Skip to content

fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC #1320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LFRon wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(xwayland): allow cross-UID MIT-SHM by removing NoNewPrivileges and PrivateIPC #1320

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 21 additions & 2 deletions misc/systemd/treeland.service.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,17 @@ RestartSec=1s
StandardOutput=null
StandardError=null

NoNewPrivileges=true
# NOTE: NoNewPrivileges=true is intentionally NOT enabled here.
#
# wlroots spawns Xwayland inside treeland, and Xwayland needs to attach to
# SysV shared-memory segments (MIT-SHM / XShmPutImage) created by X11
# clients that run under a different UID than the Xwayland process itself
# (e.g. Electron apps launched by the real login user against the
# DDM-owned session). This requires the cap_ipc_owner file capability on
# the Xwayland binary (applied by ddm at startup), but no_new_privs makes
# the kernel ignore file capabilities entirely at execve(), leaving such
# windows blank (XShmAttach → BadAccess). See Xext/shm.c:ProcShmAttach.
# NoNewPrivileges=true
OOMScoreAdjust=-1000
Nice=-20
CPUWeight=10000
Expand All @@ -51,7 +61,16 @@ IOSchedulingPriority=0
#
# MemoryDenyWriteExecute=true

PrivateIPC=true
# NOTE: PrivateIPC=true is intentionally NOT enabled here.
#
# Xwayland (spawned by wlroots inside treeland, IPC-namespace isolated when
# PrivateIPC=true) must share the host IPC namespace with X11 clients so that
# MIT-SHM (XShmAttach → shmat) can find the SysV shared-memory segments the
# clients create via shmget(). Otherwise shmat() fails with EINVAL (segment
# invisible in the private namespace) and every XShmPutImage window renders
# blank. Combined with the cap_ipc_owner setup above, Xwayland can both find
# and attach cross-UID client segments. See Xext/shm.c:ProcShmAttach.
# PrivateIPC=true
ProtectSystem=full
ProtectHome=true
ProtectClock=true
Expand Down
Loading