T-Gander/Sunshine
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix(linux): security: drop CAP_SYS_ADMIN when possible, retain CAP_SYS_NICE (#5075)

Browse Source
This commit is contained in:
Conn O'Griofa
2026-05-06 01:05:21 +01:00
committed by GitHub
parent dd30d0555f
commit ecba5c3c2e
4 changed files with 37 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/platform/linux/kwingrab.cpp
View File

@@ -674,11 +674,6 @@ namespace platf {
return nullptr;
}
// Drop CAP_SYS_ADMIN so KWin's permission check (if active) can see and match the executable
if (!kwin::screencast_permission_helper_t::is_permission_system_deactivated() && has_elevated_privileges()) {
drop_elevated_privileges();
}
auto display = std::make_shared<kwin::kwin_t>();
if (display->init(hwdevice_type, display_name, config)) {
return nullptr;
@@ -688,7 +683,7 @@ namespace platf {
}
std::vector<std::string> kwin_display_names() {
if (!kwin::screencast_permission_helper_t::is_permission_system_deactivated() && has_elevated_privileges()) {
if (has_elevated_privileges(false)) {
// We're still in the probing phase of Sunshine startup. Dropping portal security early will break KMS.
// Just return a dummy screen for now. Display re-enumeration after encoder probing will yield full result.
std::vector<std::string> display_names;