mirrors/pipewire
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/pipewire/pipewire.git synced 2025-10-29 05:40:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

pipewire-pulse: add snap permissions support

Browse source 
SNAP containers have two main "audio" security rules:

 * audio-playback: the applications inside the container can
   send audio samples into a sink

 * audio-record: the applications inside the container can
   get audio samples from a source

Also, old SNAP containers had the "pulseaudio" rule, which just
exposed the pulseaudio socket directly, without limits. This
is similar to the current Flatpak audio permissions.

In the pulseaudio days, a specific pulseaudio module was used
that checked the permissions given to the application and
allowed or forbade access to the pulseaudio operations.
With the change to pipewire, this functionality must be
implemented in pipewire-pulse to guarantee the sandbox
security.

This patch adds support for sandboxing permissions in the
pulseaudio module, and implements support for the SNAP audio
security model, thus forbiding a SNAP application to record
audio unless it has permissions to do so.

The current code for pipewire-pulseaudio checks the permissions
of the snap and adds three properties to each new client:

 * pipewire.snap.id: contains the Snap ID of the client.

 * pipewire.snap.audio.playback: its value is 'true' if the client
   has permission to play audio, or 'false' if not.

 * pipewire.snap.audio.record: its value is 'true' if the client
   has permission to record audio, or 'false' if not.

These properties must be processed by wireplumber to add or
remove access permissions to the corresponding nodes. That
code is available in a separate patch: https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567
This commit is contained in:
Sergio Costas Rodriguez 2023-11-22 11:26:16 +01:00 • committed by Wim Taymans
parent adbd081b12
commit d568dcd64f
5 changed files with 59 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
meson.build
View file

@ -433,6 +433,22 @@ summary({'lilv (for lv2 plugins)': lilv_lib.found()}, bool_yn: true)
libffado_dep = dependency('libffado', required: get_option('libffado'))
summary({'ffado': libffado_dep.found()}, bool_yn: true)
glib2_snap_dep = dependency('glib-2.0', required : get_option('snap'))
gio2_snap_dep = dependency('gio-2.0', required : get_option('snap'))
apparmor_snap_dep = dependency('libapparmor', required : get_option('snap'))
if dependency('snapd-glib-2', required: false).found()
snap_dep = dependency('snapd-glib-2', required : get_option('snap'))
else
snap_dep = dependency('snapd-glib', required : get_option('snap'))
endif
if snap_dep.found() and glib2_snap_dep.found() and gio2_snap_dep.found() and apparmor_snap_dep.found()
cdata.set('HAVE_SNAP', 1)
snap_deps = [glib2_snap_dep, gio2_snap_dep, snap_dep, apparmor_snap_dep]
endif
summary({'GLib-2.0 (Snap support)': glib2_snap_dep.found()}, bool_yn: true, section: 'Misc dependencies')
summary({'Gio-2.0 (Snap support)': gio2_snap_dep.found()}, bool_yn: true, section: 'Misc dependencies')
summary({'Apparmor (Snap support)': apparmor_snap_dep.found()}, bool_yn: true, section: 'Misc dependencies')
summary({'Snapd-glib (Snap support)': snap_dep.found()}, bool_yn: true, section: 'Misc dependencies')
check_functions = [
['gettid', '#include <unistd.h>', ['-D_GNU_SOURCE'], []],