From ace5e3111c0b8d8bfd84b32f2c689b0a4d92c061 Mon Sep 17 00:00:00 2001
From: Michael Biebl <biebl@debian.org>
Date: Fri, 13 Jul 2018 23:36:13 +0200
Subject: [PATCH] Do not apply uaccess tag for /dev/kvm if mode is 0666

---
 meson.build                                         |  4 +++-
 src/login/{70-uaccess.rules => 70-uaccess.rules.m4} |  5 +++--
 src/login/meson.build                               | 13 +++++++++----
 3 files changed, 15 insertions(+), 7 deletions(-)
 rename src/login/{70-uaccess.rules => 70-uaccess.rules.m4} (96%)

diff --git a/meson.build b/meson.build
index dd904c7148..2a70af0dcb 100644
--- a/meson.build
+++ b/meson.build
@@ -741,7 +741,9 @@ substs.set('USERS_GID', users_gid)
 conf.set10('ENABLE_ADM_GROUP', get_option('adm-group'))
 conf.set10('ENABLE_WHEEL_GROUP', get_option('wheel-group'))
 
-substs.set('DEV_KVM_MODE', get_option('dev-kvm-mode'))
+dev_kvm_mode = get_option('dev-kvm-mode')
+substs.set('DEV_KVM_MODE', dev_kvm_mode)
+conf.set10('DEV_KVM_UACCESS', dev_kvm_mode != '0666')
 substs.set('GROUP_RENDER_MODE', get_option('group-render-mode'))
 
 kill_user_processes = get_option('default-kill-user-processes')
diff --git a/src/login/70-uaccess.rules b/src/login/70-uaccess.rules.m4
similarity index 96%
rename from src/login/70-uaccess.rules
rename to src/login/70-uaccess.rules.m4
index 6feb9572e6..d55e5bf5ce 100644
--- a/src/login/70-uaccess.rules
+++ b/src/login/70-uaccess.rules.m4
@@ -46,9 +46,10 @@ SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x014001*", TAG+="uaccess"
 
 # DRI video devices
 SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess"
-
+m4_ifdef(`DEV_KVM_UACCESS',``
 # KVM
-SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"
+SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"''
+)m4_dnl
 
 # smart-card readers
 ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess"
diff --git a/src/login/meson.build b/src/login/meson.build
index 4326a452c6..0e1ed18f7a 100644
--- a/src/login/meson.build
+++ b/src/login/meson.build
@@ -81,10 +81,6 @@ if conf.get('ENABLE_LOGIND') == 1
 
         install_data('70-power-switch.rules', install_dir : udevrulesdir)
 
-        if conf.get('HAVE_ACL') == 1
-                install_data('70-uaccess.rules', install_dir : udevrulesdir)
-        endif
-
         seat_rules = configure_file(
                 input : '71-seat.rules.in',
                 output : '71-seat.rules',
@@ -92,6 +88,15 @@ if conf.get('ENABLE_LOGIND') == 1
         install_data(seat_rules,
                      install_dir : udevrulesdir)
 
+        custom_target(
+                '70-uaccess.rules',
+                input : '70-uaccess.rules.m4',
+                output: '70-uaccess.rules',
+                command : [meson_apply_m4, config_h, '@INPUT@'],
+                capture : true,
+                install : conf.get('HAVE_ACL') == 1,
+                install_dir : udevrulesdir)
+
         custom_target(
                 '73-seat-late.rules',
                 input : '73-seat-late.rules.m4',