From b8fd3d82205f632ce001fade74fed287e1564a1a Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 31 Oct 2017 08:41:53 -0700 Subject: [PATCH 1/4] udev-rules: Permission changes for /dev/kvm - Remove uaccess tag from /dev/kvm. - Change the default mode for /dev/kvm to 0666. --- meson_options.txt | 2 +- src/login/70-uaccess.rules | 3 --- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/meson_options.txt b/meson_options.txt index 3de72acf950..50f24df1b35 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -144,7 +144,7 @@ option('nobody-user', type : 'string', option('nobody-group', type : 'string', description : 'The name of the nobody group (the one with GID 65534)', value : 'nobody') -option('dev-kvm-mode', type : 'string', value : '0660', +option('dev-kvm-mode', type : 'string', value : '0666', description : '/dev/kvm access mode') option('default-kill-user-processes', type : 'boolean', description : 'the default value for KillUserProcesses= setting') diff --git a/src/login/70-uaccess.rules b/src/login/70-uaccess.rules index 50dcd2e2758..9e9dbae0e06 100644 --- a/src/login/70-uaccess.rules +++ b/src/login/70-uaccess.rules @@ -45,9 +45,6 @@ SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x014001*", TAG+="uaccess" # DRI video devices SUBSYSTEM=="drm", KERNEL=="card*|renderD*", TAG+="uaccess" -# KVM -SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess" - # smart-card readers ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess" From 4e15a7343cb389e97f3eb4f49699161862d8b8b2 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 31 Oct 2017 08:46:24 -0700 Subject: [PATCH 2/4] udev-rules: Permission changes for /dev/dri/renderD* - Remove the uaccess tag from /dev/dri/renderD*. - Change the owning group from video to render. - Change default mode to 0666. - Add an option to allow users to set the access mode for these devices at compile time. --- meson.build | 2 ++ meson_options.txt | 2 ++ rules/50-udev-default.rules.in | 4 +++- src/login/70-uaccess.rules | 2 +- sysusers.d/basic.conf.in | 1 + 5 files changed, 9 insertions(+), 2 deletions(-) diff --git a/meson.build b/meson.build index 34eed351903..e935a093743 100644 --- a/meson.build +++ b/meson.build @@ -614,6 +614,7 @@ if get_option('wheel-group') endif substs.set('DEV_KVM_MODE', get_option('dev-kvm-mode')) +substs.set('GROUP_RENDER_MODE', get_option('group-render-mode')) kill_user_processes = get_option('default-kill-user-processes') conf.set10('KILL_USER_PROCESSES', kill_user_processes) @@ -2452,6 +2453,7 @@ status = [ 'maximum system UID: @0@'.format(system_uid_max), 'maximum system GID: @0@'.format(system_gid_max), '/dev/kvm access mode: @0@'.format(get_option('dev-kvm-mode')), + 'render group access mode: @0@'.format(get_option('group-render-mode')), 'certificate root: @0@'.format(get_option('certificate-root')), 'support URL: @0@'.format(support_url), 'nobody user name: @0@'.format(get_option('nobody-user')), diff --git a/meson_options.txt b/meson_options.txt index 50f24df1b35..037c298887c 100644 --- a/meson_options.txt +++ b/meson_options.txt @@ -146,6 +146,8 @@ option('nobody-group', type : 'string', value : 'nobody') option('dev-kvm-mode', type : 'string', value : '0666', description : '/dev/kvm access mode') +option('group-render-mode', type : 'string', value : '0666', + description : 'Access mode for devices owned by render group (e.g. /dev/dri/renderD*, /dev/kfd).') option('default-kill-user-processes', type : 'boolean', description : 'the default value for KillUserProcesses= setting') option('gshadow', type : 'boolean', diff --git a/rules/50-udev-default.rules.in b/rules/50-udev-default.rules.in index d3d1c9a2067..b17d3cf87e6 100644 --- a/rules/50-udev-default.rules.in +++ b/rules/50-udev-default.rules.in @@ -31,11 +31,13 @@ SUBSYSTEM=="input", KERNEL=="js[0-9]*", MODE="0664" SUBSYSTEM=="video4linux", GROUP="video" SUBSYSTEM=="graphics", GROUP="video" -SUBSYSTEM=="drm", GROUP="video" +SUBSYSTEM=="drm", KERNEL!="renderD*", GROUP="video" SUBSYSTEM=="dvb", GROUP="video" SUBSYSTEM=="media", GROUP="video" SUBSYSTEM=="cec", GROUP="video" +SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="@GROUP_RENDER_MODE@" + SUBSYSTEM=="sound", GROUP="audio", \ OPTIONS+="static_node=snd/seq", OPTIONS+="static_node=snd/timer" diff --git a/src/login/70-uaccess.rules b/src/login/70-uaccess.rules index 9e9dbae0e06..e946bf2380b 100644 --- a/src/login/70-uaccess.rules +++ b/src/login/70-uaccess.rules @@ -43,7 +43,7 @@ SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x010001*", TAG+="uaccess" SUBSYSTEM=="firewire", ATTR{units}=="*0x00a02d:0x014001*", TAG+="uaccess" # DRI video devices -SUBSYSTEM=="drm", KERNEL=="card*|renderD*", TAG+="uaccess" +SUBSYSTEM=="drm", KERNEL=="card*", TAG+="uaccess" # smart-card readers ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess" diff --git a/sysusers.d/basic.conf.in b/sysusers.d/basic.conf.in index 7d6021e855a..6c23f4216dd 100644 --- a/sysusers.d/basic.conf.in +++ b/sysusers.d/basic.conf.in @@ -32,6 +32,7 @@ g lp - - - g kvm - - - g tape - - - g video - - - +g render - - - # Default group for normal users g users - - - From f301622d840ae414e7f56c364fe9b035f3041539 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Tue, 31 Oct 2017 08:56:19 -0700 Subject: [PATCH 3/4] udev-rules: Add rule for /dev/kfd --- rules/50-udev-default.rules.in | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/50-udev-default.rules.in b/rules/50-udev-default.rules.in index b17d3cf87e6..71e716913ce 100644 --- a/rules/50-udev-default.rules.in +++ b/rules/50-udev-default.rules.in @@ -37,6 +37,7 @@ SUBSYSTEM=="media", GROUP="video" SUBSYSTEM=="cec", GROUP="video" SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="@GROUP_RENDER_MODE@" +SUBSYSTEM=="kfd", GROUP="render", MODE="@GROUP_RENDER_MODE@" SUBSYSTEM=="sound", GROUP="audio", \ OPTIONS+="static_node=snd/seq", OPTIONS+="static_node=snd/timer" From 3754abc58facf6ed76be77d8645d12a2b0ebafa7 Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Wed, 8 Nov 2017 08:35:23 -0800 Subject: [PATCH 4/4] NEWS: Add note about udev changes for /dev/kvm, /dev/dri/renderD*, and /dev/kfd --- NEWS | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/NEWS b/NEWS index ecd12d32be2..46d9b2ebd9b 100644 --- a/NEWS +++ b/NEWS @@ -14,6 +14,10 @@ CHANGES WITH 236 in spe: achieves a more correct DNS resolution by software that bypasses local DNS APIs (e.g. NSS). + * uaccess tag has been dropped from /dev/kvm and /dev/dri/renderD*. + These devices now have 0666 permsions by default. /dev/dri/renderD* + will now be owned by the render group along with /dev/kfd. + CHANGES WITH 235: * A new modprobe.d drop-in is now shipped by default that sets the