Dont run browser as root #296
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
adamkankovsky
force-pushed
the
dont-run-browser-as-root
branch
from
3e6b5a9
to
8bc3d55
Compare
adamkankovsky
force-pushed
the
dont-run-browser-as-root
branch
from
8bc3d55
to
2c9de5d
Compare
KKoukiou
force-pushed
the
dont-run-browser-as-root
branch
from
2c9de5d
to
8820795
Compare
adamkankovsky
force-pushed
the
dont-run-browser-as-root
branch
2 times, most recently
from
0a8d53d
to
2cbc20f
Compare
The titlebar with "Mozilla Firefox" has been fixed but there are some more bits that can be cleaned up. This commit achieves that by: 1. Make sure more of the environment is bubbled through anaconda to the webui launcher. In particular, we need XDG_CURRENT_DESKTOP, but this commit brings it all through, so firefox runs in an environment as close to getting run directly by the live user as possible. 2. Two exceptions are XAUTHORITY and XDG_RUNTIME_DIR which need to remain unset until we can run firefox as a normal user instead of root.
At the moment most of the firefox command line is getting placed in a variable named $BROWSER and then getting run as $BROWSER http://url This only works if $BROWSER is at the very front of the line or if it's run through eval. Instead, make BROWSER into an array so it's positional arguments get expanded positionally.
It's not a good idea to run UI code as root if we can help it, and since the webui separates front end from backend, we don't need to run the front end code as root. This commit changes webui-desktop to start firefox as the liveuser. The entire script could probably be run unprivileged with a few changes to the cockpit parts (different port, new polkit policy, cockpit.spawn changes to run as superuser), but that's a change for another time.
KKoukiou
force-pushed
the
dont-run-browser-as-root
branch
from
2cbc20f
to
f87161b
Compare
|
I rebased. It was quite tricky. Previous SHA pushed from @adamkankovsky was 2cbc20f for reference. |
KKoukiou
approved these changes
Oct 25, 2024
There was a problem hiding this comment.
Should be released together with rhinstaller/anaconda#5689
Tested interactively the Workstation ISO and it worked as expected.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Separating WebUI stuff from PR:rhinstaller/anaconda#5058