Skip to content

Commons of opengl-game-wrapper.sh #4071

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 24, 2021

Conversation

rusty-snake
Copy link
Collaborator

@rusty-snake rusty-snake commented Mar 8, 2021

Add profiles for alienarena, ballbuster, colorful, gl-117, glaxium, pinball

Commons of opengl-game-wrapper.sh

  • Add allow-opengl-game.inc
  • Add profiles for alienarena-wrapper, ballbuster-wrapper,
    colorful-wrapper, etr-wrapper, gl-117-wrapper, glaxium-wrapper,
    neverball-wrapper, neverputt-wrapper, pinball-wrapper,
    supertuxkart-wrapper
  • Use allow-opengl-game.inc in xonotic.profile and the profiles above
  • xonotic.profile: simplify private-bin by using xonotic*

@rusty-snake rusty-snake marked this pull request as ready for review April 17, 2021 12:45
@rusty-snake
Copy link
Collaborator Author

I'm unsure whether we should add profiles for all the GAME-wrappers or not.

Explanation: Fedora (and maybe more) installs a .desktop that uses Exec=foo-wrapper instead of Exec=foo. /usr/bin/foo-wrapper is a symlink to /usr/bin/opengl-game-wrapper.sh which checks HW-accel and then starts the game or notifies the user that there is a problem.

$ cat /usr/bin/opengl-game-wrapper.sh
#!/usr/bin/bash

. /usr/share/opengl-games-utils/opengl-game-functions.sh

GAME=`basename $0 | sed 's/-wrapper.*//'`

checkDriOK $GAME

exec $GAME "$@"
$ cat /usr/share/opengl-games-utils/opengl-game-functions.sh 
# check if DRI is available, true if it is, false otherwise

function hasDri ()
{
  if [ "`glxinfo | grep "direct rendering: " | head -n 1 | cut -d " " -f 3`" != Yes ] ||
     glxinfo | grep -qE "OpenGL renderer string: Software Rasterizer|OpenGL renderer string: Gallium .* on llvmpipe"; then
    return 1
  else
    return 0
  fi 
}

# check if DRI is available, show an error and exit if it isn't

function checkDriOK ()
{
  if ! hasDri; then
    zenity --error --text="Your system currently is not capable of hardware \
accelerated 3D. Therefore $1 cannot run.

Usually the cause of this error is that there are no Free Software drivers \
for your graphics card, please contact your graphics card manufacturer and \
kindly ask them to provide Free Software support for your card."
    exit 1;
  fi
}

On the one hand it makes sense to have this check inside that sandbox. On the other hand it requires a shell which can weaken the sandbox.

@rusty-snake rusty-snake requested a review from glitsj16 April 20, 2021 17:11
Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Only one nitpick.

@rusty-snake rusty-snake marked this pull request as draft April 20, 2021 17:46
@glitsj16
Copy link
Collaborator

I'm unsure whether we should add profiles for all the GAME-wrappers or not.
On the one hand it makes sense to have this check inside that sandbox. On the other hand it requires a shell which can weaken the sandbox.

Always difficult IMO weighing pro's and con's in such a context. How about adding a comment? I mean, keep the sandbox as tight as possible (no shell) and inform users on how to proceed if they want that? As you can probably tell, I don't have any experience with (sandboxing) games, so I can't offer anything helpful here I'm afraid.

@rusty-snake rusty-snake force-pushed the open-game-wrapper branch 2 times, most recently from 24a9cc9 to 4df6485 Compare April 24, 2021 07:31
@rusty-snake rusty-snake marked this pull request as ready for review April 24, 2021 07:32
…, gl-117, glaxium, pinball

alienarena is missing in firecfg.config by intention, I didn't tested
any online multiplayer.
[skip ci]
 - Add allow-opengl-game.inc
 - Add profiles for alienarena-wrapper, ballbuster-wrapper,
   colorful-wrapper, etr-wrapper, gl-117-wrapper, glaxium-wrapper,
   neverball-wrapper, neverputt-wrapper, pinball-wrapper,
   supertuxkart-wrapper
 - Use allow-opengl-game.inc in xonotic.profile and the profiles above
 - xonotic.profile: simplify private-bin by using xonotic*
Copy link
Collaborator

@glitsj16 glitsj16 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Nice work!

@rusty-snake rusty-snake merged commit a5e8578 into netblue30:master Apr 24, 2021
@rusty-snake rusty-snake deleted the open-game-wrapper branch April 24, 2021 09:47
kmk3 added a commit to kmk3/firejail that referenced this pull request Apr 26, 2021
Added on commit 41f69f7 ("Commons of opengl-game-wrapper.sh") /
PR netblue30#4071.

Commands used to search and replace:

    $ git ls-files -z -- '*.profie' | xargs -0 -I '{}' sh -c
      "git mv '{}' \"\`printf '%s\n' '{}' | sed 's/.[^.]*$//'\`\""
kmk3 added a commit to kmk3/firejail that referenced this pull request Apr 26, 2021
They are duplicates of their equivalent *.profile files.

Added on commit 41f69f7 ("Commons of opengl-game-wrapper.sh") /
PR netblue30#4071.

Commands used to search and replace (which results in their deletion):

    $ git ls-files -z -- '*.profie' | xargs -0 -I '{}' sh -c
      "git mv -f '{}' \"\`printf '%s\n' '{}' | sed 's/.[^.]*$//'\`.profile\""
kmk3 added a commit to kmk3/firejail that referenced this pull request Apr 26, 2021
Added on commit 41f69f7 ("Commons of opengl-game-wrapper.sh") /
PR netblue30#4071.

Each one is a duplicate of a .profile file that was added on the same
commit.

Commands used to search and replace (which is what causes their
deletion):

    $ git ls-files -z -- '*.profie' | xargs -0 -I '{}' sh -c
      "git mv -f '{}' \"\`printf '%s\n' '{}' | sed 's/.[^.]*$//'\`.profile\""
@kmk3 kmk3 mentioned this pull request Apr 26, 2021
kmk3 added a commit to kmk3/firejail that referenced this pull request Apr 4, 2024
To make it consistent with the other include profiles.

See etc/templates/profile.template.

With this, all `etc/inc/allow-*` files are listed in profile.template.

The explanation is based on a comment by @rusty-snake[1].

Relates to netblue30#4071.

This is a follow-up to netblue30#6299.

[1] netblue30#4071 (comment)
kmk3 added a commit that referenced this pull request Apr 5, 2024
To make it consistent with the other include profiles.

See etc/templates/profile.template.

With this, all `etc/inc/allow-*` files are listed in profile.template.

The explanation is based on a comment by @rusty-snake[1].

Relates to #4071.

This is a follow-up to #6299.

[1] #4071 (comment)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants