[PATCH RFC] Xorg: Add a suid root wrapper
Hans de Goede
hdegoede at redhat.com
Wed Mar 5 07:51:52 PST 2014
With the recent systemd-logind changes it is possible to install the Xorg
binary without suid root rights and still have everything working as it
should *if* the user only has cards which are supported by kms.
This commit adds a little suid root wrapper, which is a bit weird, first we
strip the suid-root bit of the Xorg binary, and then we add a wrapper ?
The function of this wrapper is to see if a system still needs root-rights,
if it does not (it supports kms and the kms drivers are properly loaded),
then it will immediately drop all elevated rights before executing the real
Xorg binary. If it finds (some) cards which don't support kms, or no cards
at all, then it will execute the Xorg server with elevated rights so that
ie the nvidia binary driver and the vesa driver can keep working normally.
To make it possible for security concious users who don't need the root
rights to completely remove the wrapper, Xorg is started in a 3 step process
when the wrapper is enabled during build time:
1) A simple shell script which checks if the wrapper is there, if it is
it executes the wrapper, if not it directly executes the real Xorg binary
2) The wrapper gets executed, does its checks, normally drops all elevated
rights and then executes the real Xorg binary
3) The real Xorg binary does its thing
This allows distributions to put the wrapper binary in a separate package, and
will allow users to remove this package. IE the plan with Fedora is to make
"legacy" drivers depend on the wrapper pkg, and since our default install
contains some legacy drivers it will be part of the default install, but
users can later yum remove it (which will also automatically remove the
legacy driver packages as those won't work without it anyways).
Signed-off-by: Hans de Goede <hdegoede at redhat.com>
---
configure.ac | 6 ++++
hw/xfree86/Makefile.am | 12 ++++++-
hw/xfree86/Xorg.sh | 13 ++++++++
hw/xfree86/xorg-wrapper.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 112 insertions(+), 1 deletion(-)
create mode 100644 hw/xfree86/Xorg.sh
create mode 100644 hw/xfree86/xorg-wrapper.c
diff --git a/configure.ac b/configure.ac
index 588ae59..5e96911 100644
--- a/configure.ac
+++ b/configure.ac
@@ -627,6 +627,7 @@ AC_ARG_ENABLE(pciaccess, AS_HELP_STRING([--enable-pciaccess], [Build Xorg with p
AC_ARG_ENABLE(linux_acpi, AS_HELP_STRING([--disable-linux-acpi], [Disable building ACPI support on Linux (if available).]), [enable_linux_acpi=$enableval], [enable_linux_acpi=yes])
AC_ARG_ENABLE(linux_apm, AS_HELP_STRING([--disable-linux-apm], [Disable building APM support on Linux (if available).]), [enable_linux_apm=$enableval], [enable_linux_apm=yes])
AC_ARG_ENABLE(systemd-logind, AC_HELP_STRING([--enable-systemd-logind], [Build systemd-logind support (default: auto)]), [SYSTEMD_LOGIND=$enableval], [SYSTEMD_LOGIND=auto])
+AC_ARG_ENABLE(suid-wrapper, AC_HELP_STRING([--enable-suid-wrapper], [Build suid-root wrapper for legacy driver support on rootless xserver systems (default: no)]), [SUID_WRAPPER=$enableval], [SUID_WRAPPER=no])
dnl DDXes.
AC_ARG_ENABLE(xorg, AS_HELP_STRING([--enable-xorg], [Build Xorg server (default: auto)]), [XORG=$enableval], [XORG=auto])
@@ -922,6 +923,11 @@ if test "x$SYSTEMD_LOGIND" = xyes; then
fi
AM_CONDITIONAL(SYSTEMD_LOGIND, [test "x$SYSTEMD_LOGIND" = xyes])
+if test "x$SUID_WRAPPER" = xyes; then
+ SETUID="no"
+fi
+AM_CONDITIONAL(SUID_WRAPPER, [test "x$SUID_WRAPPER" = xyes])
+
if test "x$NEED_DBUS" = xyes; then
AC_DEFINE(NEED_DBUS, 1, [Enable D-Bus core])
fi
diff --git a/hw/xfree86/Makefile.am b/hw/xfree86/Makefile.am
index 9672904..d44d172 100644
--- a/hw/xfree86/Makefile.am
+++ b/hw/xfree86/Makefile.am
@@ -76,9 +76,14 @@ Xorg_DEPENDENCIES = $(LOCAL_LIBS)
Xorg_LDFLAGS = $(LD_EXPORT_SYMBOLS_FLAG)
+if SUID_WRAPPER
+bin_PROGRAMS += Xorg.wrap
+Xorg_wrap_SOURCES = xorg-wrapper.c
+endif
+
BUILT_SOURCES = xorg.conf.example
DISTCLEANFILES = xorg.conf.example
-EXTRA_DIST = xorgconf.cpp
+EXTRA_DIST = xorgconf.cpp Xorg.sh
# Without logdir, X will post an error on the terminal and will not start
install-data-local:
@@ -93,6 +98,11 @@ if INSTALL_SETUID
chown root $(DESTDIR)$(bindir)/Xorg
chmod u+s $(DESTDIR)$(bindir)/Xorg
endif
+if SUID_WRAPPER
+ mv $(DESTDIR)$(bindir)/Xorg $(DESTDIR)$(bindir)/Xorg.bin
+ ${INSTALL} -m 755 Xorg.sh $(DESTDIR)$(bindir)/Xorg
+ -chown root $(DESTDIR)$(bindir)/Xorg.wrap && chmod u+s $(DESTDIR)$(bindir)/Xorg.wrap
+endif
uninstall-local:
if CYGWIN
diff --git a/hw/xfree86/Xorg.sh b/hw/xfree86/Xorg.sh
new file mode 100644
index 0000000..3a2b34b
--- /dev/null
+++ b/hw/xfree86/Xorg.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+#
+# See if Xorg.wrap is installed and if it is execute it, otherwise execute
+# Xorg.bin directly. This allows distros to put the suid wrapper in a
+# separate package.
+
+canonical=$(readlink -f "$0")
+basedir=$(dirname "$canonical")
+if [ -x "$basedir"/Xorg.wrap ]; then
+ exec "$basedir"/Xorg.wrap "$@"
+else
+ exec "$basedir"/Xorg.bin "$@"
+fi
diff --git a/hw/xfree86/xorg-wrapper.c b/hw/xfree86/xorg-wrapper.c
new file mode 100644
index 0000000..93a5f15
--- /dev/null
+++ b/hw/xfree86/xorg-wrapper.c
@@ -0,0 +1,82 @@
+/*
+ * Copyright © 2014 Red Hat, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ * Author: Hans de Goede <hdegoede at redhat.com>
+ */
+
+#include <fcntl.h>
+#include <limits.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <drm/drm.h>
+
+#include "dix-config.h" /* For PROJECTROOT */
+
+int main(int argc, char *argv[])
+{
+ struct drm_mode_card_res res;
+ char buf[PATH_MAX];
+ int i, r, fd;
+ int kms_cards = 0;
+ int total_cards = 0;
+
+ for (i = 0; i < 16; i++) {
+ snprintf(buf, PATH_MAX, "/dev/dri/card%d", i);
+ fd = open(buf, O_RDWR);
+ if (fd == -1)
+ continue;
+
+ total_cards++;
+
+ memset(&res, 0, sizeof(struct drm_mode_card_res));
+ r = ioctl(fd, DRM_IOCTL_MODE_GETRESOURCES, &res);
+ if (r == 0 && res.count_connectors > 0)
+ kms_cards++;
+
+ close(fd);
+ }
+
+ /* If we've found cards, and all cards support kms, drop root rights */
+ if (total_cards && kms_cards == total_cards) {
+ gid_t realgid = getgid();
+ uid_t realuid = getuid();
+
+ if (setresgid(-1, realgid, realgid) != 0) {
+ perror("Could not drop setgid privileges. Aborting.");
+ exit(1);
+ }
+ if (setresuid(-1, realuid, realuid) != 0) {
+ perror("Could not drop setuid privileges. Aborting.");
+ exit(1);
+ }
+ }
+
+ snprintf(buf, PATH_MAX, "%s/bin/Xorg.bin", PROJECTROOT);
+ argv[0] = buf;
+ return execv(argv[0], argv);
+}
--
1.9.0
More information about the xorg-devel
mailing list