entd: require a per-entd-invocation session id in every request

bin/entdwife.sh

 #!/bin/sh
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This script is temporary front-end to entd.  It validates the policy's
 # signature before starting the daemon.  If the signing certificate or
 # signature to not validate, then this script will log an error to syslog
 # and exit without starting entd.
 #
@@ skipping 240 matching lines @@
     log "Can't start enterprise daemon, no username provided."
     return 1
   fi
 
   local domain="$(echo "$FLAGS_username" | cut -f2 -d'@')"
   if [ "$domain" = "gmail.com" ]; then
     log "Enterprise daemon disabled for gmail.com users."
     return 1
   fi
 
+  local session_path="$extension/session-id.json"
+  # Remove session-id file as it should be ignored when verifying
+  # the signature.
+  log "removing $session_path"
+  rm -f "$session_path"
+
   if ! cmd_verify "$extension"; then
     return 1
   fi
 
+  # Remove session-id.json at exit to enable the extension to remain
+  # backward compatible with earlier versions of entd/entwife.
+  trap "rm -f $session_path" EXIT TERM
+
+  # Provide a way for a developer to disable session id to simplify
+  # iterating new extensions.
+  local local_session_id=""
+  if [ ! -r "/root/.disable-entd-session-id" ]; then
+    session_id=$(head -c 8 /dev/urandom | openssl md5)
+  fi
+
+  cat > "$session_path" <<EOF
+{
+  "session_id": "$session_id"
+}
+EOF
+
   local root_ca_option=""
   if [ -f "$extension/$ROOT_CA_FILE" ]; then
     root_ca_option="--root-ca-file=$extension/$ROOT_CA_FILE"
   fi
 
   local extid="$(basename $(dirname "$extension"))"
 
-  exec "$FLAGS_entd" --utility="$FLAGS_utility" "$root_ca_option" \
+  # Run entd in the background and wait on it - this allows the
+  # shell interpreter to catch TERM signal and clean up session_path.
+  "$FLAGS_entd" --utility="$FLAGS_utility" "$root_ca_option" \
     --policy="$extension/policy.js" --manifest="$extension/manifest.json" \
-    --username="$FLAGS_username" --callback-origin=chrome-extension://"$extid"
+    --username="$FLAGS_username" --callback-origin=chrome-extension://"$extid" \
+    --session-id="$session_id" &
+  local pid=$!
+  wait $pid
 }
 
 cmd_disapprove() {
   if [ -f "$FLAGS_user_var/$APPROVED_CA" ]; then
     log "Removing enterprise certificate authority"
     rm -f "$FLAGS_user_var/$APPROVED_CA"
   else
     log "No enterprise certificate authority has been approved."
   fi
 }
@@ skipping 403 matching lines @@
 }
 EOF
 
   "$FLAGS_entd" --policy="$scriptfile" --manifest="$extension/manifest.json" \
     --username=user@example.com --allow-dirty-exit 2>/dev/null
 
   rm "$scriptfile"
 }
 
 main "$@"