[mutter/wip/carlosg/rt-scheduler: 1/2] core: Drop all capabilities before running the main loop
- From: Carlos Garnacho <carlosg src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [mutter/wip/carlosg/rt-scheduler: 1/2] core: Drop all capabilities before running the main loop
- Date: Wed, 27 Feb 2019 18:10:24 +0000 (UTC)
commit a055b01216c5a3a7015024956824be9641654933
Author: Carlos Garnacho <carlosg gnome org>
Date: Wed Feb 27 18:58:52 2019 +0100
core: Drop all capabilities before running the main loop
Add an optional dependency on libcap-ng, if the library is detected
drop all capabilities by default, in order to allow packagers/users
to do "setcap CAP_SYS_NICE=+ep `which gnome-shell`" and let it set
higher priorities it wouldn't be allowed to.
Examples are: EGL_IMG_context_priority, SCHED_RR.
config.h.meson | 3 +++
meson.build | 5 +++++
meson_options.txt | 6 ++++++
src/core/main.c | 9 +++++++++
src/meson.build | 1 +
5 files changed, 24 insertions(+)
---
diff --git a/config.h.meson b/config.h.meson
index 70681d774..ee301752c 100644
--- a/config.h.meson
+++ b/config.h.meson
@@ -60,3 +60,6 @@
/* Default rules for allowing Xwayland grabs */
#mesondefine XWAYLAND_GRAB_DEFAULT_ACCESS_RULES
+
+/* Defined if libcap-ng is available */
+#mesondefine HAVE_LIBCAPNG
diff --git a/meson.build b/meson.build
index 7de4eba55..d42611a66 100644
--- a/meson.build
+++ b/meson.build
@@ -29,6 +29,7 @@ libstartup_notification_req = '>= 0.7'
libcanberra_req = '>= 0.26'
libwacom_req = '>= 0.13'
atk_req = '>= 2.5.3'
+libcapng_req = '>= 0.7.9'
# optional version requirements
udev_req = '>= 228'
@@ -120,6 +121,7 @@ xinerama_dep = dependency('xinerama')
ice_dep = dependency('ice')
atk_dep = dependency('atk', version: atk_req)
libcanberra_dep = dependency('libcanberra', version: libcanberra_req)
+libcapng_dep = dependency('libcap-ng', required: get_option('libcap'))
# For now always require X11 support
have_x11 = true
@@ -249,6 +251,7 @@ endif
have_cogl_tests = get_option('cogl_tests')
have_clutter_tests = get_option('clutter_tests')
have_installed_tests = get_option('installed_tests')
+have_libcap = libcapng_dep.found()
have_tests = get_option('tests')
if have_tests
@@ -336,6 +339,7 @@ cdata.set('HAVE_LIBWACOM', have_libwacom)
cdata.set('HAVE_SM', have_sm)
cdata.set('HAVE_STARTUP_NOTIFICATION', have_startup_notification)
cdata.set('HAVE_INTROSPECTION', have_introspection)
+cdata.set('HAVE_LIBCAPNG', have_libcap)
xkb_base = xkeyboard_config_dep.get_pkgconfig_variable('xkb_base')
cdata.set_quoted('XKB_BASE', xkb_base)
@@ -401,6 +405,7 @@ output = [
' SM....................... ' + have_sm.to_string(),
' Startup notification..... ' + have_startup_notification.to_string(),
' Introspection............ ' + have_introspection.to_string(),
+ ' libcap................... ' + have_libcap.to_string(),
'',
' Tests:',
'',
diff --git a/meson_options.txt b/meson_options.txt
index add49c866..9f58feba6 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -140,3 +140,9 @@ option('xwayland_grab_default_access_rules',
value: 'gnome-boxes,remote-viewer,virt-viewer,virt-manager,vinagre,vncviewer,Xephyr',
description: 'Comma delimited list of applications ressources or class allowed to issue X11 grabs in
Xwayland'
)
+
+option('libcap',
+ type: 'feature',
+ value: 'auto',
+ description: 'Enable libcap support'
+)
diff --git a/src/core/main.c b/src/core/main.c
index e8464720f..898f49f47 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -66,6 +66,10 @@
#include <girepository.h>
#endif
+#ifdef HAVE_LIBCAPNG
+#include <cap-ng.h>
+#endif
+
#if defined(HAVE_NATIVE_BACKEND) && defined(HAVE_WAYLAND)
#include <systemd/sd-login.h>
#endif /* HAVE_WAYLAND && HAVE_NATIVE_BACKEND */
@@ -680,6 +684,11 @@ meta_run (void)
if (!meta_display_open ())
meta_exit (META_EXIT_ERROR);
+#ifdef HAVE_LIBCAPNG
+ capng_clear (CAPNG_SELECT_BOTH);
+ capng_apply (CAPNG_SELECT_BOTH);
+#endif
+
g_main_loop_run (meta_main_loop);
meta_finalize ();
diff --git a/src/meson.build b/src/meson.build
index 8779c956e..75cfc22a6 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -18,6 +18,7 @@ mutter_pkg_deps = [
gsettings_desktop_schemas_dep,
gtk3_dep,
pango_dep,
+ libcapng_dep,
]
mutter_pkg_private_deps = [
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]