Re: [PATCH 2/2] host/rootfs: weston: run as non-root

[Demi Marie Obenour <demiobenour@gmail.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1771 bytes --]

On 12/9/25 14:50, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> On 12/9/25 13:24, Alyssa Ross wrote:

(snip)

>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>> index 29f3b252..50def56d 100644
>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/etc/passwd
>>> @@ -1 +1,2 @@
>>>  root:x:0:0:System administrator:/:/bin/sh
>>> +wayland:x:15:15:Wayland compositor:/:/bin/nologin
>>> diff --git a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>> index 67ccfb45..86b9a1ef 100755
>>> --- a/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>> +++ b/host/rootfs/image/etc/s6-linux-init/run-image/service/root-terminal/run
>>> @@ -4,6 +4,8 @@
>>>  
>>>  s6-ipcserver-socketbinder -a 0700 /run/root-terminal
>>>  
>>> +if { chown wayland /run/root-terminal }
>>> +
>>>  fdmove 1 3
>>>  s6-ipcserverd -1P
>>>  
>>> diff --git a/host/rootfs/image/etc/s6-rc/weston/run b/host/rootfs/image/etc/s6-rc/weston/run
>>> index 2674ec0b..7d10b5b4 100644
>>> --- a/host/rootfs/image/etc/s6-rc/weston/run
>>> +++ b/host/rootfs/image/etc/s6-rc/weston/run
>>> @@ -34,10 +34,13 @@ backtick HOME {
>>>    homeof $user
>>>  }
>>>  
>>> +if { install -do wayland -g wayland -m 0770 /run/wayland }
>>> +if { chown wayland /dev/tty0 /dev/tty1 }
>>
>> Why chown and not setfacl?
> 
> Why setfacl and not chown?

Having a real device node owned by non-root is weird, and systemd-udevd
uses ACLs.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]