On Tue, Mar 04, 2025 at 04:57:57PM +0100, Enrico Weigelt, metux IT consult wrote:
> The Xserver's System() function is a special wrapper for calling a program
> (xkbcomp) as an unprivileged user, when the Xserver is running as suid-root.
> (which today only needed on a few platforms, eg. Solaris). Therefore it's
> not suited for being called by arbitrary drivers.
>
> In this specific context it doesn't even much sense, since it's just used
> for checking whether pkexec command is present at all (and just should be
> used), while the actual exec'ing of the helper is done directly by fork()
> and exec() syscalls.
>
> Thus we can safely use standard system() call instead - clearing the road
> for dropping System() from Xserver's public/driver API.
>
> Signed-off-by: Enrico Weigelt, metux IT consult <info@xxxxxxxxx>
> ---
> src/backlight.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/backlight.c b/src/backlight.c
> index fcbb279f..f416f2a4 100644
> --- a/src/backlight.c
> +++ b/src/backlight.c
> @@ -366,7 +366,7 @@ static int __backlight_helper_init(struct backlight *b, char *iface)
> return 0;
>
> if ((st.st_mode & (S_IFREG | S_ISUID | S_IXUSR)) != (S_IFREG | S_ISUID | S_IXUSR)) {
> - if (System("pkexec --version"))
> + if (system("pkexec --version"))
The exact opposite was done by Hans in commit 27a9dc4ce8fa ("backlight:
Use System instead of system when checking for pkexec"). The commit
msg isn't super helpful but I assume it was just to avoid running
random stuff as root.
I guess one option would be to hand roll the whole
fork()+drop_privs+exec() for this early pkexec check as well.
> return 0;
>
> use_pkexec = 1;
> --
> 2.39.5
--
Ville Syrjälä
Intel
