media-video/ffmpeg use flag 'libdrm' provide screen capturing from the active KMS plane, but capture whole planes requires CAP_SYS_ADMIN to run (as says ffmpeg wiki: https://trac.ffmpeg.org/wiki/Hardware/VAAPI#ScreenCapture) Reproducible: Always Steps to Reproduce: $ ffmpeg -hide_banner -device /dev/dri/card0 -f kmsgrab -i - -vf 'hwmap=derive_device=vaapi,scale_vaapi=format=nv12' -c:v h264_vaapi -qp 24 output.mp4 Actual Results: [kmsgrab @ 0x55fd3baa4340] Using plane 31 to locate framebuffers. [kmsgrab @ 0x55fd3baa4340] Template framebuffer is 104: 3840x2160 32bpp 24b depth. [kmsgrab @ 0x55fd3baa4340] No handle set on framebuffer: maybe you need some additional capabilities? pipe:: Invalid argument Expected Results: screen capture starting with no errors after setting capabilities $ sudo setcap cap_sys_admin+ep /usr/bin/ffmpeg screen capture starting ok: [kmsgrab @ 0x55b372d68340] Using plane 31 to locate framebuffers. [kmsgrab @ 0x55b372d68340] Template framebuffer is 104: 3840x2160 32bpp 24b depth. Input #0, kmsgrab, from 'pipe:': Duration: N/A, start: 1589052292.305081, bitrate: N/A Stream #0:0: Video: wrapped_avframe, drm_prime, 3840x2160, 29.92 tbr, 1000k tbn, 1000k tbc Stream mapping: Stream #0:0 -> #0:0 (wrapped_avframe (native) -> h264 (h264_vaapi)) Output #0, mp4, to 'output.mp4': Metadata: encoder : Lavf58.29.100 Stream #0:0: Video: h264 (h264_vaapi) (High) (avc1 / 0x31637661), vaapi_vld, 3840x2160, q=-1--1, 29.92 fps, 11488 tbn, 29.92 tbc Metadata: encoder : Lavc58.54.100 h264_vaapi
Giving ffmpeg CAP_SYS_ADMIN seems like a terrible idea from a security perspective. If implemented, this should be opt-in and carry a big warning.
(In reply to Mike Gilbert from comment #1) > Giving ffmpeg CAP_SYS_ADMIN seems like a terrible idea from a security > perspective. If implemented, this should be opt-in and carry a big warning. I agree. I think the ffmpeg documentation is enough for this, we should definitely not give ffmpeg, which is often used to process untrusted data, suid-root like permissions.
If you really want to do this, use a sudo wrapper script that uses setpriv to run the command with +cap_sys_admin. It's still dangerous but at least the damage is contained to a fixed command line that way. And do keep in mind that scraping screen contents at the hardware level is locked behind pseudo-root privileges for a good reason. If you're just trying to record your desktop media-video/obs-studio works without root, and also has VAAPI support.
