Fix .desktop icons for tails 3.3

[emkll]

Status

Ready for review

Description of Changes

Fixes #2586.

Changes proposed in this pull request:

source.desktop and journalist.desktop are now trusted once tor finishes bootstrapping and securedrop_init.py is called by Network manager.

Workaround for issues with Nautilus per @kushaldas comments in #2586.

Testing

Needs to be tested on both new install and existing installs (upgrades)

git checkout $branch
./securedrop-admin tailsconfig

• .desktop icons should now have SecureDrop logo and should not require manually making them trusted.
• This should persist across reboots

[redshiftzero]

Works like a charm! 🎉 Couple of minor comments inline for maintainability.

[redshiftzero]

In order to avoid magic numbers, can we do something like:

import pwd, grp

amnesia_gid = grp.getgrnam("amnesia").gr_gid
os.setresgid(amnesia_gid, amnesia_gid, -1)
amensia_uid = pwd.getpwnam("amnesia").pw_uid
os.setresuid(amensia_uid, amensia_uid, -1)

[redshiftzero]

Is the str() necessary here? Seems like path_desktop and shortcut are both strings and concatenating them will also produce a string

(This comment applies to the next two lines)

[redshiftzero]

And then we can use .format to demonstrate where the 1000 is coming from:

'/run/user/{}'.format(blah)

[redshiftzero]

Same here

[emkll]

Thanks for the comments, @redshiftzero. They should now be addressed.

[redshiftzero]

Changes look great - merging for inclusion in SecureDrop 0.5.

[redshiftzero]

Staging failure:

    fatal: [app-staging]: FAILED! => {"failed": true, "msg": "The conditional check 'hostvars[groups.securedrop_monitor_server.0].ossec_agent_already_registered == false and iptables_rules_check_result.stat.exists == true' failed. The error was: error while evaluating conditional (hostvars[groups.securedrop_monitor_server.0].ossec_agent_already_registered == false and iptables_rules_check_result.stat.exists == true): 'dict object' has no attribute 'ossec_agent_already_registered'\n\nThe error appears to have been in '/root/sd/install_files/ansible-base/roles/ossec-agent/tasks/agent_config.yml': line 17, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n\n- name: Add firewall exemption for OSSEC agent registration.\n  ^ here\n"}

Restarting..

[b-meson]

Worked for me, thanks @emkll !

[emkll]

Gitter chat just make me think about this: We will have to instruct admins to checkout/verify 0.5 and run securedrop-admin tailsconfig on all journalist/admin workstations, likely required for #2591 as well (when they update to Tails 3.3).

[conorsch]

CI is passing. We've noted that we'll need to include instructions for rerun tails scripts during the release announcement. Merging.