Re: [PATCH 2/2] host/rootfs: weston: run as non-root

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 1976 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 12/9/25 14:50, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> On 12/9/25 13:24, Alyssa Ross wrote:
>
> (snip)
>
>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>>> index 29f3b252..50def56d 100644
>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>>> @@ -1 +1,2 @@
>>>>  root:x:0:0:System administrator:/:/bin/sh
>>>> +wayland:x:15:15:Wayland compositor:/:/bin/nologin
>>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>>> index 67ccfb45..86b9a1ef 100755
>>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>>> @@ -4,6 +4,8 @@
>>>>  
>>>>  s6-ipcserver-socketbinder -a 0700 /run/root-terminal
>>>>  
>>>> +if { chown wayland /run/root-terminal }
>>>> +
>>>>  fdmove 1 3
>>>>  s6-ipcserverd -1P
>>>>  
>>>> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
>>>> index 2674ec0b..7d10b5b4 100644
>>>> --- a/host/rootfs/image/etc/s6-rc/weston/run
>>>> +++ b/host/rootfs/image/etc/s6-rc/weston/run
>>>> @@ -34,10 +34,13 @@ backtick HOME {
>>>>    homeof $user
>>>>  }
>>>>  
>>>> +if { install -do wayland -g wayland -m 0770 /run/wayland }
>>>> +if { chown wayland /dev/tty0 /dev/tty1 }
>>>
>>> Why chown and not setfacl?
>> 
>> Why setfacl and not chown?
>
> Having a real device node owned by non-root is weird, and systemd-udevd
> uses ACLs.

It's not that weird… /dev/tty1 is owned by the user I'm logged in as on
my NixOS system, and I haven't done anything special to make that
happen.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]