mirrors/sway
1
0
Fork 0
mirror of https://github.com/swaywm/sway.git synced 2024-11-26 18:01:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Perform (partial) server initialization before dropping privileges.

Browse source 
Some operations during backend creation (e.g. becoming DRM master)
require CAP_SYS_ADMIN privileges. At this point, sway has dropped them
already, though. This patch splits the privileged part of server_init
into its own function and calls it before dropping its privileges.
This fixes the bug with minimal security implications.
This commit is contained in:
Tobias Blass 2018-06-13 00:39:24 +02:00
parent 202ee51150
commit a5c091e302
3 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/sway/server.h
View file

@ -47,6 +47,8 @@ struct sway_server {
struct sway_server server; struct sway_server server;
/* Prepares an unprivileged server_init by performing all privileged operations in advance */
bool server_privileged_prepare(struct sway_server *server);
bool server_init(struct sway_server *server); bool server_init(struct sway_server *server);
void server_fini(struct sway_server *server); void server_fini(struct sway_server *server);
void server_run(struct sway_server *server); void server_run(struct sway_server *server);

5
sway/main.c
View file

@ -359,6 +359,11 @@ int main(int argc, char **argv) {
executable_sanity_check(); executable_sanity_check();
bool suid = false; bool suid = false;
if (!server_privileged_prepare(&server)) {
return 1;
}
#ifdef __linux__ #ifdef __linux__
if (getuid() != geteuid() || getgid() != getegid()) { if (getuid() != geteuid() || getgid() != getegid()) {
// Retain capabilities after setuid() // Retain capabilities after setuid()

11
sway/server.c
View file

@ -25,9 +25,8 @@
#include "sway/tree/layout.h" #include "sway/tree/layout.h"
bool server_init(struct sway_server *server) { bool server_privileged_prepare(struct sway_server *server) {
wlr_log(L_DEBUG, "Initializing Wayland server"); wlr_log(L_DEBUG, "Preparing Wayland server initialization");
server->wl_display = wl_display_create(); server->wl_display = wl_display_create();
server->wl_event_loop = wl_display_get_event_loop(server->wl_display); server->wl_event_loop = wl_display_get_event_loop(server->wl_display);
server->backend = wlr_backend_autocreate(server->wl_display, NULL); server->backend = wlr_backend_autocreate(server->wl_display, NULL);
@ -36,6 +35,12 @@ bool server_init(struct sway_server *server) {
wlr_log(L_ERROR, "Unable to create backend"); wlr_log(L_ERROR, "Unable to create backend");
return false; return false;
} }
return true;
}
bool server_init(struct sway_server *server) {
wlr_log(L_DEBUG, "Initializing Wayland server");
struct wlr_renderer *renderer = wlr_backend_get_renderer(server->backend); struct wlr_renderer *renderer = wlr_backend_get_renderer(server->backend);
assert(renderer); assert(renderer);