Repository navigation
Conversation
…ll (#1048) Create the layer-shell global with a filter: a connection is admitted when the runtime accepts it from the shell child it spawned and still holds (pidfd, else SO_PEERCRED). Ordinary clients neither see nor can force-bind it, so an application can no longer place surfaces over the panel or the lock. Tests now bind layer-shell through a shell connection; a new test covers the ordinary/shell split. The Marlin VM constraint fixture becomes a fullscreen xdg_toplevel and V-HOT-CORNER-CONSTRAINTS asserts the corner stays closed over it (GNOME's inFullscreen guard), with pressure positives after it quits. Signed-off-by: James Reilly <jreilly1821@gmail.com>
|
CI note: |
|
CI note: |
|
Third |
Closes #1048. Part of #577 (security release gate R14).
Admission:
WlrLayerShellState::new_with_filtershows the global only to clients markedsupervised_shell. The runtime marks a connection at accept when its peer is the shell child it spawned and still holds (pidfd-pinned, elseSO_PEERCREDPID) — the same identity the session lock and control socket use (runtime.rsaccept path,lib.rsClientState,layer.rs::is_shell_peer). Ordinary clients cannot see it, and a blind bind is a protocol error. Enumerated users: tuna-shell-gtk (gtk4-layer-shell), legacy tuna-shell-host, their test fixtures, and one VM fixture; no shell child process uses layer-shell. Mutter's analogue is its filter manager (meta-wayland-filter-manager.c); GNOME has no client-placed layers.Tests:
protocols.rsEXPECTEDis now what an ordinary client sees plusSHELL_ONLY; newlayer_shell_is_visible_and_bindable_only_by_the_supervised_shell;layer::tests::only_the_held_shell_child_is_a_shell_peer. Existing layer tests (input_protocols, layer, layer_teardown, popups, windows, x11_gates, shell-host panel live tests) connect throughTestCompositor::add_shell_client; no assertion removed.VM fixture:
packaging/marlin/vm-lane/tuna-vm-constraints.cis a fullscreen xdg_toplevel (was a layer surface).V-HOT-CORNER-CONSTRAINTS(scripts/tuna-vm-lane) keeps every lock/confine/region/reactivation/destroy assertion, now asserts the hot corner stays closed over the fullscreen principal (fullscreen_at), and takes the pressure positives after the principal quits. Proof ID unchanged. Build drops wlr-protocols.Docs:
docs/protocols.mdrow and golden-test text;docs/security-model.mdmoves layer shell from Known limitations to Privileged Wayland globals and fixes stalelib.rscitations;docs/environment.mdwording.Local checks:
cargo fmt;cargo clippy -p tuna-compositor -p tuna-shell-host --all-targets -D warnings;cargo test -p tuna-compositor --lib(1058 passed) and--test protocols/layer/layer_teardown/popups/windows/input_protocols/x11_gates(all pass);cargo test -p tuna-shell-host(all pass);scripts/lib/vm-boot-tests.py,native-constraint-tests.pyOK; throwawaycc -std=c11 -Wall -Wextra -Werrorbuild of the fixture OK. Not run locally: the Marlin VM lane; the reworked V-HOT-CORNER-CONSTRAINTS depends on the panel being under 48 px tall in the VM and on Tuna honouringset_fullscreenbefore first commit — themarlin-vmCI job must confirm both.