File 0001-Use-Xauthority-for-Xwayland.patch of Package kwin5

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Use-Xauthority-for-Xwayland.patch of Package kwin5 (Revision cf3893ed3518517d7865677d0b4bca19)

Currently displaying revision cf3893ed3518517d7865677d0b4bca19 , Show latest

From 8026c9649990d70ebe53c5c7d0c68e74fce28014 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fabian@ritter-vogt.de>
Date: Sat, 17 Mar 2018 23:25:56 +0100
Subject: [PATCH] Use Xauthority for Xwayland authorization

Currently Xwayland only looks at the uid of the application connecting to it.
Using Xauthority gives more flexibility here, by having a token which can be
passed around.

Not only does this allow to grant only certain applications the right to
connect to the display (e.g. su user xterm) while keeping other applications
outside, this allows also
starting applications as other users again
---
 CMakeLists.txt   |   1 +
 xwl/xwayland.cpp | 103 ++++++++++++++++++++++++++++++++++++++++++++++-
 xwl/xwayland.h   |   3 ++
 3 files changed, 105 insertions(+), 2 deletions(-)

Index: kwin-5.15.80git.20200912T061110~f5900a5fd/CMakeLists.txt
===================================================================
--- kwin-5.15.80git.20200912T061110~f5900a5fd.orig/CMakeLists.txt	2020-09-12 06:11:10.000000000 +0200
+++ kwin-5.15.80git.20200912T061110~f5900a5fd/CMakeLists.txt	2020-09-12 11:27:06.232054780 +0200
@@ -668,6 +668,7 @@
     ${X11_ICE_LIB}
     ${X11_SM_LIB}
     ${X11_X11_LIB}
+    ${X11_Xau_LIB}
 )
 
 set(kwin_XCB_LIBS
Index: kwin-5.15.80git.20200912T061110~f5900a5fd/xwl/xwayland.cpp
===================================================================
--- kwin-5.15.80git.20200912T061110~f5900a5fd.orig/xwl/xwayland.cpp	2020-09-12 06:11:10.000000000 +0200
+++ kwin-5.15.80git.20200912T061110~f5900a5fd/xwl/xwayland.cpp	2020-09-12 11:27:25.688155051 +0200
@@ -39,6 +39,8 @@
 #include <sys/socket.h>
 #include <cerrno>
 #include <cstring>
+#include <iostream>
+#include <X11/Xauth.h>
 
 static QByteArray readDisplay(int pipe)
 {
@@ -77,6 +79,72 @@
     stop();
 }
 
+static QByteArray getRandomData(qint64 bytes)
+{
+    QFile random(QStringLiteral("/dev/urandom"));
+    if (!random.open(QIODevice::ReadOnly))
+        return {};
+
+    QByteArray data;
+    data.resize(bytes);
+    while (bytes) {
+        auto bytesRead = random.read(data.data() + data.size() - bytes, bytes);
+        if (bytesRead == -1)
+            return {};
+
+        bytes -= bytesRead;
+    }
+
+    return data;
+}
+
+static bool addCookieToFile(QString filename, QString &hostname)
+{
+    QByteArray cookie = getRandomData(16);
+    char *displayNumber = getenv("DISPLAY");
+
+    if(displayNumber == nullptr || displayNumber[0] == '\0' || cookie.count() != 16) {
+        return false;
+    }
+
+    FILE *authFp = fopen(qPrintable(filename), "wb");
+    if (authFp == nullptr) {
+        return false;
+    }
+
+    char localhost[HOST_NAME_MAX + 1] = "";
+    if (gethostname(localhost, HOST_NAME_MAX) < 0) {
+        strcpy(localhost, "localhost");
+    }
+
+    hostname = QString::fromUtf8(localhost);
+
+    Xauth auth = {};
+    char cookieName[] = "MIT-MAGIC-COOKIE-1";
+
+    auth.family = FamilyLocal;
+    auth.address = localhost;
+    auth.address_length = strlen(auth.address);
+    auth.number = displayNumber + 1;
+    auth.number_length = strlen(auth.number);
+    auth.name = cookieName;
+    auth.name_length = sizeof(cookieName) - 1;
+    auth.data = cookie.data();
+    auth.data_length = cookie.count();
+
+    if (XauWriteAuth(authFp, &auth) == 0) {
+        fclose(authFp);
+        return false;
+    }
+
+    auth.family = FamilyWild;
+    bool success = XauWriteAuth(authFp, &auth) != 0 && fflush(authFp) != EOF;
+
+    fclose(authFp);
+
+    return success;
+}
+
 QProcess *Xwayland::process() const
 {
     return m_xwaylandProcess;
@@ -88,6 +156,16 @@
         return;
     }
 
+    QString dir = QStandardPaths::writableLocation(QStandardPaths::RuntimeLocation);
+    if (!dir.isEmpty()) {
+        m_xwaylandAuthority.setFileTemplate(dir + QStringLiteral("/xauth_XXXXXX"));
+        m_xwaylandAuthority.open();
+    }
+
+    if (m_xwaylandAuthority.fileName().isEmpty()) {
+        std::cerr << "Warning: Could not create a Xauthority file for Xwayland." << std::endl;
+    }
+
     int pipeFds[2];
     if (pipe(pipeFds) != 0) {
         qCWarning(KWIN_XWL, "Failed to create pipe to start Xwayland: %s", strerror(errno));
@@ -130,11 +208,15 @@
     env.insert("WAYLAND_SOCKET", QByteArray::number(wlfd));
     env.insert("EGL_PLATFORM", QByteArrayLiteral("DRM"));
     m_xwaylandProcess->setProcessEnvironment(env);
-    m_xwaylandProcess->setArguments({QStringLiteral("-displayfd"),
+    QStringList args{QStringLiteral("-displayfd"),
                            QString::number(pipeFds[1]),
                            QStringLiteral("-rootless"),
                            QStringLiteral("-wm"),
-                           QString::number(fd)});
+                           QString::number(fd)};
+    if (!m_xwaylandAuthority.fileName().isEmpty()) {
+        args << QStringLiteral("-auth") << m_xwaylandAuthority.fileName();
+    }
+    m_xwaylandProcess->setArguments(args);
     connect(m_xwaylandProcess, &QProcess::errorOccurred, this, &Xwayland::handleXwaylandError);
     connect(m_xwaylandProcess, &QProcess::started, this, &Xwayland::handleXwaylandStarted);
     connect(m_xwaylandProcess, QOverload<int, QProcess::ExitStatus>::of(&QProcess::finished),
@@ -328,6 +410,23 @@
 
 bool Xwayland::createX11Connection()
 {
+    if (!m_xwaylandAuthority.fileName().isEmpty()) {
+        QString hostname;
+        if (addCookieToFile(m_xwaylandAuthority.fileName(), hostname)) {
+            setenv("XAUTHORITY", qPrintable(m_xwaylandAuthority.fileName()), 1);
+            setenv("XAUTHLOCALHOSTNAME", qPrintable(hostname), 1);
+            auto env = m_app->processStartupEnvironment();
+            env.insert(QStringLiteral("XAUTHORITY"), m_xwaylandAuthority.fileName());
+            env.insert(QStringLiteral("XAUTHLOCALHOSTNAME"), hostname);
+            m_app->setProcessStartupEnvironment(env);
+        }
+        else {
+            std::cerr << "Could not generate Xauthority entry" << std::endl;
+            // We can't authenticate using it so the server must not see any entries either
+            m_xwaylandAuthority.resize(0);
+        }
+    }
+
     xcb_connection_t *connection = xcb_connect_to_fd(m_xcbConnectionFd, nullptr);
 
     const int errorCode = xcb_connection_has_error(connection);
Index: kwin-5.15.80git.20200912T061110~f5900a5fd/xwl/xwayland.h
===================================================================
--- kwin-5.15.80git.20200912T061110~f5900a5fd.orig/xwl/xwayland.h	2020-09-12 06:11:10.000000000 +0200
+++ kwin-5.15.80git.20200912T061110~f5900a5fd/xwl/xwayland.h	2020-09-12 11:27:06.232054780 +0200
@@ -15,6 +15,7 @@
 #include <QFutureWatcher>
 #include <QProcess>
 #include <QSocketNotifier>
+#include <QTemporaryFile>
 
 namespace KWin
 {
@@ -102,6 +103,7 @@
     QProcess *m_xwaylandProcess = nullptr;
     QSocketNotifier *m_socketNotifier = nullptr;
     QTimer *m_resetCrashCountTimer = nullptr;
+    QTemporaryFile m_xwaylandAuthority;
     QByteArray m_displayName;
     QFutureWatcher<QByteArray> *m_watcher = nullptr;
     ApplicationWaylandAbstract *m_app;

Places

File 0001-Use-Xauthority-for-Xwayland.patch of Package kwin5 (Revision cf3893ed3518517d7865677d0b4bca19)

Places