https://bugzilla.rpmfusion.org/show_bug.cgi?id=5122
--- Comment #10 from Nicolas Chauvet <[email protected]> ---
(In reply to Andrew Bauer from comment #8)
> Now that I am thinking of it, I need to draw the readers attention to video
> group patch:
> https://github.com/fedberry/omxplayer/blob/master/0006-video-group-check.
> patch
...
> @Xavier - What is your opinion on this?
I don't think it's appropriate to request users to be in such a privilege
(video) group:
On my Intel device, I have this:
crw-rw----+ 1 root video 226, 0 24 janv. 00:46 /dev/dri/card0
crw-rw-rw-. 1 root render 226, 128 24 janv. 00:46 /dev/dri/renderD128
So the card0 device is protected against "others" access, but not the render
node. Whereas it still possible to further restrict who is able to use the
render device it's not possible for another user to write or remove the desktop
user render tasks. (this is because of buffer handles, as I understand)
So there is no security issue in this case.
I'm pretty sure the same apply to the rpi characters devices, but this would
requires a dedicated analysis.
That been said, having end-users in the video group is not appropriate as this
might bypass how logind or a display manager "hand over" the device handle to
the desktop session user. (And this can be considered as a security risk
instead).
IMHO, we shoudn't deviate from raspbian in this aspect.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are the assignee for the bug.
_______________________________________________
rpmfusion-developers mailing list -- [email protected]
To unsubscribe send an email to [email protected]
