[BlackScorp]

Testing the changes

• I tested the changes in this PR: YES
• The greeter was tested locally and works.
• ./xbps-src pkg noctalia-greeter completed successfully. With -Q, eight tests passed, one was skipped because EGL was unavailable, and the headless compositor test failed in the build environment.

New package

• This new package conforms to the package requirements: YES
• Noctalia Greeter is compiled software installed system-wide.

Local build testing

• I built this PR locally for my native architecture, x86_64-glibc.

Related: #62968

[juandmcr]

A new version (v1.7.0) of Noctalia Greeter is now available.
I used your template locally on my system and tried to build the newest version, they added a new build dependency: libjxl-devel.
By the way, one test didn't pass for me on x86_64-glibc (my arch), x86_64-musl and i686: greeter-frame-loop. It fails during the testing phase with "eglGetDisplay failed" because it needs a working graphics display. A related test (wallpaper-program-pixels) has the same limitation but it skips instead... all the other tests passed.
I used make_check_args="--exclude greeter-frame-loop" but I don't know if that's the correct solution here, so I'd wait for review.

Compiling with this template (adding libjxl-devel and changing the version to 1.7.0) for

• x86_64
• x86_64-musl (cross)
• i686 (cross), aarch64 (cross)
• aarch64-musl (cross)
• armv7l (cross)
• armv7l-musl (cross)
• armv6l (cross)
• armv6l-musl (cross)

succeeded and I tested the package briefly for my own system.

[BlackScorp]

@juandmcr thanks for the hint, i updated the PR

[Anidetrix]

from local testing, noctalia-greeter's passwordless sync doesn't work with Void due to polkitd user owning the rules.d folder, here's the patch I used to fix it

diff --git a/src/tools/passwordless_sync_policy.cpp b/src/tools/passwordless_sync_policy.cpp
index bfffee7..ba588af 100644
--- a/src/tools/passwordless_sync_policy.cpp
+++ b/src/tools/passwordless_sync_policy.cpp
@@ -46,6 +46,10 @@ namespace greeter::passwordless_sync {
     constexpr std::size_t kMaximumUsers = 256;
     constexpr std::size_t kMaximumUserNameLength = 256;
     constexpr std::size_t kMaximumPathLength = 4096;
+    const uid_t kPolkitdUid = [] {
+      if (const struct passwd* pw = ::getpwnam("polkitd")) return pw->pw_uid;
+      return static_cast<uid_t>(-1);
+    }();
 
     class UniqueFd {
     public:
@@ -212,8 +216,8 @@ namespace greeter::passwordless_sync {
         if (::stat(current.c_str(), &state) != 0) {
           return setErrnoError(std::string("failed to inspect ") + std::string(description) + " directory", errorOut);
         }
-        if (!S_ISDIR(state.st_mode) || state.st_uid != 0 || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
-          errorOut = std::string(description) + " must use a root-owned, non-user-writable directory chain";
+        if (!S_ISDIR(state.st_mode) || (state.st_uid != 0 && state.st_uid != kPolkitdUid) || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+          errorOut = std::string(description) + " must use a root-owned or polkitd-owned, non-user-writable directory chain";
           return false;
         }
         if (current == current.root_path()) {
@@ -432,7 +436,7 @@ namespace greeter::passwordless_sync {
       if (::fstat(directory.get(), &state) != 0) {
         return setErrnoError("failed to inspect the Polkit rules directory", errorOut);
       }
-      if (!S_ISDIR(state.st_mode) || state.st_uid != 0 || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+      if (!S_ISDIR(state.st_mode) || (state.st_uid != 0 && state.st_uid != kPolkitdUid) || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
         errorOut = "the Polkit rules directory has unsafe ownership or permissions";
         return false;
       }

[BlackScorp]

hi @Anidetrix thanks for pointing that out. i didnt use passwordless login. i added your patch but modified it slightly and squasched my pr.

[Anidetrix]

I made an even more surgical patch which only allows (and forces) rules.d to be polkitd

diff --git a/src/tools/passwordless_sync_policy.cpp b/src/tools/passwordless_sync_policy.cpp
index bfffee7..91a5d7b 100644
--- a/src/tools/passwordless_sync_policy.cpp
+++ b/src/tools/passwordless_sync_policy.cpp
@@ -46,6 +46,10 @@ namespace greeter::passwordless_sync {
     constexpr std::size_t kMaximumUsers = 256;
     constexpr std::size_t kMaximumUserNameLength = 256;
     constexpr std::size_t kMaximumPathLength = 4096;
+    const uid_t kPolkitdUid = [] {
+      if (const struct passwd* pw = ::getpwnam("polkitd")) return pw->pw_uid;
+      return static_cast<uid_t>(-1);
+    }();
 
     class UniqueFd {
     public:
@@ -420,7 +424,8 @@ namespace greeter::passwordless_sync {
             + ec.message();
         return false;
       }
-      if (!validateTrustedDirectoryChain(canonical, "Polkit rules", errorOut)) {
+      const std::filesystem::path parent = canonical.parent_path();
+      if (!validateTrustedDirectoryChain(parent, "Polkit rules parent", errorOut)) {
         return false;
       }
 
@@ -432,7 +437,7 @@ namespace greeter::passwordless_sync {
       if (::fstat(directory.get(), &state) != 0) {
         return setErrnoError("failed to inspect the Polkit rules directory", errorOut);
       }
-      if (!S_ISDIR(state.st_mode) || state.st_uid != 0 || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+      if (!S_ISDIR(state.st_mode) || state.st_uid != kPolkitdUid || (state.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
         errorOut = "the Polkit rules directory has unsafe ownership or permissions";
         return false;
       }

[joshuakraemer]

greeter-frame-loop doesn't need to be excluded: it fails because of missing Mesa drivers, and once EGL works, the greeter segfaults because no fonts are installed. With the following, all 15 tests pass for me:

checkdepends="mesa-dri dejavu-fonts-ttf"

I'd also suggest an INSTALL.msg with the greetd setup:

To use noctalia-greeter, set the greeter command in /etc/greetd/config.toml:

  [default_session]
  command = "/usr/bin/noctalia-greeter-session"
  user = "_greeter"

Then initialize the greeter state as root:

  # GREETER_USER=_greeter noctalia-greeter-apply-appearance --setup-system

[BlackScorp]

Thanks @Anidetrix @joshuakraemer updated PR