main: Warn when unsafe mode is toggled

MetaContext:unsafe-mode was added as a debugging tool to temporarily
remove restrictions on privileged APIs. But as it turns out, there
are now extensions that toggle the property permanently. Right now
none of them are malicious (as far as I can see), but it's still a
bad idea and should be discouraged.

Do this with a notification that warns the user when unsafe mode is
enabled non-interactively (i.e. via looking glass), and hopefully
also clarifies what the weird lock icon in the top bar is about.

https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/4798

Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2050>

diff --git a/js/ui/main.js b/js/ui/main.js
index c7bac11f25f8e6e43347e99d5543ee6f9b219598..ab97c6cc371dcd7ba41c50a92fdae59ea2c1dc0e 100644 (file)
--- a/js/ui/main.js
+++ b/js/ui/main.js
@@ -247,6 +247,23 @@ function _initializeUI() {
 
     global.display.connect('gl-video-memory-purged', loadTheme);
 
+    global.context.connect('notify::unsafe-mode', () => {
+        if (!global.context.unsafe_mode)
+            return; // we're safe
+        if (lookingGlass?.isOpen)
+            return; // assume user action
+
+        const source = new MessageTray.SystemNotificationSource();
+        messageTray.add(source);
+        const notification = new MessageTray.Notification(source,
+            _('System was put in unsafe mode'),
+            _('Applications now have unrestricted access'));
+        notification.addAction(_('Undo'),
+            () => (global.context.unsafe_mode = false));
+        notification.setTransient(true);
+        source.showNotification(notification);
+    });
+
     // Provide the bus object for gnome-session to
     // initiate logouts.
     EndSessionDialog.init();