dinit-interchange; Secure, Polkit-free service control over D-Bus

[Timh1970]

I wanted to share a project I've been working on called dinit-interchange. It acts as a lightweight, secure bridge between dinit and D-Bus, designed specifically with Artix Linux setups in mind. 

🚀 Why build it?

In a desktop or application server environment, unprivileged users or applications often need to manage specific system/user services. Normally, you would have to grant broad, risky administrative rights via sudo, write un-auditable SUID wrappers, or deploy the massive, complex framework that is Polkit. 

Upstream dinit strictly protects its control pipe socket against non-root users. dinit-interchange solves this by acting as a minimal, audit-friendly gateway that handles secure privilege delegation using lightweight JSON configuration rules on a per-service basis. 

✨ Key Features

• Granular JSON Policies: Grant per-user or per-group permissions (start, stop, restart, reload, status) matching exact service filenames.
• Kernel-Level Identity Verification: Uses native kernel socket tracking to prevent UID spoofing.
• "Fail-Default" Logic: Built from the ground up to be safe and secure.
• Asynchronous Threaded Validation (ServiceSettled): Includes a dedicated mechanism to solve edge cases where a initialization script briefly returns a false-positive "running" state while performing display or environment probes.

📁 Granular Rule Example

To let an unprivileged user or web process like www-data manage xvfb without sudo elevations, you simply drop this into /etc/dinit-interchange/rules.d/xvfb.policy: 

{
  "users": {
    "www-data": [
      "start",
      "status"
    ]
  }
}

💡 The Real-World "Accidental" Use Case

This project was born out of a practical necessity on an application server deploying the HTML-to-PDF library wkgtk-html2pdf. The restricted web server user (www-data) needed to conditionally verify and launch a virtual frame buffer (Xvfb) so WebKitGTK wouldn't crash. dinit-interchange allows this automated pipeline to safely boot its own dependencies without introducing Remote Code Execution (RCE) root-escalation vulnerabilities to the host. The practical implementation is here https://github.com/Timh1970/wkgtk-html2pdf/blob/main/src/wk2gtkpdf/ichtmltopdf_int.cpp

🛠️ Check it Out

The project depends on libdinitctl and includes a built-in C++/GDBus reference utility tool called dinit-taxi to easily test IPC queries from the command line. 

• AUR Packages Available: dinit-interchange & libdinitctl
• Source Code: (https://github.com/Timh1970/dinit-interchange)
• Documentation: https://github.com/Timh1970/dinit-interchange/raw/master/documentation/user-manual/dinit-interchange-manual.pdf

I would love to hear your thoughts, feedback, or any edge cases you run into!