session and seat management daemon
delegate cgroup management and fix user/group permissions management
Oskar Rochowiak
(Jun 17, 2026, 4:00 PM +0200)
aa20b06b
a9cf6eaf
+18
-24
+17
-24
daemon/src/main.rs
+17
-24
daemon/src/main.rs
···
32
32
33
33
#[derive(Parser)]
34
34
struct Args {
35
-
#[arg(long, value_name = "USER", help = "Allow USER to bind seat_v1")]
36
-
seat_user: Vec<String>,
35
+
#[arg(
36
+
long,
37
+
value_name = "USER",
38
+
default_value = "root",
39
+
help = "Allow USER to bind seat_v1"
40
+
)]
41
+
seat_user: String,
37
42
#[arg(
38
43
long,
39
44
value_name = "GROUP",
45
+
default_value = "root",
40
46
help = "Allow members of GROUP to bind seat_v1"
41
47
)]
42
-
seat_group: Vec<String>,
48
+
seat_group: String,
43
49
}
44
50
45
51
struct SeatAccess {
46
-
users: Vec<process::Uid>,
47
-
groups: Vec<process::Gid>,
52
+
user: process::Uid,
53
+
group: process::Gid,
48
54
}
49
55
50
56
impl SeatAccess {
51
-
fn new(users: Vec<process::Uid>, groups: Vec<process::Gid>) -> Self {
52
-
if users.is_empty() && groups.is_empty() {
53
-
return Self {
54
-
users: vec![process::Uid::ROOT],
55
-
groups: vec![process::Gid::ROOT],
56
-
};
57
-
}
58
-
59
-
Self { users, groups }
57
+
fn new(user: process::Uid, group: process::Gid) -> Self {
58
+
Self { user, group }
60
59
}
61
60
62
61
fn allows(&self, creds: &net::UCred) -> bool {
63
-
if self.users.contains(&creds.uid) || self.groups.contains(&creds.gid) {
62
+
if self.user == creds.uid || self.group == creds.gid {
64
63
return true;
65
64
}
66
65
67
66
self.process_groups(creds.pid.as_raw_pid() as u32)
68
-
.is_ok_and(|groups| groups.iter().any(|gid| self.groups.contains(gid)))
67
+
.is_ok_and(|groups| groups.contains(&self.group))
69
68
}
70
69
71
70
fn process_groups(&self, pid: u32) -> anyhow::Result<Vec<process::Gid>> {
···
349
348
log::info!("sessiond daemon starting");
350
349
351
350
let seat_access = SeatAccess::new(
352
-
args.seat_user
353
-
.iter()
354
-
.map(|user| resolve_user(user))
355
-
.collect::<anyhow::Result<Vec<_>>>()?,
356
-
args.seat_group
357
-
.iter()
358
-
.map(|group| resolve_group(group))
359
-
.collect::<anyhow::Result<Vec<_>>>()?,
351
+
resolve_user(&args.seat_user)?,
352
+
resolve_group(&args.seat_group)?,
360
353
);
361
354
362
355
let mut event_loop = calloop::EventLoop::try_new()?;