TheLanc3/rustdesk
1
0
Fork 0
mirror of https://github.com/rustdesk/rustdesk.git synced 2026-09-08 21:41:02 +03:00
Code Issues Packages Projects Releases Wiki Activity

drm: address review findings 3.1, 4.2, 4.3, 4.4, 4.7 + minors

Browse Source 
3.1: snapshot the stock flutter bundle before the CI drm relink and restore it
before makepkg, so the official Arch package ships the stock cdylib, not the
drm-enabled one. 4.2: wrap the drm block in a failure-tolerant subshell so a
drm-only failure no longer aborts the stock deb/rpm/arch publish. 4.3: narrow the
publish glob to rustdesk-[0-9]*.deb so the consent-bypass unattended-wayland deb
stays an artifact, not on the public release. 4.4: rewrite the three stale
DRM_CAPTURE_SECURITY.md statements to the split (default path passes a read-only
scanout dma-buf fd over SCM_RIGHTS with an import-once cache; export validation is
metadata-only; BGRA-over-the-wire is the fallback) and document that grab_desc's
fd is O_RDONLY (DRM_RDWR dropped upstream, dup preserves it). 4.7: only
short-circuit to the DRM cursor when it is authoritative (visible, or hidden in a
pure-DRM session); fall through to the normal cursor path in a mixed
DRM+PipeWire session. minors: thread the deb variant by feature not glob; TODO
for the ld.so.conf.d system path; drop a stray blank line. All gated or
whitespace so the drm-off build stays byte-identical.
This commit is contained in:
Mariano Abad
2026-07-21 15:13:33 -03:00
parent b642c75a64
commit 75af53b9bf
6 changed files with 148 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
libs/scrap/src/common/drm_reader.rs
View File

@@ -232,9 +232,16 @@ impl DrmReader {
/// The scanout `dma_buf_fd` is dup'd into an `OwnedFd` BEFORE the frame is
/// released, so we keep an independently-owned reference to the buffer that
/// survives `drmtap_frame_release` (the dma-buf refcount keeps the memory
/// alive while the peer also holds a reference). The descriptor is validated
/// on METADATA ONLY (no pixel access on the export side): the fourcc gate
/// (kept from `grab()`), `MAX_DIM`, and `num_planes` in `1..=4`.
/// alive while the peer also holds a reference). The exported fd is
/// READ-ONLY: libdrmtap exports the scanout via `drmPrimeHandleToFD` with
/// `DRM_RDWR` dropped (`O_RDONLY`), and `dup()` shares the same open file
/// description, so it preserves that access mode — the unprivileged
/// `--server` that receives the fd over `SCM_RIGHTS` can map the scanout for
/// reading but can never write into the live framebuffer. The descriptor is
/// validated on METADATA ONLY (no pixel access on the export side):
/// geometry `<= MAX_DIM` and `num_planes` in `1..=4`. There is deliberately
/// NO fourcc gate here (that is the CPU-mapped `grab()` fallback's job); the
/// format check is delegated to the unprivileged converter.
///
/// Returns the owned fd + the validated descriptor with `dma_buf_fd` reset to
/// `-1` (the `OwnedFd` owns the fd now; the descriptor's local int must never
@@ -319,7 +326,10 @@ impl DrmReader {
}
// dup the fd into an OwnedFd BEFORE releasing the frame: after release
// the library may recycle its handle, but our dup (an independent fd on
// the same open dma-buf) keeps the buffer alive for the peer.
// the same open dma-buf) keeps the buffer alive for the peer. dup(2)
// shares the same open file description, so it preserves the O_RDONLY
// access mode of libdrmtap's exported scanout fd (DRM_RDWR dropped) --
// the peer's fd stays read-only and cannot write the live scanout.
let dup_fd = hbb_common::libc::dup(raw_fd);
if dup_fd < 0 {
let e = io::Error::last_os_error();