Commit 9742df15 authored by Tor Hedin Brønner's avatar Tor Hedin Brønner
Browse files

gnome3.mutter: drop inheritable cap_sys_nice 

In NixOS extra capabilities are provided through the ambient set which provides
real inheritability to user run processes [0].

We don't want gome-shell to spawn processes with cap_sys_nice however (apart
from the obvious this also breaks eg. flatpaks). So we drop inheritable when
starting to prevent further inheritance (the ambient set is only propagated
if inherit is set).

[0] https://github.com/torvalds/linux/commit/58319057b7847667f0c9585b9de0e8932b0fdb08
parent c8036d10

pkgs/desktops/gnome-3/core/mutter/default.nix

+5 −0
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
, wrapGAppsHook

, sysprof

, desktop-file-utils

, libcap_ng

}:



stdenv.mkDerivation rec {
@@ -31,6 +32,7 @@ stdenv.mkDerivation rec { 
    # required for pkgconfig to detect mutter-clutter

    libXtst

    json-glib

    libcap_ng

  ];



  nativeBuildInputs = [
@@ -55,6 +57,9 @@ stdenv.mkDerivation rec { 
  ];



  patches = [

    # Drop inheritable cap_sys_nice, to prevent the ambient set from leaking

    # from mutter/gnome-shell, see https://github.com/NixOS/nixpkgs/issues/71381

    ./drop-inheritable.patch

   # TODO: submit upstream

   ./0001-build-use-get_pkgconfig_variable-for-sysprof-dbusdir.patch

    (substituteAll {

pkgs/desktops/gnome-3/core/mutter/drop-inheritable.patch

0 → 100644
+132 −0
Original line number Diff line number Diff line 
From e9c772e265b2293af031c79f4bbc99b5847dfe3c Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= <torhedinbronner@gmail.com>

Date: Sat, 19 Oct 2019 13:26:05 +0200

Subject: [PATCH] drop inheritable



Adapted from https://gitlab.gnome.org/GNOME/mutter/commit/c53c47ae123b03cc66044d2b846342123ecb3a01



We only want to drop inheritable though, to prevent the ambient set leaking further than gnome-shell.



---

 config.h.meson    |  3 +++

 meson.build       |  5 +++++

 meson_options.txt |  6 ++++++

 src/core/main.c   | 11 +++++++++++

 src/meson.build   |  1 +

 5 files changed, 26 insertions(+)



diff --git a/config.h.meson b/config.h.meson

index 0bab71848..202fb7ed1 100644

--- a/config.h.meson

+++ b/config.h.meson

@@ -58,6 +58,9 @@

 /* Xwayland applications allowed to issue keyboard grabs */

 #mesondefine XWAYLAND_GRAB_DEFAULT_ACCESS_RULES

 

+/* Defined if libcap-ng is available */

+#mesondefine HAVE_LIBCAPNG

+

 /* XKB base prefix */

 #mesondefine XKB_BASE

 

diff --git a/meson.build b/meson.build

index 3322bd3b1..01c8020fa 100644

--- a/meson.build

+++ b/meson.build

@@ -35,6 +35,7 @@ libstartup_notification_req = '>= 0.7'

 libcanberra_req = '>= 0.26'

 libwacom_req = '>= 0.13'

 atk_req = '>= 2.5.3'

+libcapng_req = '>= 0.7.9'

 

 # optional version requirements

 udev_req = '>= 228'

@@ -125,6 +126,7 @@ xau_dep = dependency('xau')

 ice_dep = dependency('ice')

 atk_dep = dependency('atk', version: atk_req)

 libcanberra_dep = dependency('libcanberra', version: libcanberra_req)

+libcapng_dep = dependency('libcap-ng', required: get_option('libcapng'))

 

 # For now always require X11 support

 have_x11 = true

@@ -256,6 +258,7 @@ have_core_tests = false

 have_cogl_tests = false

 have_clutter_tests = false

 have_installed_tests = false

+have_libcapng = libcapng_dep.found()

 

 if have_tests

   have_core_tests = get_option('core_tests')

@@ -361,6 +364,7 @@ cdata.set('HAVE_LIBWACOM', have_libwacom)

 cdata.set('HAVE_SM', have_sm)

 cdata.set('HAVE_STARTUP_NOTIFICATION', have_startup_notification)

 cdata.set('HAVE_INTROSPECTION', have_introspection)

+cdata.set('HAVE_LIBCAPNG', have_libcapng)

 cdata.set('HAVE_PROFILER', have_profiler)

 

 xkb_base = xkeyboard_config_dep.get_pkgconfig_variable('xkb_base')

@@ -443,6 +447,7 @@ output = [

   '        Startup notification..... ' + have_startup_notification.to_string(),

   '        Introspection............ ' + have_introspection.to_string(),

   '        Profiler................. ' + have_profiler.to_string(),

+  '        libcap-ng................ ' + have_libcapng.to_string(),

   '',

   '    Tests:',

   '',

diff --git a/meson_options.txt b/meson_options.txt

index 73aa7adde..8bfaacd9a 100644

--- a/meson_options.txt

+++ b/meson_options.txt

@@ -152,3 +152,9 @@ option('xwayland_grab_default_access_rules',

   value: 'gnome-boxes,remote-viewer,virt-viewer,virt-manager,vinagre,vncviewer,Xephyr',

   description: 'Comma delimited list of applications ressources or class allowed to issue X11 grabs in Xwayland'

 )

+

+option('libcapng',

+  type: 'feature',

+  value: 'auto',

+  description: 'Enable libcap-ng support'

+)

diff --git a/src/core/main.c b/src/core/main.c

index 7f4f666d2..b27968f13 100644

--- a/src/core/main.c

+++ b/src/core/main.c

@@ -66,6 +66,10 @@

 #include <girepository.h>

 #endif

 

+#ifdef HAVE_LIBCAPNG

+#include <cap-ng.h>

+#endif

+

 #if defined(HAVE_NATIVE_BACKEND) && defined(HAVE_WAYLAND)

 #include <systemd/sd-login.h>

 #endif /* HAVE_WAYLAND && HAVE_NATIVE_BACKEND */

@@ -673,6 +677,12 @@ meta_run (void)

   if (!meta_display_open ())

     meta_exit (META_EXIT_ERROR);

 

+#ifdef HAVE_LIBCAPNG

+  capng_clear(CAPNG_SELECT_BOTH);

+  capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_NICE);

+  capng_apply(CAPNG_SELECT_BOTH);

+#endif

+

   g_main_loop_run (meta_main_loop);

 

   meta_finalize ();

diff --git a/src/meson.build b/src/meson.build

index 90d80734f..a9fffa2c2 100644

--- a/src/meson.build

+++ b/src/meson.build

@@ -18,6 +18,7 @@ mutter_pkg_deps = [

   glib_dep,

   gsettings_desktop_schemas_dep,

   gtk3_dep,

+  libcapng_dep,

   pango_dep,

 ]

 

-- 

2.23.0