release 0.5.10: a setuid, setgid or file-capability binary ignores the environment and loads no GL - #67

Summary by CodeRabbit

• Security
  • In setuid, setgid, and file-capability executions, device-selection and configuration environment variables are ignored, and GL libraries are not loaded.
  • Root callers without these binary privilege modes retain existing behavior.
• Behavior Changes
  • EGL-based detiling is unavailable in those privileged executions. Where CPU detiling is unsupported, capture fails with guidance to use the helper from an unprivileged process.
  • Framebuffers without a specified modifier are treated as linear.
• Documentation
  • Updated usage and security guidance for environment handling and helper-based capture. Release version is now 0.5.10.

Walkthrough

Version 0.5.10 uses secure environment access for selected settings and prevents GL library loading in secure-execution processes. When CPU deswizzling cannot handle a framebuffer modifier in that context, capture returns an error. Documentation and release metadata describe these changes.

Changes

Secure-execution handling

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant drm_grab
  participant load_gl_libraries
  participant getauxval
  drm_grab->>load_gl_libraries: request EGL/GLES loading
  load_gl_libraries->>getauxval: check AT_SECURE
  getauxval-->>load_gl_libraries: secure-execution status
  load_gl_libraries-->>drm_grab: return -3 when secure
  drm_grab->>drm_grab: CPU deswizzle or return ENOTSUP

Security Blast Radius

• inferred — The changed restriction applies across this backend’s capture operations within a secure-execution process, including the Rust bundled implementation. Each context selects one DRM device; effective device and display access still depends on the caller’s existing permissions and capabilities. The affected unknown-layout case requires accessible, CPU-mappable scanout data; attacker control over that producer has not been established.

Security Findings and Attack Paths

• observed — The invoking-user environment route into automatic DRM selection is narrowed by secure_getenv. The backend’s route into GL code that may consume its own environment is blocked before dlopen under AT_SECURE. These controls do not validate explicit caller-supplied device paths or remove unprivileged device selection through the existing helper model.

Trust Boundaries and Controls

• observed — Explicit device-path ownership remains with the API caller and predates this release. The helper’s separate boundary continues to validate peer UID and canonical device location before privileged access, with capability reduction and seccomp failure handling conditional on the corresponding build features.

Resilience and Maintainability Implications

• observed — Secure loader refusal occurs before GL state mutation, and procedure loading propagates it before resolving extensions. Availability caches refusal as unavailable. Existing initialization, successful readback publication, and thread-local cleanup controls remain in place; no newly insecure partial GL state was established by the changed gate.

Hardening Proposals

• proposed — When secure execution forbids EGL, distinguish a proven linear producer layout from an unspecified modifier. Preserve the fast path only with a supported linear-layout guarantee; otherwise return an unsupported-operation result so consumers can recover without accepting undecoded output. This is a design proposal, not an implemented control.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn