fix: grant Xwayland cap_ipc_owner for cross-user MIT-SHM

[LFRon]

该PR修复了: Xwayland运行的QQ音乐白屏和微信最新版4.1.13.3只能显示第一帧, 之后完全卡住的问题
且该PR需要treeland侧的更改: linuxdeepin/treeland#1320

这个PR的实现撤掉了NoNewPrivileges和PrivateIPC, 具有一定风险, 仅作为一个参考实现

XWayland runs as the display-manager user (e.g. "dde") while desktop X11 clients (especially Electron/Chromium apps) may be launched by the real login user. MIT-SHM (XShmPutImage) fails with BadAccess when the SysV shared memory segment UID differs from the X server UID — the kernel's ipcperms() denies shmat() for a 0600 segment owned by another user.

Grant cap_ipc_owner to the Xwayland binary so it can attach segments created by any user on the machine. The X server still enforces its own per-client access check (Xext/shm.c:shm_access, which verifies the client owns the segment).

Three layers ensure the capability is always present:

• Install-time (debian/ddm.postinst): applies cap_ipc_owner=ep to the Xwayland binary via setcap, so the first boot after installation already has the fix.

• Runtime (DaemonApp.cpp::applyXwaylandIpcCapability): re-applies the capability at every ddm startup, self-healing after Xwayland package upgrades that may clear the file capability.

• Cleanup (debian/ddm.postrm): removes the capability on remove/purge via setcap -r.

Depends on libcap2-bin (provides setcap).

Pair this with the treeland.service unit changes that disable NoNewPrivileges and PrivateIPC (which would otherwise block the capability or hide the segment via IPC namespace isolation).

Summary by Sourcery

Enable Xwayland to access cross-user SysV shared-memory segments and restore reliable rendering for desktop X11 clients.

Bug Fixes:

• Fix cross-user MIT-SHM rendering failures in Xwayland that cause Electron-based applications such as QQ Music and WeChat to display incorrectly or freeze.

Enhancements:

• Grant Xwayland cap_ipc_owner during installation and daemon startup, with cleanup during package removal, so the capability remains effective across upgrades and restarts.

Build:

• Add libcap2-bin as a package dependency for managing Xwayland file capabilities.

[sourcery-ai]

Sorry @LFRon, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: LFRon

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[deepin-ci-robot]

Hi @LFRon. Thanks for your PR. 😃

[deepin-ci-robot]

Hi @LFRon. Thanks for your PR.

I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sourcery-ai]

Reviewer's Guide

Ensure Xwayland always has cap_ipc_owner so MIT-SHM works across users by granting the capability at install time, re-applying it at daemon startup, and cleaning it up on removal, plus adding the necessary package dependency and a runtime helper in DaemonApp.

Sequence diagram for Xwayland IPC capability lifecycle

sequenceDiagram
    participant Package as DebianPackage
    participant DDM as DaemonApp
    participant Setcap as setcap
    participant Xwayland
    participant Client as X11Client
    participant Kernel

    Package->>Setcap: setcap cap_ipc_owner=ep Xwayland
    Setcap-->>Xwayland: File capability applied

    DDM->>DDM: applyXwaylandIpcCapability()
    DDM->>Setcap: QProcess::execute(cap_ipc_owner=ep, Xwayland)
    Setcap-->>Xwayland: Capability re-applied

    Client->>Xwayland: XShmPutImage
    Xwayland->>Kernel: shmat(shared memory)
    Kernel-->>Xwayland: Attach allowed by cap_ipc_owner
    Xwayland-->>Client: Image displayed

    Package->>Setcap: setcap -r Xwayland
    Setcap-->>Xwayland: File capability removed

Loading

File-Level Changes

Change	Details	Files
Add runtime helper in the daemon to grant cap_ipc_owner to the Xwayland binary on each startup using setcap if available.	Introduce applyXwaylandIpcCapability() that locates Xwayland and setcap via QStandardPaths and fallback paths. Check for setcap presence and log a warning if missing instead of failing hard. Execute setcap cap_ipc_owner=ep on the first existing, executable Xwayland candidate and log success or failure. Invoke applyXwaylandIpcCapability() during DaemonApp startup before initializing the seat manager. Add new Qt includes needed for file, process, and standard paths handling.	src/daemon/DaemonApp.cpp
Wire capability management into Debian packaging lifecycle so Xwayland has cap_ipc_owner after install and loses it on removal, and ensure setcap is available via a new dependency.	Declare a dependency on libcap2-bin (which provides setcap) in the Debian control file for the daemon/display-manager package. In postinst, run setcap cap_ipc_owner=ep on the Xwayland binary to grant the capability at install/upgrade time. In postrm, run setcap -r on the Xwayland binary to remove the capability on package remove/purge, cleaning up system state.	debian/control debian/ddm.postinst debian/ddm.postrm

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.