fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC - #1320
Open
LFRon wants to merge 1 commit into
Open
fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC#1320LFRon wants to merge 1 commit into
LFRon wants to merge 1 commit into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: LFRon The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideThis PR fixes cross-UID MIT-SHM/XShmPutImage issues in Xwayland (affecting apps like QQ Music and WeChat) by relaxing specific systemd hardening options in treeland’s service unit so Xwayland can use cap_ipc_owner and access host IPC namespaces, while keeping other hardening in place. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Hi @LFRon. Thanks for your PR. I'm waiting for a linuxdeepin member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
…d PrivateIPC
XWayland spawned by treeland's wlroots needs to attach to SysV shared-memory
segments (MIT-SHM / XShmPutImage) created by X11 clients. In a DDM-owned
session, Xwayland runs as user "dde" while desktop applications (notably
Electron/Chromium apps) may be launched by the real login user. Two systemd
service hardening options were blocking this:
1. NoNewPrivileges=true
Xwayland requires the cap_ipc_owner file capability on its binary to
shmat() segments created by a different UID. no_new_privs makes the
kernel ignore file capabilities entirely at execve(), so the capability
is never granted and shmat() fails with EACCES.
2. PrivateIPC=true
Creates a private IPC namespace for treeland and its children. SysV
shm segments created by clients in the host namespace are invisible to
Xwayland; shmat() returns EINVAL because the segment does not exist in
the private namespace.
Both options are now commented out with detailed explanations. Other security
hardening (ProtectSystem, ProtectHome, ProtectClock, RestrictSUIDSGID, etc.)
is kept intact.
The cap_ipc_owner capability is applied to /usr/bin/Xwayland by ddm at
startup (see ddm's DaemonApp::applyXwaylandIpcCapability).
See also: Xext/shm.c:ProcShmAttach (shmat + shm_access logic).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
该PR修复了: Xwayland运行的QQ音乐白屏和微信最新版4.1.13.3只能显示第一帧, 之后完全卡住的问题
且该PR需要ddm侧的更改: linuxdeepin/ddm#107
这个PR的实现撤掉了NoNewPrivileges和PrivateIPC, 具有一定风险, 仅作为一个参考实现
XWayland spawned by treeland's wlroots needs to attach to SysV shared-memory
segments (MIT-SHM / XShmPutImage) created by X11 clients. In a DDM-owned
session, Xwayland runs as user "dde" while desktop applications (notably
Electron/Chromium apps) may be launched by the real login user. Two systemd
service hardening options were blocking this:
NoNewPrivileges=true
Xwayland requires the cap_ipc_owner file capability on its binary to
shmat() segments created by a different UID. no_new_privs makes the
kernel ignore file capabilities entirely at execve(), so the capability
is never granted and shmat() fails with EACCES.
PrivateIPC=true
Creates a private IPC namespace for treeland and its children. SysV
shm segments created by clients in the host namespace are invisible to
Xwayland; shmat() returns EINVAL because the segment does not exist in
the private namespace.
Both options are now commented out with detailed explanations. Other security
hardening (ProtectSystem, ProtectHome, ProtectClock, RestrictSUIDSGID, etc.)
is kept intact.
The cap_ipc_owner capability is applied to /usr/bin/Xwayland by ddm at
startup (see ddm's DaemonApp::applyXwaylandIpcCapability).
See also: Xext/shm.c:ProcShmAttach (shmat + shm_access logic).
Summary by Sourcery
Enable cross-UID Xwayland shared-memory access by relaxing the service restrictions that prevent MIT-SHM clients from attaching their shared-memory segments.
Bug Fixes:
Enhancements:
Summary by Sourcery
Allow Xwayland to access shared memory created by applications running under a different UID.
Bug Fixes:
Enhancements: