Xorg: Add a suid root wrapper

With the recent systemd-logind changes it is possible to install the Xorg
binary without suid root rights and still have everything working as it
should *if* the user only has cards which are supported by kms.

This commit adds a little suid root wrapper, which is a bit weird, first we
strip the suid-root bit of the Xorg binary, and then we add a wrapper ?

The function of this wrapper is to see if a system still needs root-rights,
if it does not (it supports kms and the kms drivers are properly loaded),
then it will immediately drop all elevated rights before executing the real
Xorg binary. If it finds (some) cards which don't support kms, or no cards
at all, then it will execute the Xorg server with elevated rights so that
ie the nvidia binary driver and the vesa driver can keep working normally.

To make it possible for security concious users who don't need the root
rights to completely remove the wrapper, Xorg is started in a 3 step process
when the wrapper is enabled during build time:

1) A simple shell script which checks if the wrapper is there, if it is
  it executes the wrapper, if not it directly executes the real Xorg binary

2) The wrapper gets executed, does its checks, normally drops all elevated
  rights and then executes the real Xorg binary

3) The real Xorg binary does its thing

This allows distributions to put the wrapper binary in a separate package, and
will allow users to remove this package. IE the plan with Fedora is to make
"legacy" drivers depend on the wrapper pkg, and since our default install
contains some legacy drivers it will be part of the default install, but
users can later yum remove it (which will also automatically remove the
legacy driver packages as those won't work without it anyways).

The wrapper is loosely modelled after the existing Debian Xwrapper, it
uses the same config-file + config-file format, and also allows restricting
Xserver execution (through the wrapper) to console users only.

There also is a new needs_root_rights config file directive, which can
be used to override the auto-detection the wrapper does.

Hopefully this will allow Debian to replace their own wrapper with this
upstream one.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
config_odev*: Use XNF alloc functions

config_odev* functions are called in code-paths were we already use
XNF* functions in other places, so which are not oom safe already.

Besides that oom is something which should simply never happen, so aborting
when it does is as good a response as any other.

While switching to XNF functions also fixup an unchecked strdup case.

Note the function prototypes are kept unchanged, as they are part of the
server ABI.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Remove config_odev_add_*attribute checks in various places

Note that there are more callers but those were already not doing any
error checking.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
systemd_logind_find_info_ptr_by_devnum: Add a start argument

Modify systemd_logind_find_info_ptr_by_devnum to take a start argument, so
that it can be used to find all occurences of a devnum in an InputInfo list,
rather then just the first.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
systemd_logind_find_info_ptr_by_devnum: Move to higher inside the file

This is a preparation patch for adding support for server managed fds
for InputDevices where multiple input devices share the same device node (and
thus also their major and minor).

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
systemd-logind: Add a systemd_logind_set_input_fd_for_all_devs helper

And use it where appropriate.

Setting the fd for all matching InputDevices is necessary when we've
multiple InputDevices sharing a single device-node, such as happens with
Wacom tablets.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
systemd-logind: Correctly deal with InputDevs sharing a device-node

InputDevices may share a single device-node, this happens ie with Wacom
tablets.

This patch makes take_fd and release_fd properly deal with this, together
with the earlier patch for updating the fd in all matching xf86InputDevs
on pause / resume this completes support for such shared device-nodes.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
xf86Xinput: release server managed fd before removing the device from the list

So that the fd in use test in systemd_logind_release_fd works properly.

Note we cannot change the test inside systemd_logind_release_fd as it must
work for devices which were never added to the xf86InputDevs too.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
test: Don't add TEST_LDADD to list test

The list test case is always enabled, even if Xorg is disabled.
TEST_LDADD pulls in Xorg files which breaks linking when Xorg is disabled.
The list test doesn't need any libraries, so just remove list_LDADD.

Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Cc: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
os: Always compile ListenOnOpenFD() and export it

This function was written to allow the X server to inherit the listen
socket from launchd on OS X.  The code is not specific to OS X though
and will be useful for on-demand launched Xwayland servers.

Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
os: Add a mechanism to prevent creating any listen sockets

A socket-activated server will receive its listening sockets from the
parent process and should not create its own sockets.  This patch
introduces a NoListen flag that can be set by a DDX to prevent
the server from creating the sockets.  When NoListen is enabled, we
also disable the server lock checking, since the parent process is
responsible for checking the lock before picking the display name and
creating the sockets.

Signed-off-by: Kristian Høgsberg <krh@bitplanet.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
hw/xwin: Fix const discarded warning in winGenerateAuthorization()

Fix const discarded warning in winGenerateAuthorization() in !XCSECURITY case

In function ‘winGenerateAuthorization’:
hw/xwin/winauth.c:123:38: warning: passing argument 2 of ‘GenerateAuthorization’ discards ‘const’ qualifier from pointer target type [enabled by default]
hw/xwin/winauth.c:99:1: note: expected ‘char *’ but argument is of type ‘const char *’

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>
hw/xwin: Fix typo in comment

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Fix declaration after statement warning in ddxGiveUp()

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Use boolean AND rather than bitwise AND in WIN_POLLING_MOUSE_TIMER_ID

For clarity, use boolean AND rather than bitwise AND in
WIN_POLLING_MOUSE_TIMER_ID processing.

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Remove an unneeded include

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Consistently use 'L' for long int constants

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Use AllocDevicePair()

Use AllocDevicePair() rather than allocating Windows keyboard and pointer
devices individually.

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Remove prototype for non-existent winMWExtWMUpdateIcon()

winMWExtWMUpdateIcon() was removed in commit 527cf13135cfd279733060e0028bbfbe02be5167

Signed-off-by: Colin Harrison <colin.harrison@virgin.net>
Reviewed-by: Jon TURNEY <jon.turney@dronecode.org.uk>
hw/xwin: Add '@<WM_CLIENT_MACHINE>' to window name when it's useful to do so

Enhance GetWindowName() so it appends the result of XGetWMClientMachine() when
it is available and useful to do so

Add -hostintitle option to control this behaviour.  Add documentation for this
option to man page and -help text.

Also, fix warning in UpdateName()

v2: Provide a HOST_NAME_MAX definition for MinGW
v3: Use '@host' rather than ' (on host)'. Don't add host if it's already in the
title.

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Yaakov Selkowitz <yselkowitz@users.sourceforge.net>
Reviewed-by: Colin Harrison <colin.harrison@virgin.net>