[FFmpeg-user] kmsgrab on Intel 8th generation aka h/w accelerated screen capture

[Mark Thompson]

On 25/06/18 10:42, Moritz Barsnick wrote:
> On Mon, Jun 25, 2018 at 09:10:29 +0800, Kai Hendry wrote:
>> However since kmsgrab requires CAP_SYS_ADMIN as it points out to its
>> friendly documentation
>> https://www.ffmpeg.org/ffmpeg-devices.html#kmsgrab I believe I need to
>> run it with `sudo`.
> 
> Actually, the documentation says: "If you don’t understand what all of
> that means, you probably don’t want this." ;-)
> 
> My understanding (<- that's a disclaimer ;-)):
> 
> CAP_SYS_ADMIN is a Linux capability. Such a capability is something you
> (or the system administrator) grants a program. In effect, this
> particular capability is somewhat like root permissions, but sudo just
> won't suffice anymore, a program *must* have this capability in order
> to access DRM (which kmsgrab uses). I consider this unfortunate, that a
> program has to be granted general CAP_SYS_ADMIN, but *sigh*.

The test you need to pass for kmsgrab to work is here: <https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/drm_framebuffer.c#n482>.

When capturing inside X, the X server is already the DRM master (which has the Highlander nature) and therefore you need to have CAP_SYS_ADMIN instead to pass the test.  (It isn't needed in all cases - for example, you can capture the text console and some framebuffer programs without CAP_SYS_ADMIN because they do not take DRM master.)  The root user always has CAP_SYS_ADMIN, so sudo is always sufficient to allow kmsgrab to work.

For the pulse side of this, I believe the problem is that the pulseaudio daemon enforces that you can't record output owned by a different user.  Recording under sudo therefore doesn't work, because root is not the same user as you.  You might be able to overcome this with some configuration setting for pulseaudio, but I'm not sure exactly what that will be.

With that in mind:

> Here you find an explanation of how to grant such a capability:
> https://stackoverflow.com/q/26504457/3974309
> 
> Basically:
> $ sudo setcap cap_sys_admin+ep /path/to/ffmpeg
> 
> Afterwards, run ffmpeg *without* sudo.

I expect this answer will work, because you get CAP_SYS_ADMIN for kmsgrab but are still your own user for pulseaudio.

Thanks,

- Mark