When starting a compositor that's using the "direct" session backend,
wlroots needs to handle calls to `drmSetMaster()` and `drmDropMaster()`.
As both calls used to require `CAP_SYS_ADMIN`, wlroots thus simply
refused starting in case the process doesn't enjoy evelated privileges.
Permission rules have changed since linux.git commit 45bc3d26c95a (drm:
rework SET_MASTER and DROP_MASTER perm handling, 2020-03-19). As a
result, starting with Linux v5.8, both ioctls will now also succeed if
the process is currently or has been the DRM master. And as the first
process to open render nodes will become the DRM master automatically,
this effectively means that process elevation is not strictly required
in all setups anymore.
So let's drop the `geteuid() != 0` permission check to allow those new
rules to do their magic.
This is simply a false sense of security, and is worse than just using
setuid. CAP_SYS_ADMIN is an extremely serious capability that is
effectively as powerful as root.
It also required users to be in the input group, which allows any
process to keylog the entire system.
As evdev-proto is installed by CI some files have been missed:
../examples/pointer-constraints.c:2:10: fatal error: 'linux/input-event-codes.h' file not found
#include <linux/input-event-codes.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~
../examples/relative-pointer-unstable-v1.c:5:10: fatal error: 'linux/input-event-codes.h' file not found
#include <linux/input-event-codes.h>
^~~~~~~~~~~~~~~~~~~~~~~~~~~
This commit implements device type discovery by calling two ioctls
(DRM_IOCTL_VERSION and EVIOCGVERSION) on the device. These iocts are
specific to drm and input devices respectively, therefore we can
determine the device type based on which one returns an error.
The major device number does not indicate the device type on FreeBSD,
and AFAIK the only way to differentiate between DRM, input, and other
devices is checking the fd path. This commit implements that.
The drmDropmaster and drmSetmaster calls are necessary, because the
implicit drop (that should occur when the DRM fd is closed) seems not
to be working in some scenarios (e.g. if you have a tmux session
running - maybe the fd is retained somehow by tmux?). This is a
problem, because once you exit the compositor, you can't start it (or
any other program that wants to be DRM master) again until you close
all your tmux sessions.
recvmsg(3) returns 0 if the connection partner has shut down its socket.
The communicate function considered 0 a successful message, though, and
keeps calling recvmsg(3) again and again.
Patrick Steinhardt
Scott Anderson
Jan Beich
emersion
sghctoma
Drew DeVault
Dominique Martinet
Tobias Blass
Björn Esser
Greg V
Scott Anderson