From da86aac0f5c5c3604351961b901f62cdf7186a10 Mon Sep 17 00:00:00 2001
From: Vaxry <vaxry@vaxry.net>
Date: Sun, 6 Oct 2024 14:07:07 +0100
Subject: security-context: implement protocol

fixes #7318
---
 src/Compositor.cpp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'src/Compositor.cpp')

diff --git a/src/Compositor.cpp b/src/Compositor.cpp
index b4d10c88..f00e1e34 100644
--- a/src/Compositor.cpp
+++ b/src/Compositor.cpp
@@ -24,6 +24,7 @@
 #include "protocols/LayerShell.hpp"
 #include "protocols/XDGShell.hpp"
 #include "protocols/XDGOutput.hpp"
+#include "protocols/SecurityContext.hpp"
 #include "protocols/core/Compositor.hpp"
 #include "protocols/core/Subcompositor.hpp"
 #include "desktop/LayerSurface.hpp"
@@ -210,11 +211,22 @@ void CCompositor::setRandomSplash() {
 
 static std::vector<SP<Aquamarine::IOutput>> pendingOutputs;
 
+//
+
+static bool filterGlobals(const wl_client* client, const wl_global* global, void* data) {
+    if (!PROTO::securityContext->isClientSandboxed(client))
+        return true;
+
+    return !g_pProtocolManager || !g_pProtocolManager->isGlobalPrivileged(global);
+}
+
 //
 void CCompositor::initServer(std::string socketName, int socketFd) {
 
     m_sWLDisplay = wl_display_create();
 
+    wl_display_set_global_filter(m_sWLDisplay, ::filterGlobals, nullptr);
+
     m_sWLEventLoop = wl_display_get_event_loop(m_sWLDisplay);
 
     // register crit signal handler
-- 
cgit v1.2.3