fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC - #1320
fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC#1320LFRon wants to merge 1 commit into
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR fixes cross-UID MIT-SHM/XShmPutImage issues in Xwayland (affecting apps like QQ Music and WeChat) by relaxing specific systemd hardening options in treeland’s service unit so Xwayland can use cap_ipc_owner and access host IPC namespaces, while keeping other hardening in place. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Hi @LFRon. Thanks for your PR. I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
449072e to
2bda1ee
Compare
|
TAG Bot New tag: 0.9.1 |
|
修复qq音乐白屏 |
收到,我改一下 |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: LFRon The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1 similar comment
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: LFRon The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
…C_OWNER XWayland spawned by treeland's wlroots needs to attach to SysV shared-memory segments (MIT-SHM / XShmPutImage) created by X11 clients. In a DDM-owned session, Xwayland runs as user "dde" while desktop applications (notably Electron/Chromium apps) may be launched by the real login user. Set AmbientCapabilities=CAP_IPC_OWNER in treeland.service so systemd grants the capability directly into the process credentials (permitted, inheritable and ambient sets); the ambient set survives fork+exec of non-privileged binaries and enters their effective set, so Xwayland can shmat() segments created by a different UID (see Xext/shm.c:ProcShmAttach). NoNewPrivileges=true is kept enabled: it only makes the kernel ignore privileged grants coming from the executable itself (setuid/file caps), it does not clear ambient capabilities injected by systemd. Set PrivateIPC=false explicitly: the private IPC namespace hides SysV shm segments created by clients in the host namespace, making shmat() fail with EINVAL; Xwayland must share the host IPC namespace with its X11 clients.
|
我改好了 |
4 participants
该PR修复了: Xwayland运行的QQ音乐白屏和微信最新版4.1.13.3只能显示第一帧, 之后完全卡住的问题
且该PR需要ddm侧的更改: linuxdeepin/ddm#107
这个PR的实现撤掉了NoNewPrivileges和PrivateIPC, 具有一定风险, 仅作为一个参考实现
XWayland spawned by treeland's wlroots needs to attach to SysV shared-memory
segments (MIT-SHM / XShmPutImage) created by X11 clients. In a DDM-owned
session, Xwayland runs as user "dde" while desktop applications (notably
Electron/Chromium apps) may be launched by the real login user. Two systemd
service hardening options were blocking this:
NoNewPrivileges=true
Xwayland requires the cap_ipc_owner file capability on its binary to
shmat() segments created by a different UID. no_new_privs makes the
kernel ignore file capabilities entirely at execve(), so the capability
is never granted and shmat() fails with EACCES.
PrivateIPC=true
Creates a private IPC namespace for treeland and its children. SysV
shm segments created by clients in the host namespace are invisible to
Xwayland; shmat() returns EINVAL because the segment does not exist in
the private namespace.
Both options are now commented out with detailed explanations. Other security
hardening (ProtectSystem, ProtectHome, ProtectClock, RestrictSUIDSGID, etc.)
is kept intact.
The cap_ipc_owner capability is applied to /usr/bin/Xwayland by ddm at
startup (see ddm's DaemonApp::applyXwaylandIpcCapability).
See also: Xext/shm.c:ProcShmAttach (shmat + shm_access logic).
Summary by Sourcery
Enable cross-user MIT-SHM support in Treeland's Xwayland service so applications can render correctly across the DDM-managed session.
Bug Fixes:
Enhancements: