2 Commits

Author	SHA1	Message	Date
Krzysztof kuhy Rudnicki	b3e629e3f0	Bill gaming time only while the user is actually playing ... A running game process was treated as proof of play. On 2026-08-28 the budget billed ~2h23m while a gatelock screen locker covered the display and the machine could not be touched at all -- the game was simply still resident. A tick now bills only when all three hold, evaluated together rather than short-circuited so the audit log can answer "was the screen ALSO locked?": * no gatelock guard owns the screen (_screen_hold, via /proc/locks) * the focused window belongs to a qualifying process or its ancestry * some input source has been used within idle_grace_seconds (default 300) Any probe that cannot answer BILLS the tick and is recorded in `degraded`. A broken detector must never become an unlimited-gaming exploit. Three findings from measuring this machine rather than assuming: * /dev/input/js0 here is an *ASRock LED Controller* -- the kernel exposes the motherboard RGB device as a joystick. A presence check would have disabled the idle criterion permanently, so _controller_input watches for real events instead (skipping joydev's synthetic open burst). * Aseprite's window carries no _NET_WM_PID at all, so focus attribution falls back to XRes, which asks the server who owns the window rather than trusting the client to have announced itself. * /proc/locks reports gatelock's hold without taking it; gatelock's own read_claim_if_held detects held-ness by acquiring, which would race a guard every 3 seconds. Idle pauses also refund the grace period once per walk-away, on the engaged->paused edge only, never across a day rollover, and never on the first tick after a restart -- the only place the counter moves backwards. Everything is recorded to /var/log/steam-backlog-enforcer/budget.jsonl, on change plus a heartbeat rather than one line per 3s tick. Records name the qualifying PIDs: reconstructing this incident from journald alone was only possible by inferring accrual from the spacing of two warning notifications. Also: refuse to bounce Steam while a game is running. ensure_steam_debug_port relaunches Steam when the CDP port is closed, which kills the running game -- that is how restarting the daemon to deploy this change ended a live session. It now defers exactly as it already did for in-flight game updates. Talks to X through ctypes over one cached connection: at a 3s tick, forking xprintidle and xprop would cost ~40 forks a minute. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019CEsG6BzHtYR9cHcdxPZqG	2026-08-28 19:24:14 +02:00
Krzysztof kuhy Rudnicki	21fe2f7742	Stop the enforcer launching Steam and notifications as root ... The enforce service runs as root (no User=) but sets DISPLAY=:0, so any GUI it starts lands on the desktop session. Two resolvers disagreed about who to drop privileges to: library_hider._resolve_desktop_user() read STEAM_ENFORCER_DESKTOP_USER game_install._get_real_user() read only SUDO_USER or USER systemd sets neither of the latter, so _get_real_user() returned None under the service and every `geteuid() == 0 and real_user and ...` guard fell through to running as root. Steam answered with a zenity modal ("Cannot run as root user", /usr/lib/steam/steam:261) on screen. Confirmed from the live process tree: root `bash /usr/lib/steam/steam -cef-disable-gpu ... steam://install/618510` with a root zenity child. It never reached the journal, because that text goes to zenity and _run_as_user sends child output to DEVNULL. - _desktop_env: add resolve_desktop_user/desktop_uid/desktop_user_cmd. Only the argv builder is shared, never the spawn call: tests/_no_subprocess.py patches subprocess per module by name, so a spawn site in an unpatched module could fire a real `sudo -u kuhy steam`. - game_install._get_real_user: delegate to the shared resolver. This alone also fixes the root `steam -silent` in _ensure_steam_running and the no-op os.chown on new appmanifests. - _trigger_steam_install / enforcer.send_notification: drop privileges. send_notification had no DBUS_SESSION_BUS_ADDRESS, so it silently reached nobody for all six of its callers. - _run_as_user: fail closed. Running unchanged as root when no desktop user resolves is what put the modal on screen; refuse and log instead. Also stop the retry storm behind it. steamapps does not exist (Steam has never completed sign-in), so is_game_installed() was always False and the loop re-triggered every allowed game every pass: 1656 attempts in 30 minutes, service RSS 1.5 GB (peak 4.3 GB), a FileNotFoundError traceback each time. Guard install_game and _reinstall_missing_allowed on steam_library_ready() -- a missing library means no install can succeed by any route, so this is a correctness check rather than a tuned retry limit. The module splits here are forced by the pre-commit 250-line gate, which blocks any commit touching an over-cap file: game_install, library_hider and _enforce_loop were already over before this change. They are split by responsibility (_cdp transport, _steam_launch lifecycle, _steam_process spawning, _steam_errors, _steam_client, _game_names, game_uninstall, _enforce_steps, _owned_apps_cache, _echo, _protected_apps). game_install and library_hider re-export their old public names, so the 15 modules that import from them are untouched by this commit. Verified as real root under the unit's environment: argv is now `sudo -u kuhy env DISPLAY=:0 ... xdg-open steam://install/...` for both the installer and notify-send; three enforce passes spawn no process and log once; _run_as_user refuses with no desktop user. After restart: 0 retries, 0 tracebacks, 0 root-owned files under ~/.local/share/Steam, RSS 342 MB. 1311 tests pass. _desktop_env and _steam_state at 100% branch coverage. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016A1EYiv7e7HGhET84oa9M3	2026-08-24 13:55:44 +02:00