diff options
author | Joshua Watt <JPEWhacker@gmail.com> | 2020-11-19 16:58:53 -0600 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-11-24 10:27:45 +0000 |
commit | ccdaab972e1d03087f9de0eae605008eaada7cd1 (patch) | |
tree | 6efb470a6ec6e91d88b45b641fd4d6d609a9396e /meta | |
parent | 862a6937d5d43d195a90df7e5744a8f60787f2aa (diff) | |
download | poky-ccdaab972e1d03087f9de0eae605008eaada7cd1.tar.gz |
weston-init: Stop running weston as root
Running the weston compositor as the root user is an insecure default
behavior for OE-core. We can do much better, at least when using
systemd. Change the recipe to create a dedicated "weston" user and start
weston as this user. The systemd service and socket units are no longer
template units, as there were several inconsistencies in the templates.
Instead, there is now a global /run/wayland-0 socket that gets created,
and systemd will start weston on demand when a client connects to that
socket or when attempting to reach graphical.target, whichever comes
first. This also allows downstream users to easily change the behavior
so that weston *only* starts on demand by adding a drop file. Access to
the global socket is controlled by a "wayland" group; any user that is a
member of the group can use the socket to talk to the compositor. This
also satisfies another use case where another systemd service might
start a graphical application that needs to display with weston (e.g. a
single function device in kiosk mode). Finally, the udev rules for
starting weston with the existance of a DRM device have been removed.
Being WantedBy= a graphical target should eliminate the need for this
behavior, and having it present makes it difficult for downstream users
to start weston on demand (having to override the udev rules).
(From OE-Core rev: dd83fb40f76749c6689807afabc63b9d5c2a4065)
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-graphics/wayland/weston-init.bb | 33 | ||||
-rw-r--r-- | meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules | 2 | ||||
-rw-r--r-- | meta/recipes-graphics/wayland/weston-init/weston.service (renamed from meta/recipes-graphics/wayland/weston-init/weston@.service) | 14 | ||||
-rw-r--r-- | meta/recipes-graphics/wayland/weston-init/weston.socket | 14 | ||||
-rw-r--r-- | meta/recipes-graphics/wayland/weston-init/weston@.socket | 10 |
5 files changed, 45 insertions, 28 deletions
diff --git a/meta/recipes-graphics/wayland/weston-init.bb b/meta/recipes-graphics/wayland/weston-init.bb index a616c473ec..65d7b81dc5 100644 --- a/meta/recipes-graphics/wayland/weston-init.bb +++ b/meta/recipes-graphics/wayland/weston-init.bb | |||
@@ -7,9 +7,8 @@ PACKAGE_ARCH = "${MACHINE_ARCH}" | |||
7 | SRC_URI = "file://init \ | 7 | SRC_URI = "file://init \ |
8 | file://weston.env \ | 8 | file://weston.env \ |
9 | file://weston.ini \ | 9 | file://weston.ini \ |
10 | file://weston@.service \ | 10 | file://weston.service \ |
11 | file://weston@.socket \ | 11 | file://weston.socket \ |
12 | file://71-weston-drm.rules \ | ||
13 | file://weston-autologin \ | 12 | file://weston-autologin \ |
14 | file://weston-start" | 13 | file://weston-start" |
15 | 14 | ||
@@ -36,17 +35,15 @@ do_install() { | |||
36 | install -Dm644 ${WORKDIR}/weston.env ${D}${sysconfdir}/default/weston | 35 | install -Dm644 ${WORKDIR}/weston.env ${D}${sysconfdir}/default/weston |
37 | 36 | ||
38 | # Install Weston systemd service and accompanying udev rule | 37 | # Install Weston systemd service and accompanying udev rule |
39 | install -D -p -m0644 ${WORKDIR}/weston@.service ${D}${systemd_system_unitdir}/weston@.service | 38 | install -D -p -m0644 ${WORKDIR}/weston.service ${D}${systemd_system_unitdir}/weston.service |
40 | install -D -p -m0644 ${WORKDIR}/weston@.socket ${D}${systemd_system_unitdir}/weston@.socket | 39 | install -D -p -m0644 ${WORKDIR}/weston.socket ${D}${systemd_system_unitdir}/weston.socket |
41 | if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then | 40 | if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then |
42 | install -D -p -m0644 ${WORKDIR}/weston-autologin ${D}${sysconfdir}/pam.d/weston-autologin | 41 | install -D -p -m0644 ${WORKDIR}/weston-autologin ${D}${sysconfdir}/pam.d/weston-autologin |
43 | fi | 42 | fi |
44 | sed -i -e s:/etc:${sysconfdir}:g \ | 43 | sed -i -e s:/etc:${sysconfdir}:g \ |
45 | -e s:/usr/bin:${bindir}:g \ | 44 | -e s:/usr/bin:${bindir}:g \ |
46 | -e s:/var:${localstatedir}:g \ | 45 | -e s:/var:${localstatedir}:g \ |
47 | ${D}${systemd_unitdir}/system/weston@.service | 46 | ${D}${systemd_unitdir}/system/weston.service |
48 | install -D -p -m0644 ${WORKDIR}/71-weston-drm.rules \ | ||
49 | ${D}${sysconfdir}/udev/rules.d/71-weston-drm.rules | ||
50 | # Install weston-start script | 47 | # Install weston-start script |
51 | install -Dm755 ${WORKDIR}/weston-start ${D}${bindir}/weston-start | 48 | install -Dm755 ${WORKDIR}/weston-start ${D}${bindir}/weston-start |
52 | sed -i 's,@DATADIR@,${datadir},g' ${D}${bindir}/weston-start | 49 | sed -i 's,@DATADIR@,${datadir},g' ${D}${bindir}/weston-start |
@@ -58,11 +55,15 @@ do_install() { | |||
58 | if [ "${@bb.utils.contains('PACKAGECONFIG', 'no-idle-timeout', 'yes', 'no', d)}" = "yes" ]; then | 55 | if [ "${@bb.utils.contains('PACKAGECONFIG', 'no-idle-timeout', 'yes', 'no', d)}" = "yes" ]; then |
59 | sed -i -e "/^\[core\]/a idle-time=0" ${D}${sysconfdir}/xdg/weston/weston.ini | 56 | sed -i -e "/^\[core\]/a idle-time=0" ${D}${sysconfdir}/xdg/weston/weston.ini |
60 | fi | 57 | fi |
58 | |||
59 | install -dm 755 -o weston -g weston ${D}/home/weston | ||
61 | } | 60 | } |
62 | 61 | ||
63 | INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}" | 62 | INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}" |
64 | 63 | ||
65 | inherit update-rc.d features_check systemd | 64 | inherit update-rc.d features_check systemd useradd |
65 | |||
66 | USERADD_PACKAGES = "${PN}" | ||
66 | 67 | ||
67 | # rdepends on weston which depends on virtual/egl | 68 | # rdepends on weston which depends on virtual/egl |
68 | # requires pam enabled if started via systemd | 69 | # requires pam enabled if started via systemd |
@@ -73,10 +74,18 @@ RDEPENDS_${PN} = "weston kbd" | |||
73 | INITSCRIPT_NAME = "weston" | 74 | INITSCRIPT_NAME = "weston" |
74 | INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ." | 75 | INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ." |
75 | 76 | ||
76 | FILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${systemd_system_unitdir}/weston@.service ${systemd_system_unitdir}/weston@.socket ${sysconfdir}/default/weston ${sysconfdir}/pam.d/" | 77 | FILES_${PN} += "\ |
78 | ${sysconfdir}/xdg/weston/weston.ini \ | ||
79 | ${systemd_system_unitdir}/weston.service \ | ||
80 | ${systemd_system_unitdir}/weston.socket \ | ||
81 | ${sysconfdir}/default/weston \ | ||
82 | ${sysconfdir}/pam.d/ \ | ||
83 | /home/weston \ | ||
84 | " | ||
77 | 85 | ||
78 | CONFFILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${sysconfdir}/default/weston" | 86 | CONFFILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${sysconfdir}/default/weston" |
79 | 87 | ||
80 | SYSTEMD_SERVICE_${PN} = "weston@%i.service" | 88 | SYSTEMD_SERVICE_${PN} = "weston.service weston.socket" |
81 | SYSTEMD_AUTO_ENABLE = "disable" | 89 | USERADD_PARAM_${PN} = "--home /home/weston --shell /bin/sh --user-group -G video,input weston" |
90 | GROUPADD_PARAM_${PN} = "-r wayland" | ||
82 | 91 | ||
diff --git a/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules b/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules deleted file mode 100644 index 1a1b8bbda4..0000000000 --- a/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules +++ /dev/null | |||
@@ -1,2 +0,0 @@ | |||
1 | ACTION=="add", SUBSYSTEM=="graphics", KERNEL=="fb0", TAG+="systemd", ENV{SYSTEMD_WANTS}+="weston@root.service" | ||
2 | ACTION=="add", SUBSYSTEM=="drm", KERNEL=="card0", TAG+="systemd", ENV{SYSTEMD_WANTS}+="weston@root.service" | ||
diff --git a/meta/recipes-graphics/wayland/weston-init/weston@.service b/meta/recipes-graphics/wayland/weston-init/weston.service index ce8f4fb71a..e09625b31c 100644 --- a/meta/recipes-graphics/wayland/weston-init/weston@.service +++ b/meta/recipes-graphics/wayland/weston-init/weston.service | |||
@@ -9,6 +9,7 @@ Documentation=man:weston(1) man:weston.ini(5) | |||
9 | Documentation=http://wayland.freedesktop.org/ | 9 | Documentation=http://wayland.freedesktop.org/ |
10 | 10 | ||
11 | # Make sure we are started after logins are permitted. | 11 | # Make sure we are started after logins are permitted. |
12 | Requires=systemd-user-sessions.service | ||
12 | After=systemd-user-sessions.service | 13 | After=systemd-user-sessions.service |
13 | 14 | ||
14 | # If Plymouth is used, we want to start when it is on its way out. | 15 | # If Plymouth is used, we want to start when it is on its way out. |
@@ -18,6 +19,9 @@ After=plymouth-quit-wait.service | |||
18 | Wants=dbus.socket | 19 | Wants=dbus.socket |
19 | After=dbus.socket | 20 | After=dbus.socket |
20 | 21 | ||
22 | # Ensure the socket is present | ||
23 | Requires=weston.socket | ||
24 | |||
21 | # Since we are part of the graphical session, make sure we are started before | 25 | # Since we are part of the graphical session, make sure we are started before |
22 | # it is complete. | 26 | # it is complete. |
23 | Before=graphical.target | 27 | Before=graphical.target |
@@ -37,10 +41,11 @@ TimeoutStartSec=60 | |||
37 | WatchdogSec=20 | 41 | WatchdogSec=20 |
38 | 42 | ||
39 | # The user to run Weston as. | 43 | # The user to run Weston as. |
40 | User=%I | 44 | User=weston |
45 | Group=weston | ||
41 | 46 | ||
42 | # Make sure working directory is users home directory | 47 | # Make sure the working directory is the users home directory |
43 | WorkingDirectory=/home/%i | 48 | WorkingDirectory=/home/weston |
44 | 49 | ||
45 | # Set up a full user session for the user, required by Weston. | 50 | # Set up a full user session for the user, required by Weston. |
46 | PAMName=weston-autologin | 51 | PAMName=weston-autologin |
@@ -61,5 +66,6 @@ UtmpIdentifier=tty7 | |||
61 | UtmpMode=user | 66 | UtmpMode=user |
62 | 67 | ||
63 | [Install] | 68 | [Install] |
69 | # Note: If you only want weston to start on-demand, remove this line with a | ||
70 | # service drop file | ||
64 | WantedBy=graphical.target | 71 | WantedBy=graphical.target |
65 | DefaultInstance=tty7 | ||
diff --git a/meta/recipes-graphics/wayland/weston-init/weston.socket b/meta/recipes-graphics/wayland/weston-init/weston.socket new file mode 100644 index 0000000000..c1bdc83c05 --- /dev/null +++ b/meta/recipes-graphics/wayland/weston-init/weston.socket | |||
@@ -0,0 +1,14 @@ | |||
1 | [Unit] | ||
2 | Description=Weston socket | ||
3 | RequiresMountsFor=/run | ||
4 | |||
5 | [Socket] | ||
6 | ListenStream=/run/wayland-0 | ||
7 | SocketMode=0775 | ||
8 | SocketUser=weston | ||
9 | SocketGroup=wayland | ||
10 | RemoveOnStop=yes | ||
11 | |||
12 | [Install] | ||
13 | WantedBy=sockets.target | ||
14 | |||
diff --git a/meta/recipes-graphics/wayland/weston-init/weston@.socket b/meta/recipes-graphics/wayland/weston-init/weston@.socket deleted file mode 100644 index f1790d74a8..0000000000 --- a/meta/recipes-graphics/wayland/weston-init/weston@.socket +++ /dev/null | |||
@@ -1,10 +0,0 @@ | |||
1 | [Unit] | ||
2 | Description=Weston Wayland socket | ||
3 | After=user-runtime-dir@1000.service | ||
4 | |||
5 | [Socket] | ||
6 | ListenStream=/run/user/1000/wayland-%I | ||
7 | |||
8 | [Install] | ||
9 | WantedBy=sockets.target | ||
10 | |||