From c8036d1050f20b929513b2d9e7136a0ef7798c86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= Date: Sat, 19 Oct 2019 15:03:17 +0200 Subject: [PATCH 1/3] gnome3.mutter: does not depend clutter Mutter have shipped its own `clutter` for ages, we need json-glib however which clutter propagated. --- pkgs/desktops/gnome-3/core/mutter/default.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/desktops/gnome-3/core/mutter/default.nix b/pkgs/desktops/gnome-3/core/mutter/default.nix index c8b1ac7e466..2633749f43b 100644 --- a/pkgs/desktops/gnome-3/core/mutter/default.nix +++ b/pkgs/desktops/gnome-3/core/mutter/default.nix @@ -1,5 +1,5 @@ { fetchurl, fetchpatch, substituteAll, stdenv, pkgconfig, gnome3, gettext, gobject-introspection, upower, cairo -, pango, cogl, clutter, libstartup_notification, zenity, libcanberra-gtk3 +, pango, cogl, json-glib, libstartup_notification, zenity, libcanberra-gtk3 , ninja, xkeyboard_config, libxkbfile, libxkbcommon, libXtst, libinput , gsettings-desktop-schemas, glib, gtk3, gnome-desktop , geocode-glib, pipewire, libgudev, libwacom, xwayland, meson @@ -30,6 +30,7 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ # required for pkgconfig to detect mutter-clutter libXtst + json-glib ]; nativeBuildInputs = [ @@ -46,7 +47,7 @@ stdenv.mkDerivation rec { buildInputs = [ glib gobject-introspection gtk3 gsettings-desktop-schemas upower - gnome-desktop cairo pango cogl clutter zenity libstartup_notification + gnome-desktop cairo pango cogl zenity libstartup_notification geocode-glib libinput libgudev libwacom libcanberra-gtk3 zenity xkeyboard_config libxkbfile libxkbcommon pipewire xwayland From 9742df15950a4c53e89fcc79feabd3a1a78827e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= Date: Sat, 19 Oct 2019 15:15:20 +0200 Subject: [PATCH 2/3] gnome3.mutter: drop inheritable cap_sys_nice In NixOS extra capabilities are provided through the ambient set which provides real inheritability to user run processes [0]. We don't want gome-shell to spawn processes with cap_sys_nice however (apart from the obvious this also breaks eg. flatpaks). So we drop inheritable when starting to prevent further inheritance (the ambient set is only propagated if inherit is set). [0] https://github.com/torvalds/linux/commit/58319057b7847667f0c9585b9de0e8932b0fdb08 --- pkgs/desktops/gnome-3/core/mutter/default.nix | 5 + .../core/mutter/drop-inheritable.patch | 132 ++++++++++++++++++ 2 files changed, 137 insertions(+) create mode 100644 pkgs/desktops/gnome-3/core/mutter/drop-inheritable.patch diff --git a/pkgs/desktops/gnome-3/core/mutter/default.nix b/pkgs/desktops/gnome-3/core/mutter/default.nix index 2633749f43b..d2745c2a90d 100644 --- a/pkgs/desktops/gnome-3/core/mutter/default.nix +++ b/pkgs/desktops/gnome-3/core/mutter/default.nix @@ -9,6 +9,7 @@ , wrapGAppsHook , sysprof , desktop-file-utils +, libcap_ng }: stdenv.mkDerivation rec { @@ -31,6 +32,7 @@ stdenv.mkDerivation rec { # required for pkgconfig to detect mutter-clutter libXtst json-glib + libcap_ng ]; nativeBuildInputs = [ @@ -55,6 +57,9 @@ stdenv.mkDerivation rec { ]; patches = [ + # Drop inheritable cap_sys_nice, to prevent the ambient set from leaking + # from mutter/gnome-shell, see https://github.com/NixOS/nixpkgs/issues/71381 + ./drop-inheritable.patch # TODO: submit upstream ./0001-build-use-get_pkgconfig_variable-for-sysprof-dbusdir.patch (substituteAll { diff --git a/pkgs/desktops/gnome-3/core/mutter/drop-inheritable.patch b/pkgs/desktops/gnome-3/core/mutter/drop-inheritable.patch new file mode 100644 index 00000000000..574ed572561 --- /dev/null +++ b/pkgs/desktops/gnome-3/core/mutter/drop-inheritable.patch @@ -0,0 +1,132 @@ +From e9c772e265b2293af031c79f4bbc99b5847dfe3c Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= +Date: Sat, 19 Oct 2019 13:26:05 +0200 +Subject: [PATCH] drop inheritable + +Adapted from https://gitlab.gnome.org/GNOME/mutter/commit/c53c47ae123b03cc66044d2b846342123ecb3a01 + +We only want to drop inheritable though, to prevent the ambient set leaking further than gnome-shell. + +--- + config.h.meson | 3 +++ + meson.build | 5 +++++ + meson_options.txt | 6 ++++++ + src/core/main.c | 11 +++++++++++ + src/meson.build | 1 + + 5 files changed, 26 insertions(+) + +diff --git a/config.h.meson b/config.h.meson +index 0bab71848..202fb7ed1 100644 +--- a/config.h.meson ++++ b/config.h.meson +@@ -58,6 +58,9 @@ + /* Xwayland applications allowed to issue keyboard grabs */ + #mesondefine XWAYLAND_GRAB_DEFAULT_ACCESS_RULES + ++/* Defined if libcap-ng is available */ ++#mesondefine HAVE_LIBCAPNG ++ + /* XKB base prefix */ + #mesondefine XKB_BASE + +diff --git a/meson.build b/meson.build +index 3322bd3b1..01c8020fa 100644 +--- a/meson.build ++++ b/meson.build +@@ -35,6 +35,7 @@ libstartup_notification_req = '>= 0.7' + libcanberra_req = '>= 0.26' + libwacom_req = '>= 0.13' + atk_req = '>= 2.5.3' ++libcapng_req = '>= 0.7.9' + + # optional version requirements + udev_req = '>= 228' +@@ -125,6 +126,7 @@ xau_dep = dependency('xau') + ice_dep = dependency('ice') + atk_dep = dependency('atk', version: atk_req) + libcanberra_dep = dependency('libcanberra', version: libcanberra_req) ++libcapng_dep = dependency('libcap-ng', required: get_option('libcapng')) + + # For now always require X11 support + have_x11 = true +@@ -256,6 +258,7 @@ have_core_tests = false + have_cogl_tests = false + have_clutter_tests = false + have_installed_tests = false ++have_libcapng = libcapng_dep.found() + + if have_tests + have_core_tests = get_option('core_tests') +@@ -361,6 +364,7 @@ cdata.set('HAVE_LIBWACOM', have_libwacom) + cdata.set('HAVE_SM', have_sm) + cdata.set('HAVE_STARTUP_NOTIFICATION', have_startup_notification) + cdata.set('HAVE_INTROSPECTION', have_introspection) ++cdata.set('HAVE_LIBCAPNG', have_libcapng) + cdata.set('HAVE_PROFILER', have_profiler) + + xkb_base = xkeyboard_config_dep.get_pkgconfig_variable('xkb_base') +@@ -443,6 +447,7 @@ output = [ + ' Startup notification..... ' + have_startup_notification.to_string(), + ' Introspection............ ' + have_introspection.to_string(), + ' Profiler................. ' + have_profiler.to_string(), ++ ' libcap-ng................ ' + have_libcapng.to_string(), + '', + ' Tests:', + '', +diff --git a/meson_options.txt b/meson_options.txt +index 73aa7adde..8bfaacd9a 100644 +--- a/meson_options.txt ++++ b/meson_options.txt +@@ -152,3 +152,9 @@ option('xwayland_grab_default_access_rules', + value: 'gnome-boxes,remote-viewer,virt-viewer,virt-manager,vinagre,vncviewer,Xephyr', + description: 'Comma delimited list of applications ressources or class allowed to issue X11 grabs in Xwayland' + ) ++ ++option('libcapng', ++ type: 'feature', ++ value: 'auto', ++ description: 'Enable libcap-ng support' ++) +diff --git a/src/core/main.c b/src/core/main.c +index 7f4f666d2..b27968f13 100644 +--- a/src/core/main.c ++++ b/src/core/main.c +@@ -66,6 +66,10 @@ + #include + #endif + ++#ifdef HAVE_LIBCAPNG ++#include ++#endif ++ + #if defined(HAVE_NATIVE_BACKEND) && defined(HAVE_WAYLAND) + #include + #endif /* HAVE_WAYLAND && HAVE_NATIVE_BACKEND */ +@@ -673,6 +677,12 @@ meta_run (void) + if (!meta_display_open ()) + meta_exit (META_EXIT_ERROR); + ++#ifdef HAVE_LIBCAPNG ++ capng_clear(CAPNG_SELECT_BOTH); ++ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, CAP_SYS_NICE); ++ capng_apply(CAPNG_SELECT_BOTH); ++#endif ++ + g_main_loop_run (meta_main_loop); + + meta_finalize (); +diff --git a/src/meson.build b/src/meson.build +index 90d80734f..a9fffa2c2 100644 +--- a/src/meson.build ++++ b/src/meson.build +@@ -18,6 +18,7 @@ mutter_pkg_deps = [ + glib_dep, + gsettings_desktop_schemas_dep, + gtk3_dep, ++ libcapng_dep, + pango_dep, + ] + +-- +2.23.0 + From 927a6fdaad493044f2344cba73e6310d3450ca00 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tor=20Hedin=20Br=C3=B8nner?= Date: Sat, 19 Oct 2019 15:38:04 +0200 Subject: [PATCH 3/3] nixos/gnome3: launch gnome-shell wayland with RT scheduling We create a wrapper which launches gnome-shell with the correct environment and cap_sys_nice. We can then override gnome-shell-wayland.service to use this wrapper. NOTE: We need to force clear the environment, because the defaults aren't good for user services. That should probably be fixed. --- .../services/x11/desktop-managers/gnome3.nix | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/nixos/modules/services/x11/desktop-managers/gnome3.nix b/nixos/modules/services/x11/desktop-managers/gnome3.nix index 9a402c74c05..1544a842053 100644 --- a/nixos/modules/services/x11/desktop-managers/gnome3.nix +++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix @@ -269,6 +269,26 @@ in source-sans-pro ]; + ## Enable soft realtime scheduling, only supported on wayland ## + + security.wrappers.".gnome-shell-wrapped" = { + source = "${pkgs.gnome3.gnome-shell}/bin/.gnome-shell-wrapped"; + capabilities = "cap_sys_nice=ep"; + }; + + systemd.user.services.gnome-shell-wayland = let + gnomeShellRT = with pkgs.gnome3; pkgs.runCommand "gnome-shell-rt" {} '' + mkdir -p $out/bin/ + cp ${gnome-shell}/bin/gnome-shell $out/bin + sed -i "s@${gnome-shell}/bin/@${config.security.wrapperDir}/@" $out/bin/gnome-shell + ''; + in { + # Note we need to clear ExecStart before overriding it + serviceConfig.ExecStart = ["" "${gnomeShellRT}/bin/gnome-shell"]; + # Do not use the default environment, it provides a broken PATH + environment = mkForce {}; + }; + # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-32/elements/core/meta-gnome-core-shell.bst environment.systemPackages = with pkgs.gnome3; [ adwaita-icon-theme