Add privleap support

Makefile

@@ -40,6 +40,8 @@ install-vm: install-both
 	$(INSTALL_DATA) receiver/qubes-video-companion.rules $(DESTDIR)/usr/lib/udev/rules.d/80-qubes-video-companion.rules
 	$(INSTALL_DATA) receiver/qubes-video-companion.modprobe $(DESTDIR)/usr/lib/modprobe.d/qubes-video-companion.conf
 	$(INSTALL_DATA) receiver/qubes-video-companion.sudoers $(DESTDIR)/etc/sudoers.d/qubes-video-companion
+	$(INSTALL_DIR) $(DESTDIR)/etc/privleap/conf.d
+	$(INSTALL_DATA) receiver/qubes-video-companion.privleap $(DESTDIR)/etc/privleap/conf.d/qubes-video-companion.conf
 	$(INSTALL_DIR) $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config
 	echo 'wait-for-session=1' > $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config/qvc.Webcam
 	echo 'wait-for-session=1' > $(DESTDIR)$(SYSCONFDIR)/qubes/rpc-config/qvc.ScreenShare

receiver/qubes-video-companion.privleap

@@ -0,0 +1,3 @@
+[action:qvc-modprobe-v4l2loopback]
+Command=modprobe v4l2loopback
+AuthorizedGroups=sudo,privleap,qubes

receiver/setup.py

@@ -10,6 +10,7 @@
 import os
 import fcntl
 import subprocess
+import shutil
 
 # see v4l2loopback.h:
 #    __s32 output_nr;
@@ -91,16 +92,40 @@ def register_device(name):
         os.close(ctrl_fd)
 
 
+def try_esc_exec(exe, cmdline):
+    if shutil.which(exe) is not None:
+        try:
+            subprocess.check_call([exe, *cmdline])
+        except Exception:
+            return False
+    else:
+        return False
+    return True
+
+
 def main(argv):
     name = None
     if len(argv) == 2:
         name = f"QVC - {argv[1]}"
     elif len(argv) != 1:
         raise RuntimeError("Invalid arguments - usage: setup.py [name]")
     if not os.path.exists("/dev/v4l2loopback"):
-        subprocess.check_call(
-            ["sudo", "--non-interactive", "modprobe", "v4l2loopback"]
-        )
+        if (
+            not try_esc_exec(
+                "sudo",
+                [
+                    "--non-interactive",
+                    "modprobe",
+                    "v4l2loopback",
+                ],
+            )
+            and not try_esc_exec(
+                "leaprun", ["qvc-modprobe-v4l2loopback"]
+            )
+        ):
+            raise RuntimeError(
+                "Cannot escalate privileges to modprobe v4l2loopback"
+            )
         # wait for udev to apply permission
         subprocess.check_call(
             ["udevadm", "wait", "--settle", "/dev/v4l2loopback"]

rpm_spec/qubes-video-companion.spec.in

@@ -111,6 +111,7 @@ This package contains the video-receiving portion of Qubes Video Companion.
 /usr/lib/udev/rules.d/80-qubes-video-companion.rules
 /usr/lib/modprobe.d/qubes-video-companion.conf
 /etc/sudoers.d/qubes-video-companion
+/etc/privleap/conf.d/qubes-video-companion.conf
 
 %package docs
 Summary:        Documentation for qubes-video-companion