1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
From 14cee101882e65a57dcd66ea0f8399477b23ce7e Mon Sep 17 00:00:00 2001
Message-Id: <14cee101882e65a57dcd66ea0f8399477b23ce7e.1601082838.git-series.worldofpeace@protonmail.ch>
In-Reply-To: <7b94f980f2a099dd4b19b60c357cfcf5ff7ada6d.1601082838.git-series.worldofpeace@protonmail.ch>
References: <7b94f980f2a099dd4b19b60c357cfcf5ff7ada6d.1601082838.git-series.worldofpeace@protonmail.ch>
From: WORLDofPEACE <worldofpeace@protonmail.ch>
Date: Sat, 19 Oct 2019 13:26:05 +0200
Subject: [PATCH 2/7] drop inheritable
From: Tor Hedin Brønner <torhedinbronner@gmail.com>
Adapted from https://gitlab.gnome.org/GNOME/mutter/commit/c53c47ae123b03cc66044d2b846342123ecb3a01
We only want to drop inheritable though, to prevent the ambient set leaking further than gnome-shell.
---
config.h.meson | 3 +++
meson.build | 5 +++++
meson_options.txt | 6 ++++++
src/core/main.c | 10 ++++++++++
src/meson.build | 1 +
5 files changed, 25 insertions(+)
diff --git a/config.h.meson b/config.h.meson
index 0bab718..202fb7e 100644
--- a/config.h.meson
+++ b/config.h.meson
@@ -58,6 +58,9 @@
/* Xwayland applications allowed to issue keyboard grabs */
#mesondefine XWAYLAND_GRAB_DEFAULT_ACCESS_RULES
+/* Defined if libcap-ng is available */
+#mesondefine HAVE_LIBCAPNG
+
/* XKB base prefix */
#mesondefine XKB_BASE
diff --git a/meson.build b/meson.build
index 29d495b..86970df 100644
--- a/meson.build
+++ b/meson.build
@@ -35,6 +35,7 @@ libstartup_notification_req = '>= 0.7'
libcanberra_req = '>= 0.26'
libwacom_req = '>= 0.13'
atk_req = '>= 2.5.3'
+libcapng_req = '>= 0.7.9'
# optional version requirements
udev_req = '>= 228'
@@ -125,6 +126,7 @@ xau_dep = dependency('xau')
ice_dep = dependency('ice')
atk_dep = dependency('atk', version: atk_req)
libcanberra_dep = dependency('libcanberra', version: libcanberra_req)
+libcapng_dep = dependency('libcap-ng', required: get_option('libcapng'))
# For now always require X11 support
have_x11 = true
@@ -256,6 +258,7 @@ have_core_tests = false
have_cogl_tests = false
have_clutter_tests = false
have_installed_tests = false
+have_libcapng = libcapng_dep.found()
if have_tests
have_core_tests = get_option('core_tests')
@@ -361,6 +364,7 @@ cdata.set('HAVE_LIBWACOM', have_libwacom)
cdata.set('HAVE_SM', have_sm)
cdata.set('HAVE_STARTUP_NOTIFICATION', have_startup_notification)
cdata.set('HAVE_INTROSPECTION', have_introspection)
+cdata.set('HAVE_LIBCAPNG', have_libcapng)
cdata.set('HAVE_PROFILER', have_profiler)
xkb_base = xkeyboard_config_dep.get_pkgconfig_variable('xkb_base')
@@ -443,6 +447,7 @@ output = [
' Startup notification..... ' + have_startup_notification.to_string(),
' Introspection............ ' + have_introspection.to_string(),
' Profiler................. ' + have_profiler.to_string(),
+ ' libcap-ng................ ' + have_libcapng.to_string(),
'',
' Tests:',
'',
diff --git a/meson_options.txt b/meson_options.txt
index 73aa7ad..8bfaacd 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -152,3 +152,9 @@ option('xwayland_grab_default_access_rules',
value: 'gnome-boxes,remote-viewer,virt-viewer,virt-manager,vinagre,vncviewer,Xephyr',
description: 'Comma delimited list of applications ressources or class allowed to issue X11 grabs in Xwayland'
)
+
+option('libcapng',
+ type: 'feature',
+ value: 'auto',
+ description: 'Enable libcap-ng support'
+)
diff --git a/src/core/main.c b/src/core/main.c
index 3935f35..ecf3cb2 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -66,6 +66,10 @@
#include <girepository.h>
#endif
+#ifdef HAVE_LIBCAPNG
+#include <cap-ng.h>
+#endif
+
#if defined(HAVE_NATIVE_BACKEND) && defined(HAVE_WAYLAND)
#include <systemd/sd-login.h>
#endif /* HAVE_WAYLAND && HAVE_NATIVE_BACKEND */
@@ -673,6 +677,12 @@ meta_run (void)
if (!meta_display_open ())
meta_exit (META_EXIT_ERROR);
+#ifdef HAVE_LIBCAPNG
+ capng_clear(CAPNG_SELECT_BOTH);
+ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_NICE);
+ capng_apply(CAPNG_SELECT_BOTH);
+#endif
+
g_main_loop_run (meta_main_loop);
meta_finalize ();
diff --git a/src/meson.build b/src/meson.build
index 90d8073..a9fffa2 100644
--- a/src/meson.build
+++ b/src/meson.build
@@ -18,6 +18,7 @@ mutter_pkg_deps = [
glib_dep,
gsettings_desktop_schemas_dep,
gtk3_dep,
+ libcapng_dep,
pango_dep,
]
--
git-series 0.9.1
|
