client: properties with "pipewire." prefix are read-only

Properties that start with "pipewire." can only be set once. This
prevents a client from overwriting the ucred or any of the other
protected properties once they are set by the core or a module.

2 files changed, 14 insertions, 4 deletions

diff --git a/src/pipewire/client.c b/src/pipewire/client.c
index c5257c22..2730c3d0 100644
--- a/src/pipewire/client.c
+++ b/src/pipewire/client.c
@@ -370,9 +370,18 @@ int pw_client_update_properties(struct pw_client *client, const struct spa_dict
 	struct pw_resource *resource;
 	uint32_t i, changed = 0;
 
-	for (i = 0; i < dict->n_items; i++)
-		changed += pw_properties_set(client->properties,
-				  dict->items[i].key, dict->items[i].value);
+	for (i = 0; i < dict->n_items; i++) {
+		const char *key = dict->items[i].key, *old, *val = dict->items[i].value;
+
+		if (strstr(key, "pipewire.") == key &&
+		    (old = pw_properties_get(client->properties, key)) != NULL &&
+		    (val == NULL || strcmp(old, val))) {
+			pw_log_warn("client %p: refused update of key %s from %s to %s",
+					client, key, old, val);
+			continue;
+		}
+		changed += pw_properties_set(client->properties, key, val);
+	}
 
 	pw_log_debug("client %p: updated %d properties", client, changed);
 
diff --git a/src/pipewire/core.c b/src/pipewire/core.c
index fc49d445..7c74b2a4 100644
--- a/src/pipewire/core.c
+++ b/src/pipewire/core.c
@@ -117,7 +117,8 @@ static void core_hello(void *object)
 static void core_client_update(void *object, const struct spa_dict *props)
 {
 	struct pw_resource *resource = object;
-	pw_client_update_properties(resource->client, props);
+	struct pw_client *client = resource->client;
+	pw_client_update_properties(client, props);
 }
 
 static void core_permissions(void *object, const struct spa_dict *props)