From 2251162c3d015ef68589089b3ede4579d6e1cc92 Mon Sep 17 00:00:00 2001 From: Martin Sirringhaus Date: Fri, 14 Aug 2026 14:50:26 +0200 Subject: [PATCH] Always trust system-paths, and only extend the list with debug env-variable --- credentialsd/src/gateway/mod.rs | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/credentialsd/src/gateway/mod.rs b/credentialsd/src/gateway/mod.rs index 594ea2aa..96e69d22 100644 --- a/credentialsd/src/gateway/mod.rs +++ b/credentialsd/src/gateway/mod.rs @@ -262,19 +262,19 @@ async fn should_trust_app_id(pid: u32) -> bool { }; tracing::debug!(?exe_path, %pid, "Found executable path:"); - let trusted_callers: Vec = if cfg!(debug_assertions) { + + let mut trusted_callers: Vec = vec![ + PathBuf::from("/usr/lib/xdg-desktop-portal"), + PathBuf::from("/usr/libexec/xdg-desktop-portal"), + PathBuf::from("/usr/local/lib/xdg-desktop-portal"), + PathBuf::from("/usr/local/libexec/xdg-desktop-portal"), + ]; + if cfg!(debug_assertions) { let trusted_callers_env = std::env::var("CREDSD_TRUSTED_CALLERS").unwrap_or_default(); - trusted_callers_env + let custom_paths = trusted_callers_env .split(',') - .filter_map(|path| Path::new(path).canonicalize().ok()) - .collect() - } else { - vec![ - PathBuf::from("/usr/lib/xdg-desktop-portal"), - PathBuf::from("/usr/libexec/xdg-desktop-portal"), - PathBuf::from("/usr/local/lib/xdg-desktop-portal"), - PathBuf::from("/usr/local/libexec/xdg-desktop-portal"), - ] + .filter_map(|path| Path::new(path).canonicalize().ok()); + trusted_callers.extend(custom_paths); }; tracing::debug!( ?trusted_callers,