Skip to content

Xenomai rootless and fixes#4240

Open
hdiethelm wants to merge 4 commits into
LinuxCNC:masterfrom
hdiethelm:xenomai_nonroot
Open

Xenomai rootless and fixes#4240
hdiethelm wants to merge 4 commits into
LinuxCNC:masterfrom
hdiethelm:xenomai_nonroot

Conversation

@hdiethelm

@hdiethelm hdiethelm commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

This PR has 3 commits:

This needs libevl >= 59-1 from https://github.com/hdiethelm/xenomai4-linuxcnc where the udev rules are installed. Of course, this can also be done manually. The rules are here: https://github.com/hdiethelm/xenomai4-linuxcnc/blob/lfs/libevl-debian/udev/90-libevl.rules

Tested and works both with Xenomai3 / Xenomai4 EVL.

@hdiethelm hdiethelm changed the title Xenomai nonroot + Fixes Xenomai rootless and fixes Jul 13, 2026
Comment thread src/rtapi/uspace_rtapi_main.cc
Comment thread src/rtapi/uspace_rtapi_main.cc Outdated
Comment on lines +107 to +108
static int is_current_user_in_gid(gid_t target_gid) {
int ngroups = getgroups(0, NULL);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the return type not bool?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is_current_user_in_gid() has -1 on failure, 0 on not member, 1 on member.

It's a bit a mess in rtapi_app_main.cc with the return values. Sometimes 1 is pass, sometimes 0 and sometimes it is bool.

The detect_* functions return 1 on success. For example handle_command() and all commands have -1 on failure, 0 on success.

It would probably make sense to change all detect_* and related functions to bool?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But you are using it like:

bool isInGid = is_current_user_in_gid(gid) > 0;

If this is supposed to distinguish between "user in gid", "user not in gid" or "error condition", then you should actually use the return value to distinguish the cases. However, you add this function and convert its return value to bool. You are not doing anything to distinguish error from not and treat errors like "user not in gid". That is fine by me... But then, my question stands: why is the return value not bool?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

f5316b6 changes all return values to bool in the detect_* code. I think this makes more sense.

is_current_user_in_gid() should never fail so the perror() handling should be enough. According to the man page, a wrong address or wrong size is the only reason and this is verified before. So out of memory is the only remaining reason.

If this fails, everything beaks and there are many error messages.
So better abort here.
This allows to run without setuid given the correct group membership
and Xenomai access configuration
These functions are used only in if(detect_*) so return type bool makes
more sense.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants