Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vulkan-loader: fix search paths in suid processes #23003

Closed
wants to merge 1 commit into from

Conversation

Ralith
Copy link
Contributor

@Ralith Ralith commented Feb 19, 2017

Motivation for this change

Fixes #22990

Things done
  • Tested using sandboxing
    (nix.useSandbox on NixOS,
    or option build-use-sandbox in nix.conf
    on non-NixOS)
  • Built on platform(s)
    • NixOS
    • macOS
    • Linux
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Fits CONTRIBUTING.md.

@mention-bot
Copy link

@Ralith, thanks for your PR! By analyzing the history of the files in this pull request, we identified @expipiplus1, @corngood and @lummax to be potential reviewers.

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

I am attempting to get the added patch upstreamed, so hopefully it will be unnecessary soon.

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

This will break nix-built packages that use Vulkan and run on non-NixOS in situations where the XDG vars are unset of unavailable for security reasons. This is a corner case of a corner case that we already don't support very well, so IMO it shouldn't block, but if anyone knows an easy way to omit the second element of cmakeFlags on non-NixOS, that would be an improvement.

@abbradar
Copy link
Member

There are still standard well-known paths like /etc/vulkan/icd.d and /usr/share/vulkan/icd.d that would be examined so usual distributions are fine -- I don't think de facto much distributions will rely on XDG paths for this. Anyway, NixOS and non-NixOS are undistinguishable in nixpkgs.

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

This change specifically disables the fallback search of /usr/share. AFAIK every distribution sets XDG_DATA_DIRS such that this will not be an issue most of the time, but the fallback is outright wrong on non-NixOS. Maybe that's a case for making such distinguishing possible.

@abbradar
Copy link
Member

I was under the impression that you don't remove SYSCONFDIR and EXTRASYSCONFDIR -- I don't see anything hinting at this in this patch, and current code looks fine too. Or have I been misreading something yet again? D:

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

SYSCONFDIR and EXTRASYSCONFDIR are responsible for searching /etc, not /usr/share.

@abbradar
Copy link
Member

Oh, isn't one of those pointed at /usr/share? I thought it to be so for some reason...

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

@abbradar
Copy link
Member

abbradar commented Feb 19, 2017

Yeah, already. Seems my memory is flaky from my old NIX_CFLAGS_COMPILE patch, so -- sorry for misleading again.

Can't we just set fallback to ${mesa.driverLink}/share:/usr/share? Should make no harm on NixOS and fix the problem.

@Ralith
Copy link
Contributor Author

Ralith commented Feb 19, 2017

Good idea! Done. I'd be happier with a conditional but this is easy and works.

@abbradar
Copy link
Member

Tested on a local system, verified that it works in absence of XDG_DATA_DIRS and XDG_CONFIG_DIRS. Merged in bfdfd6c, thanks and sorry for me being slow ^_^

@abbradar abbradar closed this Feb 19, 2017
@Ralith
Copy link
Contributor Author

Ralith commented Feb 20, 2017

The patch introduced in this PR has been upstreamed; the next release of vulkan-loader will no longer require either patch currently in use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants