[PATCH 10/13] img/app: pipewire: run as non-root

Alyssa Ross
2025-11-26T21:34:58Z

Set the real-time scheduling priority hard limit globally at boot, as
recommended by the s6-softlimit documentation.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
---
img/app/image/etc/group | 1 +
img/app/image/etc/mdev.conf | 4 +++-
img/app/image/etc/passwd | 1 +
img/app/image/etc/s6-rc/pipewire/run | 4 ++++
img/app/image/usr/bin/init | 4 +++-
5 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/img/app/image/etc/group b/img/app/image/etc/group
index 5eafb82..0bf6579 100644
--- a/img/app/image/etc/group
+++ b/img/app/image/etc/group
@@ -1,2 +1,3 @@
wayland:x:1:wayland
wireplumber:x:2:wireplumber
+pipewire:x:3:pipewire
diff --git a/img/app/image/etc/mdev.conf b/img/app/image/etc/mdev.conf
index b7c0c5b..d4cd825 100644
--- a/img/app/image/etc/mdev.conf
+++ b/img/app/image/etc/mdev.conf
@@ -5,7 +5,9 @@
$INTERFACE=.* 0:0 0 ! +/etc/mdev/iface
$MODALIAS=virtio:d0000001Av.* 0:0 0 ! +/etc/mdev/virtiofs
dri/card0 wayland:wayland 660 +background { /etc/mdev/listen card0 }
-snd/controlC0 0:0 660 +background { /etc/mdev/listen controlC0 }
+
+-SUBSYSTEM=sound;.* pipewire:pipewire 660
+snd/controlC0 pipewire:pipewire 660 +background { /etc/mdev/listen controlC0 }

# Don't change mode of other device nodes created by devtmpfs.
.* 0:0 0 !
diff --git a/img/app/image/etc/passwd b/img/app/image/etc/passwd
index 5557240..631554c 100644
--- a/img/app/image/etc/passwd
+++ b/img/app/image/etc/passwd
@@ -1,3 +1,4 @@
root:x:0:0:System administrator:/run/root:/bin/sh
wayland:x:1:1:wayland-proxy-virtwl service user:/:/usr/bin/nologin
wireplumber:x:2:2:WirePlumber service user:/:/usr/bin/nologin
+pipewire:x:3:3:PipeWire service user:/:/usr/bin/nologin
diff --git a/img/app/image/etc/s6-rc/pipewire/run b/img/app/image/etc/s6-rc/pipewire/run
index afaada1..3925f08 100644
--- a/img/app/image/etc/s6-rc/pipewire/run
+++ b/img/app/image/etc/s6-rc/pipewire/run
@@ -27,6 +27,10 @@ fdclose 5
# Wait for sound devices to be available
if { /etc/mdev/wait controlC0 }

+nice -n -11
+s6-softlimit -P 88
+s6-setuidgid pipewire
+
export LISTEN_FDS 2
getpid LISTEN_PID
pipewire
diff --git a/img/app/image/usr/bin/init b/img/app/image/usr/bin/init
index 6424e22..aca6efa 100755
--- a/img/app/image/usr/bin/init
+++ b/img/app/image/usr/bin/init
@@ -1,5 +1,7 @@
#!/bin/execlineb -s0
# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2022 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2022, 2025 Alyssa Ross <hi@alyssa.is>
+
+/bin/s6-softlimit -HP 88

/bin/s6-linux-init -Bc /etc/s6-linux-init -- $@
--
2.51.0