From 66046f95827bd9a8e42082851d520f5dd332fde8 Mon Sep 17 00:00:00 2001 From: aptalca Date: Tue, 17 Sep 2019 12:55:06 -0400 Subject: [PATCH 1/4] add abc to all video and render groups --- root/etc/cont-init.d/50-gid-video | 43 ++++++++++++++----------------- 1 file changed, 20 insertions(+), 23 deletions(-) diff --git a/root/etc/cont-init.d/50-gid-video b/root/etc/cont-init.d/50-gid-video index b643dc2..96736a1 100755 --- a/root/etc/cont-init.d/50-gid-video +++ b/root/etc/cont-init.d/50-gid-video @@ -3,32 +3,29 @@ # check for the existence of a video and/or tuner device if [ -e /dev/dri ] || [ -e /dev/dvb ]; then if [ -e /dev/dri ]; then - VIDEO_GID=$(stat -c '%g' /dev/dri/* | grep -v '^0$' | head -n 1) - else - VIDEO_GID=$(stat -c '%g' /dev/dvb/* | grep -v '^0$' | head -n 1) + FILES="${FILES} /dev/dri/*" fi - # just add abc to root if stuff in dri/dvb is root owned - if [ -z "${VIDEO_GID}" ]; then - usermod -a -G root abc - exit 0 + if [ -e /dev/dvb ]; then + FILES="${FILES} /dev/dvb/*" fi else exit 0 fi -# Check if this GID matches the current abc user -ABCGID=$(getent group abc | awk -F: '{print $3}') -if [ "${ABCGID}" == "${VIDEO_GID}" ]; then - exit 0 -fi - -# Check if the GID is taken and swap to 65533 -CURRENT=$(getent group ${VIDEO_GID} | awk -F: '{print $1}') -if [ -z "${CURRENT}" ] || [ "${CURRENT}" == 'video' ]; then - groupmod -g ${VIDEO_GID} video - usermod -a -G video abc -else - groupmod -g 65533 ${CURRENT} - groupmod -g ${VIDEO_GID} video - usermod -a -G video abc -fi +for i in $FILES +do + VIDEO_GID=$(stat -c '%g' "$i") + if ! id -G abc | grep -qw "$VIDEO_GID"; then + if [ "${VIDEO_GID}" == '0' ]; then + usermod -a -G root abc + else + VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}') + if [ -z "${VIDEO_NAME}" ]; then + VIDEO_NAME="video$(head /dev/urandom | tr -dc 0-9 | head -c4)" + groupadd "$VIDEO_NAME" + groupmod -g "$VIDEO_GID" "$VIDEO_NAME" + fi + usermod -a -G "$VIDEO_NAME" abc + fi + fi +done \ No newline at end of file From baa34948d86fc9ca99b06af42a3035aaacef60ad Mon Sep 17 00:00:00 2001 From: aptalca Date: Wed, 18 Sep 2019 11:32:00 -0400 Subject: [PATCH 2/4] improve logic for root owned devices --- root/etc/cont-init.d/50-gid-video | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/root/etc/cont-init.d/50-gid-video b/root/etc/cont-init.d/50-gid-video index 96736a1..74e8050 100755 --- a/root/etc/cont-init.d/50-gid-video +++ b/root/etc/cont-init.d/50-gid-video @@ -15,10 +15,10 @@ fi for i in $FILES do VIDEO_GID=$(stat -c '%g' "$i") - if ! id -G abc | grep -qw "$VIDEO_GID"; then - if [ "${VIDEO_GID}" == '0' ]; then - usermod -a -G root abc - else + if id -G abc | grep -qw "$VIDEO_GID"; then + touch /groupadd + else + if [ ! "${VIDEO_GID}" == '0' ]; then VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}') if [ -z "${VIDEO_NAME}" ]; then VIDEO_NAME="video$(head /dev/urandom | tr -dc 0-9 | head -c4)" @@ -26,6 +26,11 @@ do groupmod -g "$VIDEO_GID" "$VIDEO_NAME" fi usermod -a -G "$VIDEO_NAME" abc + touch /groupadd fi fi -done \ No newline at end of file +done + +if [ ! -z "${FILES}" ] && [ ! -f "/groupadd" ]; then + usermod -a -G root abc +fi \ No newline at end of file From 177088c2988aa610d0a5b81a3525e08e40d79b36 Mon Sep 17 00:00:00 2001 From: thelamer Date: Wed, 18 Sep 2019 09:12:00 -0700 Subject: [PATCH 3/4] decrease chance of collision if we are setting multiple group names --- root/etc/cont-init.d/50-gid-video | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/root/etc/cont-init.d/50-gid-video b/root/etc/cont-init.d/50-gid-video index 74e8050..c3d7f67 100755 --- a/root/etc/cont-init.d/50-gid-video +++ b/root/etc/cont-init.d/50-gid-video @@ -21,7 +21,7 @@ do if [ ! "${VIDEO_GID}" == '0' ]; then VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}') if [ -z "${VIDEO_NAME}" ]; then - VIDEO_NAME="video$(head /dev/urandom | tr -dc 0-9 | head -c4)" + VIDEO_NAME="video$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c8)" groupadd "$VIDEO_NAME" groupmod -g "$VIDEO_GID" "$VIDEO_NAME" fi @@ -33,4 +33,4 @@ done if [ ! -z "${FILES}" ] && [ ! -f "/groupadd" ]; then usermod -a -G root abc -fi \ No newline at end of file +fi From b01cd522f1b5e41763e4943fc6df30e0de97a263 Mon Sep 17 00:00:00 2001 From: thelamer Date: Wed, 18 Sep 2019 17:27:28 -0700 Subject: [PATCH 4/4] optmizations from @nemchik --- root/etc/cont-init.d/50-gid-video | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/root/etc/cont-init.d/50-gid-video b/root/etc/cont-init.d/50-gid-video index c3d7f67..8e0dec3 100755 --- a/root/etc/cont-init.d/50-gid-video +++ b/root/etc/cont-init.d/50-gid-video @@ -1,16 +1,6 @@ #!/usr/bin/with-contenv bash -# check for the existence of a video and/or tuner device -if [ -e /dev/dri ] || [ -e /dev/dvb ]; then - if [ -e /dev/dri ]; then - FILES="${FILES} /dev/dri/*" - fi - if [ -e /dev/dvb ]; then - FILES="${FILES} /dev/dvb/*" - fi -else - exit 0 -fi +FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null) for i in $FILES do @@ -31,6 +21,6 @@ do fi done -if [ ! -z "${FILES}" ] && [ ! -f "/groupadd" ]; then +if [ -n "${FILES}" ] && [ ! -f "/groupadd" ]; then usermod -a -G root abc fi