mpv and kitty terminal emulator on Wayland

[Russell Coker <russell@coker.com.au>]

When a paste operation is triggered (middle click on video window) mpv is 
having it's file handle sent to kitty, presumably by the wayland system (KDE 
in this case).

Denying this access can cause the source of the paste data (kitty in this 
case) to crash.  Here's the logs for kitty:

type=AVC msg=audit(1784959694.829:20780): avc:  denied  { use } for  pid=4712 
comm="kitty" path="pipe:[150412]" dev="pipefs" ino=150412 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959694.861:20787): avc:  denied  { use } for  pid=4282 
comm="QThread" path="pipe:[149316]" dev="pipefs" ino=149316 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959851.794:22406): avc:  denied  { use } for  pid=17365 
comm="kitty" path="pipe:[166960]" dev="pipefs" ino=166960 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959851.822:22409): avc:  denied  { use } for  pid=16312 
comm="WaylandEventThr" path="pipe:[164719]" dev="pipefs" ino=164719 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0
type=AVC msg=audit(1784959876.318:22422): avc:  denied  { use } for  pid=10585 
comm="kitty" path="pipe:[165833]" dev="pipefs" ino=165833 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fd permissive=0

Here's the errors from Kitty:
file descriptor expected, object (52), message send(sh)
[7.945] [glfw error 65544]: Wayland: fatal display error: Invalid argument

Here's the errors from Konsole:
file descriptor expected, object (66), message send(sh)
The Wayland connection experienced a fatal error: Invalid argument

Here's the logs when the fd use is allowed:

type=AVC msg=audit(1784960913.928:24443): avc:  denied  { write } for  
pid=25743 comm="WaylandEventThr" path="pipe:[188207]" dev="pipefs" ino=188207 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fifo_file permissive=0
type=AVC msg=audit(1784960913.964:24444): avc:  denied  { write } for  
pid=24950 comm="QThread" path="pipe:[190614]" dev="pipefs" ino=190614 
scontext=etbe:user_r:user_t:s0-s0:c0.c1023 tcontext=etbe:user_r:mplayer_t:s0-
s0:c0.c1023 tclass=fifo_file permissive=0

So it looks that for Wayland to work in the expected manner without programs 
crashing all the time we need to allow every Wayland client domain to use a fd 
from every other domain and to have fifo_file rw_inherited_fifo_file_perms 
access.

Would it be possible to have a SE Linux aware clipboard program to mediate 
this?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/