Bestand wählen
Merken

Making the X-server run without root rights

Zitierlink des Filmsegments
Embed Code

Automatisierte Medienanalyse

Beta
Erkannte Entitäten
Sprachtranskript
I will prove that I recently transferred from into the repetition and I have been
working for about the last 6 weeks on getting the X server to run without provides which is something that I you she test so these are the 2 data topics
which I plan to discuss and hopefully will have some time for questions at the end the 1st question is why uh this is sort of a mandatory question I hope no 1 really seriously also tried but for
those who as the accelerator is traditionally and then route because back in the old days when we all 486 machines and records for them from the space userspace setting and we need a direct hardware access and the direct hardware access and means you need to be routes to make sure system goals like the I O P coal which is you I operations we plotted the X server is a quite large complicated body of cold and having that run as root is security wise not really something which we want and the comments on what works is not done in the space so we know what have a really need each other to the so this hopefully for those who were wondering why would you want to do that monthly for security reasons what do we need we need
access to death input events and and the device notes in the meteorite Cox devices which are currently open only to work most of the time we need to do a couple of the TIR calls for duties which which into text mode of switching between different ICT services which are running out into integral to walk somewhere and our current default locations from Don so what the dependencies induced by Texas by the price axis so this typically means there for input noted typically restricted and because of what exactly talking you don't want have a multi-seat system were usually remotely be able to so listen to what someone else's typing on a keyboard I just to write you mechanisms induced because look at knowledge on through system the love and the way we at devices in the database would you access attributes and then automatically to divide can opened up the problem is for user for users who were present behind will because of physical columns so something which is local to the machine I have that's not enough you set laughter which is necessary for promoting requires right it's 800 permission of the height of his not enough it will still not allow you to make a call have and some sort of armature is necessary for input devices because if you are doing of FontStudio you switching so switching between users I will not 1 physical and then I want to read from the input axis to the observer which is running on behalf of the user which is stepping away from the machine so that it will not be able to eavesdrop on other people's all the time this so uh these 2 reasons are I just using you access exist none of have created the moment people have the same problem and have been thinking about a solution for this is a sort of I'm sort of building on top of things military down for Windows here I don't care what it with a new API of part of system you have an ecosystem along the already justifies management and the management etc. which starts with the take control which makes use session over and then you can also take control various devices which are attached to the action which that session is you active session the so this assuming we modify the exorbitant use this API and get file descriptors overdue goes from system the lab data service solved problems so I is is not inside X and
I have a couple of API and that's also in the changes coming up for for drivers which informed for us something could Michael should remain as follows the because each server will be managing the films that the device note instead of the device from doing it on it so I have a bringing its for input from probe function for video food because there are different from functions for video cards and that of the past and current character I feature of if system server managed and these are active this is also optional people don't need to worry that this is going to become mandatory at least not in the near future we also need to still have the server running on so hours and what this is all optional asset that gravity and if it's a video gravity and he will already in India must the the the of the slightly the trachea area is switching between teach right you know you have a picture running of the Kuala 57 depend on district against which to explore the can even run multiple external from different cities the tea leaves actually pretty easy but because basically had taken out and uh we can use interview you can process the keynote that means that the gene before control in in in Linux service is put in a special moment where I even if you use AUC accommodation to switch away you won't but switched to immediately instead the process gets a signal from a girl I want you to go away from this treaty and process in this case the server has all the time to do on looking up but needs to do so you can show that although the flight to safety device state for the GPU and what what's not and that it can signal the kernel OK you can continue we using this is in excellent because I otherwise there's way too much code to all this too soon come to something which is safe for asynchronous switching I going to raise at the start of this year will do and drop off the devices and look for input devices it will close them because they get revoked and offered at the use of graffiti which but that's what happened after the normal the the decoders run etc. so nothing much changes for drivers here the and he and the story is slightly more complicated because we
that a signal from a kernel at the same time that system the lock and gets a signal from the kernel that our thinking is becoming active all only in case we use to just as soon as we got the signal from the kernel on the gentleman we would start we initialize GPU and what's not of new opening input device notes etc. we can do that because they're being I want to ask my system like the new nation values manner so what we do is we need for a system the magnitude of the deepest signals over which is passes new evidence for input devices and signals that is had has returned in the Mosul mode for video devices we 1st need for the video device notes to be the most remote to be resumed consistently love and herbs and if a any time you already get some obstacle for input devices we put those on the list we remember that those need to be resumed later I don't that the right so we put a few little video and the handling we were always doing so it went from a driver point of view the East model while changing the driver should cold Travelmaster itself on the calls at Moffett itself on enter but that's pretty much all the changes at the bottom level of input devices that if the input devices are right after we got the key and the handling division later don't just so reading them immediately just like we really enable the enable them immediately also work if you have animals or whatever the so that concludes the parts of the the driver API changes were necessary etc. and the problem with opening titles between that and the problem which we want to keep using the due process mode so we need to be able to make a number of EDI orbitals actually this is allowed to do without rights if you are not in the same session ID as the active session as in process management in the media for all sessions of which is controlled by the teacher the man that occur all but so the you the Server puts itself in a new session ID attaches itself or its control so we need to start doing that if you want to be able to run as number because you can only make it it tells if you're items where you are in the same session ID as the controlling the TI the this is again pretty simple like this and so now all that had to be constantly the right to follow we cannot do that as a normal user so that 2 solutions we which will probably but get implementation distributions can choose if they want to enable this how do we use it I would like to learn to uh the the and placed on the 103 the which by the usual this extension data home directory which is sort of default standard for loving inside 100 trees and the other 1 is the web directly to draw the as some people may ask why not use such work because she's looking easier way to get to journal and may also be useful in our scenarios approximated the cis lock the system call is not safe to call from within a signal and and the directly from within signal and because people dial was driven to take us inside each the and that's not a problem for this Leonard has already been reviewing patches to make some during the system goals signal say no you know where those pictures are coming from I am so as I said before they are all we need to available to yeah its server needs to have a control EDI that means
that did the manager needs to do slightly more work because so far display managers have been cut a lot of quarters induced trusting rather than what we started the observer invalid user session but in the typical sense of then etc. so it's hard to know who to the least API to control session we have to be inside a proper user sessions so this statement is willing to change things like GTM and KDD unlikely a similar data needs to stocks excited about user session so that will be for some of you profession said the then session in for a session make sure to conform TDI is is set up right and the best part of it working side it is also means that this managers will need to start its work twice could lead static work has rooms that it starts uh the log screen added units user and after that it uses the same sort forever to start a new research it would need to start its work twice that once to flow of weapons screening once that's done it into terror down and she started up again as a regular user send work will be needed to maybe make a transition must not be ugly the and actually did this managers who want to redirect its work what somewhere assuming we're not just going to end up using the journal for the and this no I don't like you might the answer to this question what to do about user-space monumentally rights because there are still a couple around it's just killed them kill them with fire I am will but I'm afraid that will be an acceptable answer to some of our users so we need to come up with something else at the 1st option is probably well as well be doing somewhere in the next week's Edison you engage ever which is completely makes no sense I'm killing its ordering as roots and now I'm adding a the river and that's probably the easiest way I can make it pretty safe it can just check if there's a kernel modes having capable cotton if there is 1 it will just toppled right immediately 1020 lines of C code which hopefully our any all of to be safe that was lost words and the answer is that criminal motoring got then it will just and safe world the this kind of optional so before this or I can envision this coming in some sort of separate RPM Package for Debian packages users can remove it or maybe the Moldovan shifted by default but for the future but it would be interesting to use a simple theorem I possibly something which and determine that a better presentation before it's actually part of the stuff he did for my request it's the number of pages and effect but the driver having condition would usually not very framebuffer to actually use the fat meals to set of them from before and from simple dierent up to make the inescapable and use that as outputs on and she's which don't have a part which is support america almost 34 this result monthly ID so I'm very much open to discussion suggestions here so that no where you know you have been watching it the this
is so this is why so I walk before I show that this is you have been watching it there is 1 thing so can internalize Jesse in the room itself and this is the minimum number we need to look into that loop of wire that does that but at the end but and it's it's actually whoever it's not just the same this I also lose the capability to perform I might as well as the creation new way of I have no idea and hopefully Jesse Weston time to discuss this with all of the the final change and that requires only 1 would be on the side of the ideas have of what we have here really good thank you for this you have the right to life and you know I suggest you just don't know you you ideas like this thing is that we can do with your active control on the on the left and the have advised so the program is very i at time you can hear this summer you know the people in the world and of the book the head of that how that is is we just opened workers control for the world maybe they know it's it's just the filling from the perspective of says that there is no option to open the have a lot of the rest of the properties of fear that we're having been there like discussing mentation options I haven't said about this year because only noticed is when I was preparing this demo to to call it that way but this the you in so you have a question about the plan reflects how I going to handle the lights in here and when they peck that device is different from the chief you like this make book has some separate ship that's not in any way as size no relate cheat you do rich year-end devised feeling that the answer to that as I have no clue as I said before I noticed this like 3 minutes ago and adjustment this would be a good audience dimension to it may that somebody's with so as to show this is needed that over here you see my the 2nd line this is my explosives and it's running as user Holmes and I could have done inside FIR digital graphical love and Ioss founded to 1 level tree which is not true because that using system you no longer have low levels of the fact that we set up a taxi seasonal items that it's on a PC and since at least the extent of it knows how to properly set up user session elected and I could use to study percentages works thank you yeah
so what we're very sort of fear anyway so that I don't know questions yeah how to put that in some very much do how link with this so that only question just there's something on dimension you you keep the the biologists to act so as and in the long run we hope to make x something that is actually for the use of us with means that from any TTY because of the signal that it's shared all such as those the user so that means that and it will not have right to be attached to it could that so there might be something to think about and it's it's a problem in the maybe do something special for X in the use of with the with the help of yeah the US of France session management problem you don't really need the external to run under the same user ID and the system that is running under its in the world that they did do implement suppression and explore is the when we start from our the reseller the the end just run and and never in user and that we must oversee works there is just this little program refer shared-memory segments that the new you know that this committee that you'll be so that to create the ceremony's investor for this at stuff to read so this problem to yeah I guess we could do something where remaking extroversion UID again that make it said you to another user I. while ago how useful that is because any program capable of the technique server will very likely already running inside a user session so it already has the same rights as its so why wouldn't bother with 2nd of it's just to sort of the issues of from monitoring to restart operates so between the in the discriminative the process you can just I'm just I'm URI view on on the and that's not going to work which system need of and integration system we love and you want to see its process as part of the session otherwise it won't allow it to take control of the various devices it will allow it to open your mouth it will allow it to open your keyboard because the user who is and the x of the active user for that is the only 1 was allowed to open a keyboard and mouse as it is something that he had systems etc. that just won't work what you're suggesting need something smart the they wait for my case otherwise the video people become unhappy if we don't have to use the mean of you to do that the you really think that the part of me if I got the right uh it will be impossible to you've lethal rule to its all system there 4 or in front of you if you like the grammar where read through the reeve people removable but said I will keep things working in the old fashioned for some hours and whatever and this is a war optional but you need to be Melanie that's district will you will even if you don't want to use system you will need system 11 the anyways everything is moving to system involving the consul could is that no 1 is maintaining so you need to figure out something like this which the system during it's just better just to quickly mention that the a lot of has been part of the people to non-system the however the the take controls that's like the the other access control that some of to that west because video and here so good luck FIL more questions the you the seems like that as your talk the guess 20 minutes yes you you know they have to fill the slots now right on the consensus about where a lot of devices and something that's the reserved for tomorrow so that the idea that the faster than I expected what are it's not in order to start the next server for the GTM log in could indicate that running and have if a user wants to log in to switch to the server the server turn it down and start a new 1 there's actually what we're doing today and what we want to get rid of because uh the way system the lab and he works is that of a certain user is the machine as your the exceptional have and that 1 the only 1 which is allowed to open things like the keyboard and mouse and even if the process can keep a file descriptor opening of the regression Kyoko will be done those cells provide system and as soon as another session with objective session on that so the external could programming and computer found descriptors but it can no longer do anything with the files proposed including reading from them to get so it's just won't work as far as I know there coming up to my neck spectrum from these the the so of course uh result like question which is if you have the acts of the mind of the uh or for the whole section on you make sure that the vector that we have the same problem already when we go from the Budapest ring to expand or when we switch on between multiple consuls we want the 2nd would them because we understand when the same model where you will have 1 with them for developing manager in a separate waiting for this is something which needs to be said a graphics people maybe Witzel execrable API and just have some way to to get current content on the screen so the experience to be able to shut down without corrupting screen and wants to you will be getting all screen content and will fade over or whatever I don't think that her mom was thinking about infiltration were he still discussing you can read of the screen of work or that's that's a good point that maybe we need to have the X server which is dying fade to black and have been all along pick it up from there or given the 1 of the things I know you're thinking about all of the data in the army Yo userspace pages the interface defective black and the last thing you there has been based labels the Koran so if you meet some stupid stuff like you password the banking beat all the other you probe the key we keep everything around until next server picks it up and the so transition to whatever it wants to something like to display manager which knows that there will be no sensitive info on screen could even just keep deal content for transition that used to switch back to the text so these this assuming that there is no text-mode anymore is this restriction was sitting back to text mode of there's no worries 1 graphics gone if we only hear Biomed it's the last thing that can controls the overall steering device closes and everything dies we switch but forcefully switch back the act uh to have become the kernel on the assumption that just everything died and you actually want to write lobbying through weak tea and see what happens but as long as someone keeps open the hearer monster made some very of the mean of data so as long as your system longer in thing nor an ordinary session keep severe and devices and unnormalized is correct become the rule spread applies right the
and and the status of your work right now is that something that could be some of you tomorrow and we are do about what you have left to do lots tomorrow I have some review comes from the early on my 1st version of that set so I need to the work some cold but in about a week it should should be extended upstream of actually a lot of preparation patches or an upstream I had to split some functions of enormous Oriole tree so I had this this is actually going next major release of the service of 160 and the and and as you already have a mix of for regain full count that 1 keep running and just spend a new in all of the use of that that thing on a separate the key on whatever it's being caught kind among capture so opening a separate thinking requires revised yes but that's task for all of you will be repeated yeah i yes it is possible to keep the X server for the display Manager running on safety G 1 and put to use recession and 2 to 2 and then you could even just when you choose the fast users which option it could even be just a switch to video what this year was already waiting here that that's implementation the torso displacement it's even possible that will display manager chooses 1 model 1 another discipline adventures your model that wasn't what was to my question thank you and theories of committing heresy he did you think about it that binary can make this yes actually have already been in contact with the companies behind viagra directors and um of now it won't depending where we look for a Indian because a and is still being I O from user based after and slightly more promising than they also have some work to do for Fernando probably just fell into the category which is handled with whatever solution I come up with for a user of motor divided compatibility 1 of the things they I find the man have yes but here I am keeping an eye out for those drivers and trying to keep them to work somewhat so if the lower questions that I wish you a pleasant 2nd lunch break and the and the few so the next presentation has been canceled so yeah that makes for a long I don't know I don't know that of that you know that we the plane that of the reasons I got stuck here so you know that's that's the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the mass of the the the the the the the the the the the kind and the the the the the the the the the the the the the 2nd half of the course and the the the the the the the the the the the the the the mass the that thing the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the
the the the the the the the the the of the and the and the the the the the the the the the the the the the the the the right of the the the the the the right and the the the the the the thing the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the the
the the the the
the the the
the the the the the
the the the the the the the the
the the the the the the the
the the the the the the the the the
the the the the the
the the the thank
the the the
the the the the the
the right and the knowledge of
the mark the ARL ARL that
but it the the
the the
the the
the
the the
the the
the the the
the
the the
the the
the
the
the
the the
the the
the
the the the the the
the the
the
the the
the the the
the the
the
the
Zecchina ut the data yeah yeah a new
in and yeah
yeah but it it
Kernel <Informatik>
Server
Raum-Zeit
Computeranimation
Richtung
Virtuelle Maschine
Datensatz
Code
Computersicherheit
Wurzel <Mathematik>
Druckertreiber
Hardware
Softwaretest
Folge <Mathematik>
Nichtlinearer Operator
Hardware
Gerichtete Menge
Computersicherheit
Routing
Physikalisches System
Sichtenkonzept
Quick-Sort
Wurzel <Mathematik>
Login
Server
Gravitation
Server
Subtraktion
Prozess <Physik>
Momentenproblem
Mathematisierung
Gruppenoperation
Graphikkarte
Code
Computeranimation
Kernel <Informatik>
Videokonferenz
Virtuelle Maschine
Datenmanagement
Bildschirmfenster
Luenberger-Beobachter
Druckertreiber
Ereignishorizont
Default
Attributierte Grammatik
Lineares Funktional
Kraftfahrzeugmechatroniker
Schnelltaste
ATM
Datenhaltung
Gebäude <Mathematik>
Systemaufruf
Strömungsrichtung
Physikalisches System
Elektronische Publikation
Ein-Ausgabe
Knotenmenge
Quick-Sort
Ereignishorizont
Videokonferenz
Druckertreiber
Flächeninhalt
Wurzel <Mathematik>
Login
ATM
Ein-Ausgabe
Mereologie
Server
Gamecontroller
Decodierung
URL
Aggregatzustand
Resultante
Distributionstheorie
Prozess <Physik>
Punkt
Datensichtgerät
Computeranimation
Homepage
Kernel <Informatik>
Videokonferenz
Übergang
Netzwerktopologie
Einheit <Mathematik>
Datenmanagement
Theorem
Minimum
Wurzel <Mathematik>
Druckertreiber
Default
Gerade
Funktion <Mathematik>
Metropolitan area network
Caching
ATM
Befehl <Informatik>
Sichtenkonzept
Systemaufruf
Ein-Ausgabe
Knotenmenge
Web log
Konfiguration <Informatik>
Wurzel <Mathematik>
Rechter Winkel
Login
Konditionszahl
Ein-Ausgabe
Server
PCMCIA
Verzeichnisdienst
Schlüsselverwaltung
Standardabweichung
Server
Gruppenoperation
Mathematisierung
Implementierung
Zahlenbereich
Kombinatorische Gruppentheorie
Wrapper <Programmierung>
Division
Code
Benutzerbeteiligung
Informationsmodellierung
Luenberger-Beobachter
Maßerweiterung
Modallogik
Touchscreen
Soundverarbeitung
Trennungsaxiom
Orbit <Mathematik>
Mailing-Liste
Physikalisches System
Datenfluss
Quick-Sort
Videokonferenz
Patch <Software>
Druckertreiber
Offene Menge
Hydrostatischer Antrieb
Hypermedia
Mereologie
Gamecontroller
Wort <Informatik>
Größenordnung
Eigentliche Abbildung
Elektronischer Datenaustausch
Videospiel
Demo <Programm>
Kategorie <Mathematik>
Hausdorff-Dimension
sinc-Funktion
Güte der Anpassung
Automatische Handlungsplanung
Zahlenbereich
Physikalisches System
Computeranimation
Übergang
Konfiguration <Informatik>
Netzwerktopologie
Loop
Perspektive
Rechter Winkel
Digitalisierer
Gamecontroller
Optimierung
Maßerweiterung
Explosion <Stochastik>
Gerade
Schreib-Lese-Kopf
Sensitivitätsanalyse
Prozess <Physik>
Punkt
Datensichtgerät
Versionsverwaltung
Formale Grammatik
Computer
Zählen
Binärcode
Computeranimation
Homepage
Kernel <Informatik>
Videokonferenz
Netzwerktopologie
Monster-Gruppe
Datenmanagement
Lineare Regression
Kontrollstruktur
Metropolitan area network
Lineares Funktional
Schnelltaste
ATM
Sichtenkonzept
Kategorie <Mathematik>
Güte der Anpassung
Ruhmasse
Konfiguration <Informatik>
Motion Capturing
Arithmetisches Mittel
Rechter Winkel
Zellularer Automat
Ablöseblase
Server
Garbentheorie
Information
Ordnung <Mathematik>
Schlüsselverwaltung
Lesen <Datenverarbeitung>
Server
Hausdorff-Dimension
Gruppenoperation
Implementierung
Zellularer Automat
Kombinatorische Gruppentheorie
Punktspektrum
Physikalische Theorie
Task
Virtuelle Maschine
Informationsmodellierung
Unterring
Nominalskaliertes Merkmal
Inhalt <Mathematik>
Optimierung
Hilfesystem
Touchscreen
Schlussregel
Physikalisches System
Vektorraum
Binder <Informatik>
Elektronische Publikation
Quick-Sort
Ultimatumspiel
Integral
Objekt <Kategorie>
Patch <Software>
Druckertreiber
Displacement Mapping
Offene Menge
Mereologie
Gamecontroller
Rechter Winkel
Vorlesung/Konferenz
Open Source
Neunzehn
Hacker
Computeranimation
Gammafunktion
BEEP
Offene Menge
Open Source
Hacker
Computeranimation
Offene Menge
Open Source
Hacker
Computeranimation
Offene Menge
Open Source
Rechter Winkel
Hacker
Computeranimation
Offene Menge
Open Source
Hacker
Computeranimation
Meta-Tag
Normalvektor
Offene Menge
Open Source
Videospiel
Hacker
Computeranimation
Open Source
Unterring
Persönliche Identifikationsnummer
Hacker
Computeranimation
Offene Menge
Open Source
Videospiel
Hacker
Computeranimation
Offene Menge
Open Source
Hacker
Computeranimation
Offene Menge
Open Source
SLAM-Verfahren
Hacker
Computeranimation
Offene Menge
Open Source
Hacker
Computeranimation
Offene Menge
Open Source
Hacker
Computeranimation
Gammafunktion
Offene Menge
Open Source
Hacker
Computeranimation
Gesetz <Physik>
Offene Menge
Open Source
Likelihood-Quotienten-Test
Lie-Gruppe
Hacker
Computeranimation
Offene Menge
Open Source
Videospiel
Hacker
Computeranimation
BEEP
Offene Menge
Open Source
Bewegungsunschärfe
Hacker
Computeranimation
Offene Menge
Open Source
Einheit <Mathematik>
Hacker
Computeranimation
BEEP
Offene Menge
Open Source
Gewichtete Summe
Videospiel
Hacker
Computeranimation
Videokonferenz
Computeranimation

Metadaten

Formale Metadaten

Titel Making the X-server run without root rights
Serientitel FOSDEM 2014
Autor Goede, Hans de
Lizenz CC-Namensnennung 2.0 Belgien:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
DOI 10.5446/32572
Herausgeber FOSDEM VZW
Erscheinungsjahr 2014
Sprache Englisch

Inhaltliche Metadaten

Fachgebiet Informatik
Abstract Xorg (the X-server) is a big and complex beast. Currently it runs as root as it needs root privileges for various reasons. But with the latest systemd-logind all necessary infrastructure is in place to allow the server to run as a normal user and use systemd-logind to do input and graphics device management. This talk looks at the work being done to leverage this new infrastructure to run Xorg without root rights.

Ähnliche Filme

Loading...
Feedback