Add exclusion GID fetcher

6 files changed, 69 insertions, 0 deletions

diff --git a/dist-assets/pkg-scripts/preinstall b/dist-assets/pkg-scripts/preinstall
index ef6d953970..c8561c0730 100755
--- a/dist-assets/pkg-scripts/preinstall
+++ b/dist-assets/pkg-scripts/preinstall
@@ -30,3 +30,16 @@ fi
 # There is a risk that they're incompatible with the format this version wants
 rm "$NEW_CACHE_DIR/relays.json" || true
 rm "$NEW_CACHE_DIR/api-ip-address.txt" || true
+
+# Create a group for mullvad-exclusion
+MULLVAD_EXCLUSION_GROUP="mullvad-exclusion"
+if ! dscl . -list /Groups | grep $MULLVAD_EXCLUSION_GROUP; then
+  dscl . -create /Groups/$MULLVAD_EXCLUSION_GROUP \
+    || echo "FAILED TO CREATE $MULLVAD_EXCLUSION_GROUP GROUP"
+fi
+if ! dscl . -read /Groups/$MULLVAD_EXCLUSION_GROUP | grep PrimaryGroupID; then
+  MULLVAD_EXCLUSION_GID=$(( RANDOM ))
+  dscl . -append /Groups/$MULLVAD_EXCLUSION_GROUP PrimaryGroupID $MULLVAD_EXCLUSION_GID \
+    && echo "Created mullvad-exclusion group with gid $MULLVAD_EXCLUSION_GID" \
+    || echo "FAILED TO CREATE 'mullvad-exclusion' group"
+fi
diff --git a/dist-assets/uninstall_macos.sh b/dist-assets/uninstall_macos.sh
index 83316da3ba..7833ba528f 100755
--- a/dist-assets/uninstall_macos.sh
+++ b/dist-assets/uninstall_macos.sh
@@ -18,6 +18,9 @@ DAEMON_PLIST_PATH="/Library/LaunchDaemons/net.mullvad.daemon.plist"
 sudo launchctl unload -w "$DAEMON_PLIST_PATH"
 sudo rm -f "$DAEMON_PLIST_PATH"
 
+sudo dscl . -delete /groups/mullvad-exclusion || echo "Failed to remove 'mullvad-exclusion' group"
+
+
 echo "Resetting firewall"
 sudo /Applications/Mullvad\ VPN.app/Contents/Resources/mullvad-setup reset-firewall
 sudo /Applications/Mullvad\ VPN.app/Contents/Resources/mullvad-setup remove-wireguard-key
diff --git a/mullvad-daemon/src/exclusion_gid.rs b/mullvad-daemon/src/exclusion_gid.rs
new file mode 100644
index 0000000000..441b66cb2b
--- /dev/null
+++ b/mullvad-daemon/src/exclusion_gid.rs
@@ -0,0 +1,29 @@
+use std::ffi::CStr;
+/// name of the group that should be excluded
+const EXCLUSION_GROUP: &[u8] = b"mullvad-exclusion\0";
+
+/// Returns the GID of `mullvad-exclusion` group if it exists.
+pub fn get_exclusion_gid() -> Option<u32> {
+    let exclusion_group_name = unsafe { CStr::from_bytes_with_nul_unchecked(EXCLUSION_GROUP) };
+    talpid_core::macos::get_group_id(exclusion_group_name)
+}
+
+/// Attempts to set the GID of the current process to `mullvad-exclusion`.
+#[cfg(target_os = "macos")]
+pub fn set_exclusion_gid() {
+    if let Some(gid) = get_exclusion_gid() {
+        if let Err(err) = talpid_core::macos::set_gid(gid) {
+            log::error!("Failed to set group ID: {}", err);
+        }
+    } else {
+        log::error!("No exclusion ID available");
+    }
+}
+
+#[cfg(test)]
+mod test {
+    #[test]
+    fn test_exclusion_gid() {
+        let _ = super::get_exclusion_gid();
+    }
+}
diff --git a/mullvad-daemon/src/lib.rs b/mullvad-daemon/src/lib.rs
index 5557590b09..93ec0106cf 100644
--- a/mullvad-daemon/src/lib.rs
+++ b/mullvad-daemon/src/lib.rs
@@ -7,6 +7,9 @@ extern crate serde;
 mod account;
 pub mod account_history;
 pub mod exception_logging;
+#[cfg(target_os = "macos")]
+pub mod exclusion_gid;
+>>>>>>> 51cc8287d (Fix daemon code for GID exclusion)
 mod geoip;
 pub mod logging;
 #[cfg(not(target_os = "android"))]
@@ -555,6 +558,11 @@ where
         command_channel: DaemonCommandChannel,
         #[cfg(target_os = "android")] android_context: AndroidContext,
     ) -> Result<Self, Error> {
+        #[cfg(target_os = "macos")]
+        {
+            exclusion_gid::set_exclusion_gid();
+        };
+
         let (tunnel_state_machine_shutdown_tx, tunnel_state_machine_shutdown_signal) =
             oneshot::channel();
         let runtime = tokio::runtime::Handle::current();
diff --git a/talpid-core/src/lib.rs b/talpid-core/src/lib.rs
index 8d540fcdbd..648a45bda4 100644
--- a/talpid-core/src/lib.rs
+++ b/talpid-core/src/lib.rs
@@ -63,5 +63,9 @@ mod mktemp;
 #[cfg(target_os = "linux")]
 mod linux;
 
+/// Misc utilities for the macOS platform.
+#[cfg(target_os = "macos")]
+pub mod macos;
+
 /// A pair of functions to monitor and establish connectivity with ICMP
 pub mod ping_monitor;
diff --git a/talpid-core/src/macos.rs b/talpid-core/src/macos.rs
new file mode 100644
index 0000000000..7e6922b796
--- /dev/null
+++ b/talpid-core/src/macos.rs
@@ -0,0 +1,12 @@
+/// name of the group that should be excluded
+const EXCLUSION_GROUP: &[u8] = b"mullvad-exclusion\0";
+
+/// Returns the GID of `mullvad-exclusion` group if it exists.
+pub fn get_exclusion_gid() -> Option<u32> {
+    let group = unsafe { libc::getgrnam(EXCLUSION_GROUP.as_ptr() as *const _) };
+    if group.is_null() {
+        return None;
+    }
+    let gid = unsafe { (*group).gr_gid };
+    Some(gid)
+}