From patchwork Tue Sep 23 22:51:42 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Randolph Sapp X-Patchwork-Id: 70840 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 157C2CAC5A5 for ; Tue, 23 Sep 2025 22:52:24 +0000 (UTC) Received: from lelvem-ot02.ext.ti.com (lelvem-ot02.ext.ti.com [198.47.23.235]) by mx.groups.io with SMTP id smtpd.web11.2102.1758667938423214933 for ; Tue, 23 Sep 2025 15:52:18 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@ti.com header.s=ti-com-17Q1 header.b=Y6HMViVb; spf=pass (domain: ti.com, ip: 198.47.23.235, mailfrom: rs@ti.com) Received: from fllvem-sh03.itg.ti.com ([10.64.41.86]) by lelvem-ot02.ext.ti.com (8.15.2/8.15.2) with ESMTP id 58NMq9mL1569355; Tue, 23 Sep 2025 17:52:09 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1758667929; bh=7ctlQmke/b3VQcRev+Llh6s3xJHfHuyvpy8TLbXSvIw=; h=From:To:CC:Subject:Date:In-Reply-To:References; b=Y6HMViVbJbifXGHvHBO1i4sWAFeB//o4nVVvd9SycDUrR8dL35Q1cO69biUI406GD btjz4hwFd6KsezxWtM1LJgBT+LJlEM1BFnt2Ey6Xo7y89lFnsH8ZEzhcBhnQ6kBTMT /wwhX/Pj4fEmmk4ZH3n4reVAYcE5x2f+UMSUMGDc= Received: from DLEE109.ent.ti.com (dlee109.ent.ti.com [157.170.170.41]) by fllvem-sh03.itg.ti.com (8.18.1/8.18.1) with ESMTPS id 58NMq9E32303661 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=FAIL); Tue, 23 Sep 2025 17:52:09 -0500 Received: from DLEE212.ent.ti.com (157.170.170.114) by DLEE109.ent.ti.com (157.170.170.41) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2507.55; Tue, 23 Sep 2025 17:52:08 -0500 Received: from lelvem-mr06.itg.ti.com (10.180.75.8) by DLEE212.ent.ti.com (157.170.170.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.20 via Frontend Transport; Tue, 23 Sep 2025 17:52:08 -0500 Received: from rs-desk.dhcp.ti.com (rs-desk.dhcp.ti.com [128.247.81.144]) by lelvem-mr06.itg.ti.com (8.18.1/8.18.1) with ESMTP id 58NMq8TM750856; Tue, 23 Sep 2025 17:52:08 -0500 From: To: , , , , CC: , , , , , Subject: [oe-core][PATCHv10 6/7] xserver-nodm-init: convert to virtual-emptty-conf Date: Tue, 23 Sep 2025 17:51:42 -0500 Message-ID: <20250923225150.2407390-7-rs@ti.com> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20250923225150.2407390-1-rs@ti.com> References: <20250923225150.2407390-1-rs@ti.com> MIME-Version: 1.0 X-C2ProcessedOrg: 333ef613-75bf-4e12-a4b1-8e3623f5dcea List-Id: X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 23 Sep 2025 22:52:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/223930 From: Randolph Sapp Convert this script package into a simple config for emptty. This is capable of using either the root user or the underprivileged xuser account based on the same ROOTLESS_X variable. The xuser will leverage the nopasswdlogin session provided by emptty for automatic logins. Runtime provide virtual-emptty-conf as we need to set parameters for the default session. This also gets rid of the xuser security/capability override since emptty sets up required components as root before descending into the specified user. This does not currently handle loading of autostart applications in "/etc/xdg/autostart". This explicitly removes rooted x11 support for security related issues, as this recipe has always automatically setup passwordless login for the specified account. This was particularly useful for the underprivileged xuser account, but is quickly a problem for the root user. See the following discussion for additional information: https://lists.openembedded.org/g/openembedded-core/topic/115318655#msg223906 License-Update: GPLv2 scripts were replaced with MIT based config files Signed-off-by: Randolph Sapp --- meta/conf/distro/include/maintainers.inc | 4 +- meta/lib/oeqa/runtime/cases/xorg.py | 8 + .../x11-common/xserver-nodm-init/X11/Xsession | 38 -- .../X11/Xsession.d/13xdgbasedirs.sh | 19 - .../X11/Xsession.d/89xdgautostart.sh | 7 - .../X11/Xsession.d/90XWindowManager.sh | 7 - .../x11-common/xserver-nodm-init/Xserver | 25 -- .../xserver-nodm-init/capability.conf | 2 - .../xserver-nodm-init/default.desktop | 5 + .../xserver-nodm-init/emptty.conf.in} | 8 +- .../xserver-nodm-init/gplv2-license.patch | 355 ------------------ .../x11-common/xserver-nodm-init/xserver-nodm | 75 ---- .../xserver-nodm-init/xserver-nodm.conf.in | 7 - .../xserver-nodm-init/xserver-nodm.service.in | 11 - .../x11-common/xserver-nodm-init_3.0.bb | 64 +--- .../user-creation/xuser-account_0.1.bb | 3 +- 16 files changed, 35 insertions(+), 603 deletions(-) delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession.d/13xdgbasedirs.sh delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession.d/89xdgautostart.sh delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession.d/90XWindowManager.sh delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/Xserver delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/capability.conf create mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/default.desktop copy meta/recipes-graphics/{wayland/weston-init/emptty.conf => x11-common/xserver-nodm-init/emptty.conf.in} (95%) delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/gplv2-license.patch delete mode 100755 meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.conf.in delete mode 100644 meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.service.in diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.inc index db5e2fa9c9..621bf32066 100644 --- a/meta/conf/distro/include/maintainers.inc +++ b/meta/conf/distro/include/maintainers.inc @@ -926,12 +926,12 @@ RECIPE_MAINTAINER:pn-xorgproto = "Unassigned " RECIPE_MAINTAINER:pn-xprop = "Unassigned " RECIPE_MAINTAINER:pn-xrandr = "Unassigned " RECIPE_MAINTAINER:pn-xrestop = "Unassigned " -RECIPE_MAINTAINER:pn-xserver-nodm-init = "Unassigned " +RECIPE_MAINTAINER:pn-xserver-nodm-init = "Randolph Sapp " RECIPE_MAINTAINER:pn-xserver-xf86-config = "Unassigned " RECIPE_MAINTAINER:pn-xserver-xorg = "Unassigned " RECIPE_MAINTAINER:pn-xset = "Unassigned " RECIPE_MAINTAINER:pn-xtrans = "Unassigned " -RECIPE_MAINTAINER:pn-xuser-account = "Unassigned " +RECIPE_MAINTAINER:pn-xuser-account = "Randolph Sapp " RECIPE_MAINTAINER:pn-xvinfo = "Unassigned " RECIPE_MAINTAINER:pn-xwayland = "Unassigned " RECIPE_MAINTAINER:pn-xwininfo = "Unassigned " diff --git a/meta/lib/oeqa/runtime/cases/xorg.py b/meta/lib/oeqa/runtime/cases/xorg.py index 09afb1e3d1..8593be5b77 100644 --- a/meta/lib/oeqa/runtime/cases/xorg.py +++ b/meta/lib/oeqa/runtime/cases/xorg.py @@ -20,4 +20,12 @@ class XorgTest(OERuntimeTestCase): status, output = self.target.run(cmd) msg = ('Xorg does not appear to be running %s' % self.target.run(self.tc.target_cmds['ps'])[1]) + + # dump last 20 lines of emptty log in case of failure + log_cmd = 'tail -n 20 /var/log/emptty/7.log' + msg += '\n\n===== start: snippet =====\n\n' + msg += 'file: /var/log/emptty/7.log\n\n' + msg += '\n\n%s\n\n' % self.target.run(log_cmd)[1] + msg += '\n\n===== end: snippet =====\n\n' + self.assertEqual(status, 0, msg=msg) diff --git a/meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession b/meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession deleted file mode 100644 index 0b73127ae1..0000000000 --- a/meta/recipes-graphics/x11-common/xserver-nodm-init/X11/Xsession +++ /dev/null @@ -1,38 +0,0 @@ -#!/bin/sh - -if [ -x /usr/bin/dbus-launch ]; then - # As this is the X session script, always start a new DBus session. - eval `dbus-launch --sh-syntax --exit-with-session -+ Copyright (C) -+ -+ This program is free software; you can redistribute it and/or modify -+ it under the terms of the GNU General Public License as published by -+ the Free Software Foundation; either version 2 of the License, or -+ (at your option) any later version. -+ -+ This program is distributed in the hope that it will be useful, -+ but WITHOUT ANY WARRANTY; without even the implied warranty of -+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ GNU General Public License for more details. -+ -+ You should have received a copy of the GNU General Public License along -+ with this program; if not, write to the Free Software Foundation, Inc., -+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -+ -+Also add information on how to contact you by electronic and paper mail. -+ -+If the program is interactive, make it output a short notice like this -+when it starts in an interactive mode: -+ -+ Gnomovision version 69, Copyright (C) year name of author -+ Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. -+ This is free software, and you are welcome to redistribute it -+ under certain conditions; type `show c' for details. -+ -+The hypothetical commands `show w' and `show c' should show the appropriate -+parts of the General Public License. Of course, the commands you use may -+be called something other than `show w' and `show c'; they could even be -+mouse-clicks or menu items--whatever suits your program. -+ -+You should also get your employer (if you work as a programmer) or your -+school, if any, to sign a "copyright disclaimer" for the program, if -+necessary. Here is a sample; alter the names: -+ -+ Yoyodyne, Inc., hereby disclaims all copyright interest in the program -+ `Gnomovision' (which makes passes at compilers) written by James Hacker. -+ -+ , 1 April 1989 -+ Ty Coon, President of Vice -+ -+This General Public License does not permit incorporating your program into -+proprietary programs. If your program is a subroutine library, you may -+consider it more useful to permit linking proprietary applications with the -+library. If this is what you want to do, use the GNU Lesser General -+Public License instead of this License. diff --git a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm b/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm deleted file mode 100755 index 116bb278bc..0000000000 --- a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm +++ /dev/null @@ -1,75 +0,0 @@ -#!/bin/sh -# -### BEGIN INIT INFO -# Provides: xserver -# Required-Start: $local_fs $remote_fs dbus -# Required-Stop: $local_fs $remote_fs -# Default-Start: 5 -# Default-Stop: 0 1 2 3 6 -### END INIT INFO - -killproc() { # kill the named process(es) - pid=`/bin/pidof $1` - [ "$pid" != "" ] && kill $pid -} - -read CMDLINE < /proc/cmdline -for x in $CMDLINE; do - case $x in - x11=false) - echo "X Server disabled" - exit 0; - ;; - esac -done - -case "$1" in - start) - . /etc/profile - - #default for USER - . /etc/default/xserver-nodm - echo "Starting Xserver" - if [ "$USER" != "root" ]; then - # setting for rootless X - chmod o+w /var/log - chmod g+r /dev/tty[0-3] - # hidraw device is probably needed - if [ -e /dev/hidraw0 ]; then - chmod o+rw /dev/hidraw* - fi - # Make sure that the Xorg has the cap_sys_admin capability which is - # needed for setting the drm master - if ! grep -q "^auth.*pam_cap\.so" /etc/pam.d/su; then - echo "auth optional pam_cap.so" >>/etc/pam.d/su - fi - if ! /usr/sbin/getcap $XSERVER | grep -q cap_sys_admin; then - /usr/sbin/setcap cap_sys_admin+eip $XSERVER - fi - fi - - # Using su rather than sudo as latest 1.8.1 cause failure [YOCTO #1211] - su -l -c '/etc/xserver-nodm/Xserver &' $USER - # Wait for the desktop to say its finished loading - # before loading the rest of the system - # dbus-wait org.matchbox_project.desktop Loaded - ;; - - stop) - echo "Stopping XServer" - killproc xinit - sleep 1 - chvt 1 & - ;; - - restart) - $0 stop - $0 start - ;; - - *) - echo "usage: $0 { start | stop | restart }" - ;; -esac - -exit 0 diff --git a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.conf.in b/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.conf.in deleted file mode 100644 index 4a9670d8d2..0000000000 --- a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.conf.in +++ /dev/null @@ -1,7 +0,0 @@ -# common environment file for sysvinit and systemd - -XSERVER=/usr/bin/Xorg -DISPLAY=:0 -ARGS=" -br -pn @BLANK_ARGS@ @NO_CURSOR_ARG@ " -HOME=@HOME@ -USER=@USER@ diff --git a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.service.in b/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.service.in deleted file mode 100644 index 87dc4f8fcd..0000000000 --- a/meta/recipes-graphics/x11-common/xserver-nodm-init/xserver-nodm.service.in +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Xserver startup without a display manager - -[Service] -EnvironmentFile=/etc/default/xserver-nodm -User=@USER@ -ExecStart=/etc/xserver-nodm/Xserver -Restart=always - -[Install] -Alias=display-manager.service diff --git a/meta/recipes-graphics/x11-common/xserver-nodm-init_3.0.bb b/meta/recipes-graphics/x11-common/xserver-nodm-init_3.0.bb index 169269eefb..1fc10159e8 100644 --- a/meta/recipes-graphics/x11-common/xserver-nodm-init_3.0.bb +++ b/meta/recipes-graphics/x11-common/xserver-nodm-init_3.0.bb @@ -1,25 +1,16 @@ SUMMARY = "Simple Xserver Init Script (no dm)" -LICENSE = "GPL-2.0-only" -LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420" SECTION = "x11" -SRC_URI = "file://xserver-nodm \ - file://Xserver \ - file://X11 \ - file://gplv2-license.patch \ - file://xserver-nodm.service.in \ - file://xserver-nodm.conf.in \ - file://capability.conf \ -" +SRC_URI = "file://emptty.conf.in \ + file://default.desktop" S = "${UNPACKDIR}" -# Since we refer to ROOTLESS_X which is normally enabled per-machine -PACKAGE_ARCH = "${MACHINE_ARCH}" +inherit features_check -inherit update-rc.d systemd features_check - -REQUIRED_DISTRO_FEATURES = "x11 ${@oe.utils.conditional('ROOTLESS_X', '1', 'pam', '', d)}" +REQUIRED_DISTRO_FEATURES = "x11 pam" PACKAGECONFIG ??= "blank" # dpms and screen saver will be on only if 'blank' is in PACKAGECONFIG @@ -27,45 +18,18 @@ PACKAGECONFIG[blank] = "" PACKAGECONFIG[nocursor] = "" do_install() { - install -d ${D}${sysconfdir}/default - install xserver-nodm.conf.in ${D}${sysconfdir}/default/xserver-nodm - install -d ${D}${sysconfdir}/xserver-nodm - install Xserver ${D}${sysconfdir}/xserver-nodm/Xserver - install -d ${D}${sysconfdir}/X11/Xsession.d - install X11/Xsession.d/* ${D}${sysconfdir}/X11/Xsession.d/ - install X11/Xsession ${D}${sysconfdir}/X11/ + install -D -p -m0644 ${S}/emptty.conf.in ${D}${sysconfdir}/emptty/conf + install -D -p -m0644 ${S}/default.desktop ${D}${datadir}/xsessions/default.desktop BLANK_ARGS="${@bb.utils.contains('PACKAGECONFIG', 'blank', '', '-s 0 -dpms', d)}" NO_CURSOR_ARG="${@bb.utils.contains('PACKAGECONFIG', 'nocursor', '-nocursor', '', d)}" - if [ "${ROOTLESS_X}" = "1" ] ; then - XUSER_HOME="/home/xuser" - XUSER="xuser" - install -D capability.conf ${D}${sysconfdir}/security/capability.conf - sed -i "s:@USER@:${XUSER}:" ${D}${sysconfdir}/security/capability.conf - else - XUSER_HOME=${ROOT_HOME} - XUSER="root" - fi - sed -i "s:@HOME@:${XUSER_HOME}:; s:@USER@:${XUSER}:; s:@BLANK_ARGS@:${BLANK_ARGS}:" \ - ${D}${sysconfdir}/default/xserver-nodm - sed -i "s:@NO_CURSOR_ARG@:${NO_CURSOR_ARG}:" ${D}${sysconfdir}/default/xserver-nodm - - if ${@bb.utils.contains('DISTRO_FEATURES','systemd','true','false',d)}; then - install -d ${D}${systemd_system_unitdir} - install -m 0644 ${S}/xserver-nodm.service.in ${D}${systemd_system_unitdir}/xserver-nodm.service - sed -i "s:@USER@:${XUSER}:" ${D}${systemd_system_unitdir}/xserver-nodm.service - fi - if ${@bb.utils.contains('DISTRO_FEATURES','sysvinit','true','false',d)}; then - install -d ${D}${sysconfdir}/init.d - install xserver-nodm ${D}${sysconfdir}/init.d - fi + sed -i "s:@NO_CURSOR_ARG@:${NO_CURSOR_ARG}:" ${D}${sysconfdir}/emptty/conf + sed -i "s:@BLANK_ARGS@:${BLANK_ARGS}:" ${D}${sysconfdir}/emptty/conf } -RDEPENDS:${PN} = "xinit ${@oe.utils.conditional('ROOTLESS_X', '1', 'xuser-account libcap libcap-bin', '', d)}" - -INITSCRIPT_NAME = "xserver-nodm" -INITSCRIPT_PARAMS = "start 9 5 . stop 20 0 1 2 3 6 ." -SYSTEMD_SERVICE:${PN} = "xserver-nodm.service" +FILES:${PN} = "${sysconfdir}/emptty/conf \ + ${datadir}/xsessions/default.desktop" -RCONFLICTS:${PN} = "xserver-common (< 1.34-r9) x11-common" +RDEPENDS:${PN} = "emptty xuser-account" +RPROVIDES:${PN} += "virtual-emptty-conf" diff --git a/meta/recipes-support/user-creation/xuser-account_0.1.bb b/meta/recipes-support/user-creation/xuser-account_0.1.bb index 04f506e7a3..f1e4cb674f 100644 --- a/meta/recipes-support/user-creation/xuser-account_0.1.bb +++ b/meta/recipes-support/user-creation/xuser-account_0.1.bb @@ -24,7 +24,8 @@ FILES:${PN} = "${sysconfdir}/dbus-1/system.d/system-xuser.conf" USERADD_PACKAGES = "${PN}" USERADD_PARAM:${PN} = "--create-home \ - --groups video,tty,audio,input,shutdown,disk \ + --groups video,tty,audio,input,shutdown,disk,nopasswdlogin \ --user-group xuser" +GROUPADD_PARAM:${PN} = "-r nopasswdlogin" ALLOW_EMPTY:${PN} = "1"