firewalld D-Bus setter mis-authorization allows local firewall state changes

#!/usr/bin/env bash
# check-cve-2026-4948.sh
# Detects likely exploitable state for CVE-2026-4948.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

status="UNKNOWN"
reason=""

find_firewalld_py() {
  local candidates=(
    /usr/lib*/python*/site-packages/firewall/server/firewalld.py
    /usr/lib*/python*/dist-packages/firewall/server/firewalld.py
    /usr/lib/firewalld/firewalld.py
  )
  local f
  for pattern in "${candidates[@]}"; do
    for f in $pattern; do
      [ -f "$f" ] && { echo "$f"; return 0; }
    done
  done
  return 1
}

has_vuln_decorator() {
  local file="$1"
  python3 - "$file" <<'PY'
import sys
path = sys.argv[1]
with open(path, 'r', encoding='utf-8', errors='ignore') as fh:
    lines = fh.readlines()

def prev_nonempty(idx):
    j = idx - 1
    while j >= 0:
      s = lines[j].strip()
      if s:
        return s
      j -= 1
    return ""

z = False
p = False
for i, line in enumerate(lines):
    s = line.strip()
    if s.startswith('def setZoneSettings2('):
        z = 'PK_ACTION_CONFIG_INFO' in prev_nonempty(i)
    if s.startswith('def setPolicySettings('):
        p = 'PK_ACTION_CONFIG_INFO' in prev_nonempty(i)

if z and p:
    print('VULN')
    sys.exit(0)
else:
    print('PATCHED_OR_UNKNOWN')
    sys.exit(1)
PY
}

has_desktop_policy() {
  local dir file
  for dir in /usr/share/polkit-1/actions /etc/polkit-1/actions; do
    [ -d "$dir" ] || continue
    while IFS= read -r -d '' file; do
      if grep -q 'org.fedoraproject.FirewallD1.config.info' "$file" 2>/dev/null && \
         grep -q 'org.fedoraproject.FirewallD1.policies.info' "$file" 2>/dev/null && \
         grep -q '<allow_active>yes</allow_active>' "$file" 2>/dev/null; then
        echo "$file"
        return 0
      fi
    done < <(find "$dir" -maxdepth 1 -type f -name '*FirewallD*.policy' -print0 2>/dev/null)
  done
  return 1
}

firewalld_py="$(find_firewalld_py 2>/dev/null || true)"
if [ -z "$firewalld_py" ]; then
  echo "UNKNOWN - could not locate installed firewalld Python service file"
  exit 2
fi

if has_vuln_decorator "$firewalld_py" >/dev/null 2>&1; then
  desktop_policy="$(has_desktop_policy 2>/dev/null || true)"
  if [ -n "$desktop_policy" ]; then
    echo "VULNERABLE - vulnerable setters found in $firewalld_py and desktop polkit policy present at $desktop_policy"
    exit 1
  else
    echo "UNKNOWN - vulnerable setters found in $firewalld_py but no desktop polkit policy detected; prerequisite may be absent"
    exit 2
  fi
else
  echo "PATCHED - vulnerable setter decorators not detected in $firewalld_py"
  exit 0
fi