SDLe fix: refactor, remove drop_privileges() and capability management from main.c - #9
Merged
Conversation
dvledtx delegates all VFIO and hugepage operations to mtl_init() inside the MTL library. Whether those operations require elevated privileges is purely a system configuration concern, not an application concern. With the recommended pre-configuration on the host: - udev rule granting the service user ownership of /dev/vfio/<group> - LimitMEMLOCK=infinity in the systemd unit (or /etc/security/limits.conf) mtl_init() succeeds without any elevated capabilities. The application should run as a plain unprivileged service user with no capability management needed. Removes: - drop_privileges() function and its E-1 comment block - #include <linux/capability.h> - #include <sys/prctl.h> - #include <sys/syscall.h> - #include <sys/mman.h> (unused after removal)
dvledtx delegates all VFIO and hugepage operations to mtl_init() inside the MTL library. Whether those operations require elevated privileges is purely a system configuration concern, not an application concern. With the recommended pre-configuration on the host: - udev rule granting the service user ownership of /dev/vfio/<group> - LimitMEMLOCK=infinity in the systemd unit (or /etc/security/limits.conf) mtl_init() succeeds without any elevated capabilities. The application should run as a plain unprivileged service user with no capability management needed. Removes: - drop_privileges() function and its E-1 comment block - #include <linux/capability.h> - #include <sys/prctl.h> - #include <sys/syscall.h> - #include <sys/mman.h> (unused after removal)
dmkarthi
force-pushed
the
remove-privileged-access
branch
from
May 11, 2026 14:13
5173804 to
cc9d191
Compare
dmkarthi
changed the title
…ualCloud/directview-led-software-toolkit into remove-privileged-access
…om running binary
…ile/ldd/nm instead
…6-64 for runner portability
- Remove /tmp/ from ALLOWED_LOG_PREFIXES in main.c (world-writable, symlink attack risk) - Add test_validate_log_path_rejects_tmp: verify /tmp paths are rejected - Add test_validate_log_path_allows_var_log: verify /var/log/ is allowed - Add test_validate_log_path_allows_cwd_relative: verify cwd-relative OK - Add test_not_running_as_sudo: verify tests are not run as root
- Add lstat() check in main.c to reject config files that are symlinks - Add test_main_rejects_symlinked_config unit test to verify rejection
roshan-ku
approved these changes
May 14, 2026
sunilnom
pushed a commit
to sunilnom/directview-led-software-toolkit
that referenced
this pull request
Jul 21, 2026
* adding PR template to structure the github repo * template update Signed-off-by: ayeshaa <ayesha.a@intel.com> --------- Signed-off-by: ayeshaa <ayesha.a@intel.com>
sunilnom
pushed a commit
to sunilnom/directview-led-software-toolkit
that referenced
this pull request
Jul 21, 2026
…t from main.c (OpenVisualCloud#9) * refactor: remove drop_privileges() and capability management from main.c dvledtx delegates all VFIO and hugepage operations to mtl_init() inside the MTL library. Whether those operations require elevated privileges is purely a system configuration concern, not an application concern. With the recommended pre-configuration on the host: - udev rule granting the service user ownership of /dev/vfio/<group> - LimitMEMLOCK=infinity in the systemd unit (or /etc/security/limits.conf) mtl_init() succeeds without any elevated capabilities. The application should run as a plain unprivileged service user with no capability management needed. Removes: - drop_privileges() function and its E-1 comment block - #include <linux/capability.h> - #include <sys/prctl.h> - #include <sys/syscall.h> - #include <sys/mman.h> (unused after removal) * refactor: remove drop_privileges() and capability management from main.c dvledtx delegates all VFIO and hugepage operations to mtl_init() inside the MTL library. Whether those operations require elevated privileges is purely a system configuration concern, not an application concern. With the recommended pre-configuration on the host: - udev rule granting the service user ownership of /dev/vfio/<group> - LimitMEMLOCK=infinity in the systemd unit (or /etc/security/limits.conf) mtl_init() succeeds without any elevated capabilities. The application should run as a plain unprivileged service user with no capability management needed. Removes: - drop_privileges() function and its E-1 comment block - #include <linux/capability.h> - #include <sys/prctl.h> - #include <sys/syscall.h> - #include <sys/mman.h> (unused after removal) * ci: simplify FFmpeg skip check to pkg-config only, remove binary check * ci: verify FFmpeg MTL plugin via nm on libavdevice to avoid SIGILL from running binary * ci: remove binary execution from smoke test and FFmpeg verify - use file/ldd/nm instead * ci: remove smoke tests completely * ci: restore smoke tests and ffmpeg execution - compile with -march=x86-64 for runner portability * SDLe: remove /tmp/ from allowed log paths and add validation tests - Remove /tmp/ from ALLOWED_LOG_PREFIXES in main.c (world-writable, symlink attack risk) - Add test_validate_log_path_rejects_tmp: verify /tmp paths are rejected - Add test_validate_log_path_allows_var_log: verify /var/log/ is allowed - Add test_validate_log_path_allows_cwd_relative: verify cwd-relative OK - Add test_not_running_as_sudo: verify tests are not run as root * ci: explicit FFmpeg binary/.so copy on restore with full verify output * SDLe: reject symlinked config files to prevent symlink attacks - Add lstat() check in main.c to reject config files that are symlinks - Add test_main_rejects_symlinked_config unit test to verify rejection * SDLe: add watchdog unit tests, logger enhancements * SDLe: cap max resolution to 1920x1080 * docs: add troubleshooting kill command and Security.md --------- Co-authored-by: Roshan Kumar <roshan.kumar@intel.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dvledtx delegates all VFIO and hugepage operations to mtl_init() inside the MTL library. Whether those operations require elevated privileges is purely a system configuration concern, not an application concern.
With the recommended pre-configuration on the host:
mtl_init() succeeds without any elevated capabilities. The application should run as a plain unprivileged service user with no capability management needed.
Removes:
Description
Checklist
Code Quality
Testing
Review Readiness
Documentation
Security
PR Type
What kind of change does this PR introduce?