Split compositor sandbox from host-namespace login - #6
Merged
Merged
Conversation
Faceplate.service uses ProtectSystem=strict and RestrictAddressFamilies seccomp. Login shells forked from that unit inherit a read-only /run and cannot open AF_INET sockets. Hand the PTY slave to unsandboxed faceplate-host-login over SCM_RIGHTS so HDMI login matches a real getty.
Treat the helper as a getty, not a root exec proxy. Require SO_PEERCRED and a faceplate.service cgroup, accept only a Unix98 PTY slave, ignore client argv/environ, and fail closed if the helper is missing.
Lock in cgroup gating, fail-closed compositor spawn, ignored payload argv, and getty-shaped systemd settings so those checks cannot drift.
Guard GNU feature macros, handle write results, and apply the repository's clang-format-20 style so the hardened helper builds cleanly under -Werror.
Open the Unix98 PTY through POSIX APIs so the host-session tests do not resolve Faceplate's internal pty.h instead of the system declaration for openpty.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ProtectSystem=strictandRestrictAddressFamilieson the Faceplate compositor./bin/loginvia unsandboxedfaceplate-host-login(Unix socket + SCM_RIGHTS), because seccomp is inherited across fork and cannot be dropped withsetns./, TCP still blocked).This is the HDMI console bug where
ufwhitsEROFSon/run/ufw.lockandsshreportsAddress family not supported by protocolwhile the host mounts are actually writable.Test plan
meson testforfaceplate_host_sessionfindmnt /is rw,ufw statusworks,ssh 127.0.0.1can create AF_INET