Change:
<ins> From e9c772e265b2293af031c79f4bbc99b5847dfe3c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= <torhedinbronner@gmail.com> Date: Sat, 19 Oct 2019 13:26:05 +0200 Subject: [PATCH] drop inheritable Adapted from https://gitlab.gnome.org/GNOME/mutter/commit/c53c47ae123b03cc66044d2b846342123ecb3a01 We only want to drop inheritable though, to prevent the ambient set leaking further than gnome-shell. --- config.h.meson    |  3 +++ meson.build       |  5 +++++ meson_options.txt |  6 ++++++ src/core/main.c   | 11 +++++++++++ src/meson.build   |  1 + 5 files changed, 26 insertions(+) diff --git a/config.h.meson b/config.h.meson index 0bab71848..202fb7ed1 100644 --- a/config.h.meson +++ b/config.h.meson @@ -58,6 +58,9 @@ /* Xwayland applications allowed to issue keyboard grabs */ #mesondefine XWAYLAND_GRAB_DEFAULT_ACCESS_RULES +/* Defined if libcap-ng is available */ +#mesondefine HAVE_LIBCAPNG + /* XKB base prefix */ #mesondefine XKB_BASE diff --git a/meson.build b/meson.build index 3322bd3b1..01c8020fa 100644 --- a/meson.build +++ b/meson.build @@ -35,6 +35,7 @@ libstartup_notification_req = '>= 0.7' libcanberra_req = '>= 0.26' libwacom_req = '>= 0.13' atk_req = '>= 2.5.3' +libcapng_req = '>= 0.7.9' # optional version requirements udev_req = '>= 228' @@ -125,6 +126,7 @@ xau_dep = dependency('xau') ice_dep = dependency('ice') atk_dep = dependency('atk', version: atk_req) libcanberra_dep = dependency('libcanberra', version: libcanberra_req) +libcapng_dep = dependency('libcap-ng', required: get_option('libcapng')) # For now always require X11 support have_x11 = true @@ -256,6 +258,7 @@ have_core_tests = false have_cogl_tests = false have_clutter_tests = false have_installed_tests = false +have_libcapng = libcapng_dep.found() if have_tests have_core_tests = get_option('core_tests') @@ -361,6 +364,7 @@ cdata.set('HAVE_LIBWACOM', have_libwacom) cdata.set('HAVE_SM', have_sm) cdata.set('HAVE_STARTUP_NOTIFICATION', have_startup_notification) cdata.set('HAVE_INTROSPECTION', have_introspection) +cdata.set('HAVE_LIBCAPNG', have_libcapng) cdata.set('HAVE_PROFILER', have_profiler) xkb_base = xkeyboard_config_dep.get_pkgconfig_variable('xkb_base') @@ -443,6 +447,7 @@ output = [ '        Startup notification..... ' + have_startup_notification.to_string(), '        Introspection............ ' + have_introspection.to_string(), '        Profiler................. ' + have_profiler.to_string(), +  '        libcap-ng................ ' + have_libcapng.to_string(), '', '    Tests:', '', diff --git a/meson_options.txt b/meson_options.txt index 73aa7adde..8bfaacd9a 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -152,3 +152,9 @@ option('xwayland_grab_default_access_rules', value: 'gnome-boxes,remote-viewer,virt-viewer,virt-manager,vinagre,vncviewer,Xephyr', description: 'Comma delimited list of applications ressources or class allowed to issue X11 grabs in Xwayland' ) + +option('libcapng', +  type: 'feature', +  value: 'auto', +  description: 'Enable libcap-ng support' +) diff --git a/src/core/main.c b/src/core/main.c index 7f4f666d2..b27968f13 100644 --- a/src/core/main.c +++ b/src/core/main.c @@ -66,6 +66,10 @@ #include <girepository.h> #endif +#ifdef HAVE_LIBCAPNG +#include <cap-ng.h> +#endif + #if defined(HAVE_NATIVE_BACKEND) && defined(HAVE_WAYLAND) #include <systemd/sd-login.h> #endif /* HAVE_WAYLAND && HAVE_NATIVE_BACKEND */ @@ -673,6 +677,12 @@ meta_run (void) if (!meta_display_open ()) meta_exit (META_EXIT_ERROR); +#ifdef HAVE_LIBCAPNG +  capng_clear(CAPNG_SELECT_BOTH); +  capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_NICE); +  capng_apply(CAPNG_SELECT_BOTH); +#endif + g_main_loop_run (meta_main_loop); meta_finalize (); diff --git a/src/meson.build b/src/meson.build index 90d80734f..a9fffa2c2 100644 --- a/src/meson.build +++ b/src/meson.build @@ -18,6 +18,7 @@ mutter_pkg_deps = [ glib_dep, gsettings_desktop_schemas_dep, gtk3_dep, +  libcapng_dep, pango_dep, ] -- 2.23.0 </ins>

Discussion:
Capability wrappers are somewhat limited. They require the capability be part of the ambient set for it to survive execv's, ie. when the wrapper executes the source binary (). This means any program spawned from a wrapped binary will also inherit the capabilities. We really don't want programs launched from gnome-shell to inherit capsysnice obviously. In particular bubblewrap fails to work if it possess any extra caps, breaking at least flatpaks and epiphany. So as far as I can see we have two options: Actually copy to wrapperDir and set capsysnic=+ep. This should be pretty easy, but also quite ugly (see for context). Patch mutter to drop inheritable, we could probably adopt . This should probably work as the ambient set only propagates if inheritable is set. cc
Patching mutter to drop inheritable works :tada:, will make a PR :)
Does the rationale for not merging it not apply to us?
No it shouldn't. We only drop inheritable to prevent the ambient set being passed on, while keeping effective and permitted for gnome-shell. (it might be possible to drop the ambient set with , but I went with just clearing inheritable):