Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[enchancement] Fork into SWHKS when not detected #251

Open
newtoallofthis123 opened this issue Mar 4, 2024 · 3 comments
Open

[enchancement] Fork into SWHKS when not detected #251

newtoallofthis123 opened this issue Mar 4, 2024 · 3 comments

Comments

@newtoallofthis123
Copy link
Contributor

newtoallofthis123 commented Mar 4, 2024

Currently, the SWHKD model functions on a client server architecture. Hence, the server (swhks) would have to be active through out the life span of the main swhkd daemon. However, this creates a user experience barrier, along with complications on the side of handling the code itself.

Hence, this is a proposal to add mechanisms to start / fork the swhks server automagically during the execution of swhkd, if it doesn't detect the server already running. This can be easily achieved by checking the swhks.pid file in the runtime dir.

This would significantly improve the UX and the need to mention ./swhks & pkexec ./swhkd -d would not be necessary. Moreover, this can also help the transition to a more newer privilege model.

@HamzaMateen
Copy link

This is an interesting case to tackle, but I reason that it would need privilege de-escalation before launching swhks since we are bound to launch swhkd via pkexec so its children will inherit is privileges as well. what is your say

@newtoallofthis123
Copy link
Contributor Author

That is exactly the problem I am tackling right now 😄
pkexec is spawning the process in sudo.

However, I am looking into ways that we can launch swhks without the privileges. Any suggestions would be appreciated :)

@InnocentZero
Copy link
Contributor

This looks like a good idea but I'm not entirely sure if it is the best idea with the privilege model atm. Afaik this needs to be immediately after we are done with getting a hold of the file descriptors and then immediately after we call drop_privileges. Maybe some other things as well, I'm not sure.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

3 participants