D7616: Don't dissallow open with write flag syscall on NVIDIA

[Martin Flöser]

graesslin created this revision.
Restricted Application added a project: Plasma.
Restricted Application added a subscriber: plasma-devel.

REVISION SUMMARY
  The latest NVIDIA driver crashes the greeter due to our seccomp enabled
  sandbox being too restrictive. The driver is now opening files for
  writing after our dummy context got created and this causes a crash. In
  order to provide our users a working system again we better disable the
  seccomp rule for NVIDIA users for the time being.
  
  To detect whether an NVIDIA driver is used I copied the glplatform from
  KWin which is known to work and more reliable than writing new custom
  code even if it's a code copy. For master I'll look into splitting that
  one out from KWin and putting it into a dedicated library so that we can
  link it.
  
  This of course means that the seccomp based sandbox is now incomplete
  for NVIDIA users. An idea is to add an additional apparmor rule in
  master to enforce the write restrictions in similar way without forcing
  it for /dev.
  
  BUG: 384005

TEST PLAN
  I don't have an NVIDIA

REPOSITORY
  R133 KScreenLocker

BRANCH
  nvidia-seccomp

REVISION DETAIL
  https://phabricator.kde.org/D7616

AFFECTED FILES
  greeter/CMakeLists.txt
  greeter/autotests/CMakeLists.txt
  greeter/autotests/seccomp_test.cpp
  greeter/kwinglplatform.cpp
  greeter/kwinglplatform.h
  greeter/seccomp_filter.cpp

To: graesslin, #plasma
Cc: plasma-devel, ZrenBot, progwolff, lesliezhai, ali-mohamed, jensreuterberg, abetts, sebas, apol, mart, lukas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.kde.org/pipermail/plasma-devel/attachments/20170830/f255ac3b/attachment.html>