From nobody Sat Apr 06 10:01:54 2024 X-Original-To: dev-commits-ports-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VBW9N6z75z5GJFs; Sat, 6 Apr 2024 10:02:00 +0000 (UTC) (envelope-from jbeich@freebsd.org) Received: from freefall.freebsd.org (freefall.freebsd.org [96.47.72.132]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "freefall.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VBW9N6C19z4KvL; Sat, 6 Apr 2024 10:02:00 +0000 (UTC) (envelope-from jbeich@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1712397720; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=To8EUeNM2ZEHeZvUyQDZN2/Dz6LPkXA7ee0+tiwWYdo=; b=ATle1aPujSPA7tiEQx5ytZ9Az0Y1a0/j6RI2lQMFHfQptpwAMEp8ih2wQUikNUZQvx1Gai KNSCVdFKcZqm4RBA4wqLUuDG1k6SQlKoB1HmNO6ecfz78JI/4A1ajB4XUMHykRLzKPzkBF 8uR0xcxubvnjlbEFR3bNRhwj23XN857aUk3+kdeTOYCt5KMfcs+rNyDvYAjVGet4owa+h8 K9d1RrQAUJ0gLVbrn8OvQ9Il+tj/AlWQfU6+jm/erE3BZER+5cUcCRuO/xVxaY2rQ8yfvQ M88qJEDmk2Wz1eLh+4dPLOq4tSf1+eVMOAOGvICdT6/srkR5Wat48VM67JJQrQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1712397720; a=rsa-sha256; cv=none; b=KyZGcWLGRJoSQ5MzFt0dOlpAHtDiZoc6SUroEioPaMF4g/1Lw8UkwCBiUvCe8NVWoXpuuv atgx6Y7gOYF/duzeRQvHyUPg3Tf3cHi9IqKl566ph+DP6zXB/HdXHE6ULfC/sJt4+n4c9g xhd/kVOgrtOTwQy+zVEjLlsWatWOBWpJog94a8kq9ayEUdEddswwyUWAqVjsByuFU2n2rt iDnwpi+xs/NvvwLYRDLffOQd2t/UiGsyP6IORIeSc6teXQByXq6Cd+eTFgqm6Vf/1d7Uad B+UNEsUu3d9AbhK5owb2ubgXE/u7mzhjdxcGbKSQq5rsuRDCw7ILxclLmAryMQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1712397720; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=To8EUeNM2ZEHeZvUyQDZN2/Dz6LPkXA7ee0+tiwWYdo=; b=mLZ50TFFPRHK7Rw22jQe3HBd5vJdYygvBUyuco8dJh4iVf6SaxnhCCjpSAAiHNZSDPo2Kt g2XiflJcPXXv8TP/PjJ7zlN6dd0Kc3OBE5AAZFLmUJdZKio4LV5Rfk5CY9QbykUPYMla4U mnJ7hptKkfaV/ZgHAoLpMvTNhqw4YVuAusZ5oEUnQhwEGpCEZREJoyjCljwzQw8LO9wb3F wqNfthfMKHjf4ZvZmIJjlQCeJ7sDtk0uhoCQUUoPZ/d1n0QxlxgF9e2Knkux0rb/1xA9ba v5nykk3opG/vqs2B6I3QWA9fc/nLj/RnZ0aiNXt9arWAPo/k2AJ1hNKiqNZeQg== Received: by freefall.freebsd.org (Postfix, from userid 1354) id B06861C4D; Sat, 6 Apr 2024 10:02:00 +0000 (UTC) From: Jan Beich To: Emmanuel Vadot Cc: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org Subject: Re: git: 77f72c463b90 - 2024Q1 - x11-servers/xwayland-devel: backport recent secfixes In-Reply-To: <20240405104111.9d9263dfe7ce99a01d620ab3@bidouilliste.com> (Emmanuel Vadot's message of "Fri, 5 Apr 2024 10:41:11 +0200") References: <202404040955.4349tDrM089062@gitrepo.freebsd.org> <20240404125743.1e52876a69053b726cb456e4@bidouilliste.com> <8r1t-ny0j-wny@FreeBSD.org> <20240404141239.35d54535539b66cd6336ee5b@bidouilliste.com> <7chd-l2ru-wny@FreeBSD.org> <20240404151554.04340786db8562e522f7b1a8@bidouilliste.com> <20240405104111.9d9263dfe7ce99a01d620ab3@bidouilliste.com> Date: Sat, 06 Apr 2024 12:01:54 +0200 Message-ID: List-Id: Commits to the quarterly branches of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-branches@freebsd.org X-BeenThere: dev-commits-ports-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain Emmanuel Vadot writes: > On Thu, 04 Apr 2024 15:48:55 +0200 > Jan Beich wrote: > >> Emmanuel Vadot writes: >> >> >> but also introduced a number of regressions that >> >> don't exist in my port, all of which were documented in my reviews. >> > >> > What regressions ? I'm using xwayland for more than a year on my >> > desktop instead of -devel and haven't seen a problem. >> >> Try diff xwayland{,-devel}/Makefile: >> - Missing XSECURITY (ssh -X vs. ssh -Y; xorg-server parity per bug 221984) > > I admit that I'm a bit lost on this one, I did some test and here is > what I found : > > - Using sway and xwayland (so without xcsecurity enabled) I can't ssh > -X to a xorg host and run applications (DISPLAY is not set), but I can > ssh -Y fine Works fine here: # Prepare by removing existing permissions $ rm ~/.Xauthority $ ssh test@jail rm \~/.Xauthority # x11-servers/xwayland-devel $ ssh -X test@jail xeyes /usr/local/bin/xauth: file /home/test/.Xauthority does not exist Xlib: extension "XInputExtension" missing on display "localhost:10.0". ^C # x11-servers/xwayland $ ssh -X test@jail xeyes Warning: untrusted X11 forwarding setup failed: xauth key data not generated Error: Can't open display: Alternatively, SECURITY extension can be tested locally: $ xauth generate $DISPLAY . untrusted && xeyes xauth: file /home/jbeich/.Xauthority does not exist Xlib: extension "XInputExtension" missing on display ":0". ^C Curiously, wlroots starts Xwayland without -auth argument unlike others. https://gitlab.gnome.org/GNOME/mutter/-/commit/a8984a81c2e8 https://invent.kde.org/plasma/kwin/-/commit/335d9c41925d > So what I did next was to recompile xorg-server with xcsecurity > set to false. And to my surprise ssh -X from a xorg host to the one > with the modified xorg-server still worked. Did you run the modified xorg-server locally? ssh -X doesn't use xorg-server on the remote host, where sshd server is running. > xcsecurity is disabled by default in xorg-server upstream (in meson) > and I think that we should do the same (granted that XACE works > correctly). From https://gitlab.freedesktop.org/xorg/xserver/-/blob/c93c2e7718bc/Xext/Makefile.am#L58-59 # X-ACE extension: provides hooks for building security policy extensions # like XC-Security, X-SELinux & XTSol X-SELinux is Linux-only. XTSol is Solaris-only. Everyone else is left with the legacy XC-Security (trusted/untrusted) or nothing.