All Wayland interface implementations should have a bound event

[ddevault]

From which the compositor implementation can deny the request to bind that interface.

We should make the signal's data parameter standardized so later on we can implement some kind of standard security limiting device if that's something we want to take on.

---

wlroots has migrated to gitlab.freedesktop.org. This issue has been moved to:

https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/355

[emersion]

How does that relate to #142?

[ddevault]

I think that's only part of the solution. We'll likely want in the long term some kind of negotation protocol (see orbital's work) so that the compositor can ask the user for consent on behalf of the client and so on.

[emersion]

I don't see what are the upsides of a signal over wl_display_set_global_filter.

Also, if we want a signal, how does the compositor allows/denies a client?

1. A signal request_bind is emitted and the compositor must call wlr_<type>_bind(global, client) if it accepts it (what happens if the compositor rejects the client?).
2. A signal bind is emitted with an event struct wlr_bind_event which has a field bool accept (by default set to true). Setting it to false cancels the binding.
3. A bind callback, which returns true or false (I don't personally like this one).

[ddevault]

Well, consider the case I mentioned. The global filter will eliminate globals during the registry poll and the client won't be able to get them back after their permissions model changes (due to user consent) unless they poll again, which sucks.

[emersion]

Okay, makes sense. What do you think of solution 2?

[ddevault]

I actually think we should shelve this for now. But let's leave the ticket open for the time being.