portal-spectrum.c
index 690d397..3c75923 100644
--- a/tools/xdg-desktop-portal-spectrum/xdg-desktop-portal-spectrum.c
+++ b/tools/xdg-desktop-portal-spectrum/xdg-desktop-portal-spectrum.c
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: EUPL-1.2+
-// SPDX-FileCopyrightText: 2024 Alyssa Ross <hi@alyssa.is>
+// SPDX-FileCopyrightText: 2024-2025 Alyssa Ross <hi@alyssa.is>
 
 #include <arpa/inet.h>
 #include <err.h>
@@ -8,7 +8,6 @@
 #include <stdio.h>
 #include <stdint.h>
 #include <stdlib.h>
-#include <string.h>
 #include <unistd.h>
 
 #include <sys/socket.h>
@@ -16,12 +15,13 @@
 
 #include <linux/vm_sockets.h>
 
-#include <dbus/dbus.h>
-
 #include "config.h"
 
 static const uint32_t HOST_PORT = 219;
 
+static const char GUEST_PORT_ENV_VAR[] =
+	"XDG_DESKTOP_PORTAL_SPECTRUM_GUEST_PORT";
+
 static int parse_u32(const char *s, uint32_t *v)
 {
 	char *end;
@@ -113,36 +113,17 @@ static void check_result(int sock)
 
 int main(void)
 {
-	char *addr = getenv("DBUS_STARTER_ADDRESS");
-
-	DBusAddressEntry **entries;
-	int entries_len, i, sock;
-	DBusError error;
-
-	const char *port_str;
+	int sock;
 	uint32_t port;
+	char *port_str = getenv(GUEST_PORT_ENV_VAR);
 
-	if (!addr)
-		errx(EXIT_FAILURE, "DBUS_STARTER_ADDRESS not set");
+	if (!port_str)
+		errx(EXIT_FAILURE, "%s is not set", GUEST_PORT_ENV_VAR);
 
-	if (!dbus_parse_address(addr, &entries, &entries_len, &error))
-		errx(EXIT_FAILURE, "parsing D-Bus address '%s': %s",
-		     addr, error.message);
+	if (parse_u32(port_str, &port) == -1)
+		err(EXIT_FAILURE, "D-Bus address vsock port");
 
-	for (i = 0; i < entries_len; i++) {
-		if (strcmp(dbus_address_entry_get_method(entries[i]), "vsock"))
-			continue;
-
-		if (!(port_str = dbus_address_entry_get_value(entries[i], "port")))
-			errx(EXIT_FAILURE, "missing vsock port in D-Bus address '%s'",
-			     addr);
-
-		if (parse_u32(port_str, &port) == -1)
-			err(EXIT_FAILURE, "D-Bus address vsock port");
-
-		sock = connect_to_host();
-		send_info(sock, port);
-		check_result(sock);
-		return 0;
-	}
+	sock = connect_to_host();
+	send_info(sock, port);
+	check_result(sock);
 }
-- 
2.51.0