[PATCH 04/13] img/app: wayland-proxy-virtwl: run as non-root

[Alyssa Ross <hi@alyssa.is>]

nsswitch.conf needs to exist for s6-envuidgid to be able to find
supplementary groups.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
 img/app/file-list.mk                             | 2 ++
 img/app/image/etc/group                          | 1 +
 img/app/image/etc/group.license                  | 2 ++
 img/app/image/etc/mdev.conf                      | 2 +-
 img/app/image/etc/nsswitch.conf                  | 0
 img/app/image/etc/passwd                         | 1 +
 img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 ++
 7 files changed, 9 insertions(+), 1 deletion(-)
 create mode 100644 img/app/image/etc/group
 create mode 100644 img/app/image/etc/group.license
 create mode 100644 img/app/image/etc/nsswitch.conf

diff --git a/img/app/file-list.mk b/img/app/file-list.mk
index 6934975..c7cd82a 100644
--- a/img/app/file-list.mk
+++ b/img/app/file-list.mk
@@ -4,11 +4,13 @@
 FILES = \
 	image/etc/dbus-1/session.conf \
 	image/etc/fstab \
+	image/etc/group \
 	image/etc/mdev.conf \
 	image/etc/mdev/iface \
 	image/etc/mdev/listen \
 	image/etc/mdev/virtiofs \
 	image/etc/mdev/wait \
+	image/etc/nsswitch.conf \
 	image/etc/passwd \
 	image/etc/pipewire/pipewire.conf \
 	image/etc/resolv.conf \
diff --git a/img/app/image/etc/group b/img/app/image/etc/group
new file mode 100644
index 0000000..4add88f
--- /dev/null
+++ b/img/app/image/etc/group
@@ -0,0 +1 @@
+wayland:x:1:wayland
diff --git a/img/app/image/etc/group.license b/img/app/image/etc/group.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/img/app/image/etc/group.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf
index df215b9..b7c0c5b 100644
--- a/img/app/image/etc/mdev.conf
+++ b/img/app/image/etc/mdev.conf
@@ -4,7 +4,7 @@
 -$MODALIAS=.* 0:0 0 ! +importas -Siu MODALIAS modprobe -q $MODALIAS
 $INTERFACE=.* 0:0 0 ! +/etc/mdev/iface
 $MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
+dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 }
 snd/controlC0 0:0 660 +background { /etc/mdev/listen controlC0 }
 
 # Don't change mode of other device nodes created by devtmpfs.
diff --git a/img/app/image/etc/nsswitch.conf b/img/app/image/etc/nsswitch.conf
new file mode 100644
index 0000000..e69de29
diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd
index 5d35578..31e5773 100644
--- a/img/app/image/etc/passwd
+++ b/img/app/image/etc/passwd
@@ -1 +1,2 @@
 root:x:0:0:System administrator:/run/root:/bin/sh
+wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin
diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
index 380a833..86d7f63 100755
--- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
+++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
@@ -26,4 +26,6 @@ export LISTEN_FDS 2
 export LISTEN_FDNAMES wayland:x11
 getpid LISTEN_PID
 
+s6-setuidgid wayland
+
 wayland-proxy-virtwl --virtio-gpu --x-display=0
-- 
2.51.0