[PATCH 10/13] img/app: pipewire: run as non-root

[Alyssa Ross <hi@alyssa.is>]

Set the real-time scheduling priority hard limit globally at boot, as
recommended by the s6-softlimit documentation.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 img/app/image/etc/group              | 1 +
 img/app/image/etc/mdev.conf          | 4 +++-
 img/app/image/etc/passwd             | 1 +
 img/app/image/etc/s6-rc/pipewire/run | 4 ++++
 img/app/image/usr/bin/init           | 4 +++-
 5 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/img/app/image/etc/group b/img/app/image/etc/group
index 5eafb82..0bf6579 100644
--- a/img/app/image/etc/group
+++ b/img/app/image/etc/group
@@ -1,2 +1,3 @@
 wayland:x:1:wayland
 wireplumber:x:2:wireplumber
+pipewire:x:3:pipewire
diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf
index b7c0c5b..d4cd825 100644
--- a/img/app/image/etc/mdev.conf
+++ b/img/app/image/etc/mdev.conf
@@ -5,7 +5,9 @@
 $INTERFACE=.* 0:0 0 ! +/etc/mdev/iface
 $MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs
 dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 }
-snd/controlC0 0:0 660 +background { /etc/mdev/listen controlC0 }
+
+-SUBSYSTEM=sound;.* pipewire:pipewire 660
+snd/controlC0 pipewire:pipewire 660 +background { /etc/mdev/listen controlC0 }
 
 # Don't change mode of other device nodes created by devtmpfs.
 .* 0:0 0 !
diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd
index 5557240..631554c 100644
--- a/img/app/image/etc/passwd
+++ b/img/app/image/etc/passwd
@@ -1,3 +1,4 @@
 root:x:0:0:System administrator:/run/root:/bin/sh
 wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin
 wireplumber:x:2:2:WirePlumber service user:/:/usr/bin/nologin
+pipewire:x:3:3:PipeWire service user:/:/usr/bin/nologin
diff --git a/img/app/image/etc/s6-rc/pipewire/run b/img/app/image/etc/s6-rc/pipewire/run
index afaada1..3925f08 100644
--- a/img/app/image/etc/s6-rc/pipewire/run
+++ b/img/app/image/etc/s6-rc/pipewire/run
@@ -27,6 +27,10 @@ fdclose 5
 # Wait for sound devices to be available
 if { /etc/mdev/wait controlC0 }
 
+nice -n -11
+s6-softlimit -P 88
+s6-setuidgid pipewire
+
 export LISTEN_FDS 2
 getpid LISTEN_PID
 pipewire
diff --git a/img/app/image/usr/bin/init b/img/app/image/usr/bin/init
index 6424e22..aca6efa 100755
--- a/img/app/image/usr/bin/init
+++ b/img/app/image/usr/bin/init
@@ -1,5 +1,7 @@
 #!/bin/execlineb -s0
 # SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2022 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2022, 2025 Alyssa Ross <hi@alyssa.is>
+
+/bin/s6-softlimit -HP 88
 
 /bin/s6-linux-init -Bc /etc/s6-linux-init -- $@
-- 
2.51.0