summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
authorJoshua Watt <JPEWhacker@gmail.com>2020-11-19 16:58:53 -0600
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-11-24 10:27:45 +0000
commitccdaab972e1d03087f9de0eae605008eaada7cd1 (patch)
tree6efb470a6ec6e91d88b45b641fd4d6d609a9396e /meta
parent862a6937d5d43d195a90df7e5744a8f60787f2aa (diff)
downloadpoky-ccdaab972e1d03087f9de0eae605008eaada7cd1.tar.gz
weston-init: Stop running weston as root
Running the weston compositor as the root user is an insecure default behavior for OE-core. We can do much better, at least when using systemd. Change the recipe to create a dedicated "weston" user and start weston as this user. The systemd service and socket units are no longer template units, as there were several inconsistencies in the templates. Instead, there is now a global /run/wayland-0 socket that gets created, and systemd will start weston on demand when a client connects to that socket or when attempting to reach graphical.target, whichever comes first. This also allows downstream users to easily change the behavior so that weston *only* starts on demand by adding a drop file. Access to the global socket is controlled by a "wayland" group; any user that is a member of the group can use the socket to talk to the compositor. This also satisfies another use case where another systemd service might start a graphical application that needs to display with weston (e.g. a single function device in kiosk mode). Finally, the udev rules for starting weston with the existance of a DRM device have been removed. Being WantedBy= a graphical target should eliminate the need for this behavior, and having it present makes it difficult for downstream users to start weston on demand (having to override the udev rules). (From OE-Core rev: dd83fb40f76749c6689807afabc63b9d5c2a4065) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-graphics/wayland/weston-init.bb33
-rw-r--r--meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules2
-rw-r--r--meta/recipes-graphics/wayland/weston-init/weston.service (renamed from meta/recipes-graphics/wayland/weston-init/weston@.service)14
-rw-r--r--meta/recipes-graphics/wayland/weston-init/weston.socket14
-rw-r--r--meta/recipes-graphics/wayland/weston-init/weston@.socket10
5 files changed, 45 insertions, 28 deletions
diff --git a/meta/recipes-graphics/wayland/weston-init.bb b/meta/recipes-graphics/wayland/weston-init.bb
index a616c473ec..65d7b81dc5 100644
--- a/meta/recipes-graphics/wayland/weston-init.bb
+++ b/meta/recipes-graphics/wayland/weston-init.bb
@@ -7,9 +7,8 @@ PACKAGE_ARCH = "${MACHINE_ARCH}"
7SRC_URI = "file://init \ 7SRC_URI = "file://init \
8 file://weston.env \ 8 file://weston.env \
9 file://weston.ini \ 9 file://weston.ini \
10 file://weston@.service \ 10 file://weston.service \
11 file://weston@.socket \ 11 file://weston.socket \
12 file://71-weston-drm.rules \
13 file://weston-autologin \ 12 file://weston-autologin \
14 file://weston-start" 13 file://weston-start"
15 14
@@ -36,17 +35,15 @@ do_install() {
36 install -Dm644 ${WORKDIR}/weston.env ${D}${sysconfdir}/default/weston 35 install -Dm644 ${WORKDIR}/weston.env ${D}${sysconfdir}/default/weston
37 36
38 # Install Weston systemd service and accompanying udev rule 37 # Install Weston systemd service and accompanying udev rule
39 install -D -p -m0644 ${WORKDIR}/weston@.service ${D}${systemd_system_unitdir}/weston@.service 38 install -D -p -m0644 ${WORKDIR}/weston.service ${D}${systemd_system_unitdir}/weston.service
40 install -D -p -m0644 ${WORKDIR}/weston@.socket ${D}${systemd_system_unitdir}/weston@.socket 39 install -D -p -m0644 ${WORKDIR}/weston.socket ${D}${systemd_system_unitdir}/weston.socket
41 if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then 40 if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then
42 install -D -p -m0644 ${WORKDIR}/weston-autologin ${D}${sysconfdir}/pam.d/weston-autologin 41 install -D -p -m0644 ${WORKDIR}/weston-autologin ${D}${sysconfdir}/pam.d/weston-autologin
43 fi 42 fi
44 sed -i -e s:/etc:${sysconfdir}:g \ 43 sed -i -e s:/etc:${sysconfdir}:g \
45 -e s:/usr/bin:${bindir}:g \ 44 -e s:/usr/bin:${bindir}:g \
46 -e s:/var:${localstatedir}:g \ 45 -e s:/var:${localstatedir}:g \
47 ${D}${systemd_unitdir}/system/weston@.service 46 ${D}${systemd_unitdir}/system/weston.service
48 install -D -p -m0644 ${WORKDIR}/71-weston-drm.rules \
49 ${D}${sysconfdir}/udev/rules.d/71-weston-drm.rules
50 # Install weston-start script 47 # Install weston-start script
51 install -Dm755 ${WORKDIR}/weston-start ${D}${bindir}/weston-start 48 install -Dm755 ${WORKDIR}/weston-start ${D}${bindir}/weston-start
52 sed -i 's,@DATADIR@,${datadir},g' ${D}${bindir}/weston-start 49 sed -i 's,@DATADIR@,${datadir},g' ${D}${bindir}/weston-start
@@ -58,11 +55,15 @@ do_install() {
58 if [ "${@bb.utils.contains('PACKAGECONFIG', 'no-idle-timeout', 'yes', 'no', d)}" = "yes" ]; then 55 if [ "${@bb.utils.contains('PACKAGECONFIG', 'no-idle-timeout', 'yes', 'no', d)}" = "yes" ]; then
59 sed -i -e "/^\[core\]/a idle-time=0" ${D}${sysconfdir}/xdg/weston/weston.ini 56 sed -i -e "/^\[core\]/a idle-time=0" ${D}${sysconfdir}/xdg/weston/weston.ini
60 fi 57 fi
58
59 install -dm 755 -o weston -g weston ${D}/home/weston
61} 60}
62 61
63INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}" 62INHIBIT_UPDATERCD_BBCLASS = "${@oe.utils.conditional('VIRTUAL-RUNTIME_init_manager', 'systemd', '1', '', d)}"
64 63
65inherit update-rc.d features_check systemd 64inherit update-rc.d features_check systemd useradd
65
66USERADD_PACKAGES = "${PN}"
66 67
67# rdepends on weston which depends on virtual/egl 68# rdepends on weston which depends on virtual/egl
68# requires pam enabled if started via systemd 69# requires pam enabled if started via systemd
@@ -73,10 +74,18 @@ RDEPENDS_${PN} = "weston kbd"
73INITSCRIPT_NAME = "weston" 74INITSCRIPT_NAME = "weston"
74INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ." 75INITSCRIPT_PARAMS = "start 9 5 2 . stop 20 0 1 6 ."
75 76
76FILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${systemd_system_unitdir}/weston@.service ${systemd_system_unitdir}/weston@.socket ${sysconfdir}/default/weston ${sysconfdir}/pam.d/" 77FILES_${PN} += "\
78 ${sysconfdir}/xdg/weston/weston.ini \
79 ${systemd_system_unitdir}/weston.service \
80 ${systemd_system_unitdir}/weston.socket \
81 ${sysconfdir}/default/weston \
82 ${sysconfdir}/pam.d/ \
83 /home/weston \
84 "
77 85
78CONFFILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${sysconfdir}/default/weston" 86CONFFILES_${PN} += "${sysconfdir}/xdg/weston/weston.ini ${sysconfdir}/default/weston"
79 87
80SYSTEMD_SERVICE_${PN} = "weston@%i.service" 88SYSTEMD_SERVICE_${PN} = "weston.service weston.socket"
81SYSTEMD_AUTO_ENABLE = "disable" 89USERADD_PARAM_${PN} = "--home /home/weston --shell /bin/sh --user-group -G video,input weston"
90GROUPADD_PARAM_${PN} = "-r wayland"
82 91
diff --git a/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules b/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules
deleted file mode 100644
index 1a1b8bbda4..0000000000
--- a/meta/recipes-graphics/wayland/weston-init/71-weston-drm.rules
+++ /dev/null
@@ -1,2 +0,0 @@
1ACTION=="add", SUBSYSTEM=="graphics", KERNEL=="fb0", TAG+="systemd", ENV{SYSTEMD_WANTS}+="weston@root.service"
2ACTION=="add", SUBSYSTEM=="drm", KERNEL=="card0", TAG+="systemd", ENV{SYSTEMD_WANTS}+="weston@root.service"
diff --git a/meta/recipes-graphics/wayland/weston-init/weston@.service b/meta/recipes-graphics/wayland/weston-init/weston.service
index ce8f4fb71a..e09625b31c 100644
--- a/meta/recipes-graphics/wayland/weston-init/weston@.service
+++ b/meta/recipes-graphics/wayland/weston-init/weston.service
@@ -9,6 +9,7 @@ Documentation=man:weston(1) man:weston.ini(5)
9Documentation=http://wayland.freedesktop.org/ 9Documentation=http://wayland.freedesktop.org/
10 10
11# Make sure we are started after logins are permitted. 11# Make sure we are started after logins are permitted.
12Requires=systemd-user-sessions.service
12After=systemd-user-sessions.service 13After=systemd-user-sessions.service
13 14
14# If Plymouth is used, we want to start when it is on its way out. 15# If Plymouth is used, we want to start when it is on its way out.
@@ -18,6 +19,9 @@ After=plymouth-quit-wait.service
18Wants=dbus.socket 19Wants=dbus.socket
19After=dbus.socket 20After=dbus.socket
20 21
22# Ensure the socket is present
23Requires=weston.socket
24
21# Since we are part of the graphical session, make sure we are started before 25# Since we are part of the graphical session, make sure we are started before
22# it is complete. 26# it is complete.
23Before=graphical.target 27Before=graphical.target
@@ -37,10 +41,11 @@ TimeoutStartSec=60
37WatchdogSec=20 41WatchdogSec=20
38 42
39# The user to run Weston as. 43# The user to run Weston as.
40User=%I 44User=weston
45Group=weston
41 46
42# Make sure working directory is users home directory 47# Make sure the working directory is the users home directory
43WorkingDirectory=/home/%i 48WorkingDirectory=/home/weston
44 49
45# Set up a full user session for the user, required by Weston. 50# Set up a full user session for the user, required by Weston.
46PAMName=weston-autologin 51PAMName=weston-autologin
@@ -61,5 +66,6 @@ UtmpIdentifier=tty7
61UtmpMode=user 66UtmpMode=user
62 67
63[Install] 68[Install]
69# Note: If you only want weston to start on-demand, remove this line with a
70# service drop file
64WantedBy=graphical.target 71WantedBy=graphical.target
65DefaultInstance=tty7
diff --git a/meta/recipes-graphics/wayland/weston-init/weston.socket b/meta/recipes-graphics/wayland/weston-init/weston.socket
new file mode 100644
index 0000000000..c1bdc83c05
--- /dev/null
+++ b/meta/recipes-graphics/wayland/weston-init/weston.socket
@@ -0,0 +1,14 @@
1[Unit]
2Description=Weston socket
3RequiresMountsFor=/run
4
5[Socket]
6ListenStream=/run/wayland-0
7SocketMode=0775
8SocketUser=weston
9SocketGroup=wayland
10RemoveOnStop=yes
11
12[Install]
13WantedBy=sockets.target
14
diff --git a/meta/recipes-graphics/wayland/weston-init/weston@.socket b/meta/recipes-graphics/wayland/weston-init/weston@.socket
deleted file mode 100644
index f1790d74a8..0000000000
--- a/meta/recipes-graphics/wayland/weston-init/weston@.socket
+++ /dev/null
@@ -1,10 +0,0 @@
1[Unit]
2Description=Weston Wayland socket
3After=user-runtime-dir@1000.service
4
5[Socket]
6ListenStream=/run/user/1000/wayland-%I
7
8[Install]
9WantedBy=sockets.target
10