diff --git a/Makefile b/Makefile index c40e5ff..d8660de 100644 --- a/Makefile +++ b/Makefile @@ -40,6 +40,8 @@ install-vm: install-both $(INSTALL_DATA) receiver/qubes-video-companion.rules $(DESTDIR)/usr/lib/udev/rules.d/80-qubes-video-companion.rules $(INSTALL_DATA) receiver/qubes-video-companion.modprobe $(DESTDIR)/usr/lib/modprobe.d/qubes-video-companion.conf $(INSTALL_DATA) receiver/qubes-video-companion.sudoers $(DESTDIR)/etc/sudoers.d/qubes-video-companion + $(INSTALL_DIR) $(DESTDIR)/etc/privleap/conf.d + $(INSTALL_DATA) receiver/qubes-video-companion.privleap $(DESTDIR)/etc/privleap/conf.d/qubes-video-companion.conf $(INSTALL_DIR) $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config echo 'wait-for-session=1' > $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config/qvc.Webcam echo 'wait-for-session=1' > $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config/qvc.ScreenShare diff --git a/receiver/qubes-video-companion.privleap b/receiver/qubes-video-companion.privleap new file mode 100644 index 0000000..9e8c74d --- /dev/null +++ b/receiver/qubes-video-companion.privleap @@ -0,0 +1,3 @@ +[action:qvc-modprobe-v4l2loopback] +Command=modprobe v4l2loopback +AuthorizedGroups=sudo,privleap,qubes diff --git a/receiver/setup.py b/receiver/setup.py index d8b1808..7f4e4e3 100644 --- a/receiver/setup.py +++ b/receiver/setup.py @@ -10,6 +10,7 @@ import os import fcntl import subprocess +import shutil # see v4l2loopback.h: # __s32 output_nr; @@ -91,6 +92,17 @@ def register_device(name): os.close(ctrl_fd) +def try_esc_exec(exe, cmdline): + if shutil.which(exe) is not None: + try: + subprocess.check_call([exe, *cmdline]) + except Exception: + return False + else: + return False + return True + + def main(argv): name = None if len(argv) == 2: @@ -98,9 +110,22 @@ def main(argv): elif len(argv) != 1: raise RuntimeError("Invalid arguments - usage: setup.py [name]") if not os.path.exists("/dev/v4l2loopback"): - subprocess.check_call( - ["sudo", "--non-interactive", "modprobe", "v4l2loopback"] - ) + if ( + not try_esc_exec( + "sudo", + [ + "--non-interactive", + "modprobe", + "v4l2loopback", + ], + ) + and not try_esc_exec( + "leaprun", ["qvc-modprobe-v4l2loopback"] + ) + ): + raise RuntimeError( + "Cannot escalate privileges to modprobe v4l2loopback" + ) # wait for udev to apply permission subprocess.check_call( ["udevadm", "wait", "--settle", "/dev/v4l2loopback"] diff --git a/rpm_spec/qubes-video-companion.spec.in b/rpm_spec/qubes-video-companion.spec.in index cbf018d..cf621db 100644 --- a/rpm_spec/qubes-video-companion.spec.in +++ b/rpm_spec/qubes-video-companion.spec.in @@ -111,6 +111,7 @@ This package contains the video-receiving portion of Qubes Video Companion. /usr/lib/udev/rules.d/80-qubes-video-companion.rules /usr/lib/modprobe.d/qubes-video-companion.conf /etc/sudoers.d/qubes-video-companion +/etc/privleap/conf.d/qubes-video-companion.conf %package docs Summary: Documentation for qubes-video-companion