[PATCH 04/13] img/app: wayland-proxy-virtwl: run as non-root

Alyssa Ross
2025-11-26T21:34:51Z

nsswitch.conf needs to exist for s6-envuidgid to be able to find
supplementary groups.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
img/app/file-list.mk | 2 ++
img/app/image/etc/group | 1 +
img/app/image/etc/group.license | 2 ++
img/app/image/etc/mdev.conf | 2 +-
img/app/image/etc/nsswitch.conf | 0
img/app/image/etc/passwd | 1 +
img/app/image/etc/s6-rc/wayland-proxy-virtwl/run | 2 ++
7 files changed, 9 insertions(+), 1 deletion(-)
create mode 100644 img/app/image/etc/group
create mode 100644 img/app/image/etc/group.license
create mode 100644 img/app/image/etc/nsswitch.conf

diff --git a/img/app/file-list.mk b/img/app/file-list.mk
index 6934975..c7cd82a 100644
--- a/img/app/file-list.mk
+++ b/img/app/file-list.mk
@@ -4,11 +4,13 @@
FILES = \
image/etc/dbus-1/session.conf \
image/etc/fstab \
+ image/etc/group \
image/etc/mdev.conf \
image/etc/mdev/iface \
image/etc/mdev/listen \
image/etc/mdev/virtiofs \
image/etc/mdev/wait \
+ image/etc/nsswitch.conf \
image/etc/passwd \
image/etc/pipewire/pipewire.conf \
image/etc/resolv.conf \
diff --git a/img/app/image/etc/group b/img/app/image/etc/group
new file mode 100644
index 0000000..4add88f
--- /dev/null
+++ b/img/app/image/etc/group
@@ -0,0 +1 @@
+wayland:x:1:wayland
diff --git a/img/app/image/etc/group.license b/img/app/image/etc/group.license
new file mode 100644
index 0000000..0d3d47c
--- /dev/null
+++ b/img/app/image/etc/group.license
@@ -0,0 +1,2 @@
+SPDX-License-Identifier: CC0-1.0
+SPDX-FileCopyrightText: 2025 Alyssa Ross <hi@alyssa.is>
diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf
index df215b9..b7c0c5b 100644
--- a/img/app/image/etc/mdev.conf
+++ b/img/app/image/etc/mdev.conf
@@ -4,7 +4,7 @@
-$MODALIAS=.* 0:0 0 ! +importas -Siu MODALIAS modprobe -q $MODALIAS
$INTERFACE=.* 0:0 0 ! +/etc/mdev/iface
$MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs
-dri/card0 0:0 660 +background { /etc/mdev/listen card0 }
+dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 }
snd/controlC0 0:0 660 +background { /etc/mdev/listen controlC0 }

# Don't change mode of other device nodes created by devtmpfs.
diff --git a/img/app/image/etc/nsswitch.conf b/img/app/image/etc/nsswitch.conf
new file mode 100644
index 0000000..e69de29
diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd
index 5d35578..31e5773 100644
--- a/img/app/image/etc/passwd
+++ b/img/app/image/etc/passwd
@@ -1 +1,2 @@
root:x:0:0:System administrator:/run/root:/bin/sh
+wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin
diff --git a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
index 380a833..86d7f63 100755
--- a/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
+++ b/img/app/image/etc/s6-rc/wayland-proxy-virtwl/run
@@ -26,4 +26,6 @@ export LISTEN_FDS 2
export LISTEN_FDNAMES wayland:x11
getpid LISTEN_PID

+s6-setuidgid wayland
+
wayland-proxy-virtwl --virtio-gpu --x-display=0
--
2.51.0