sessiond-uaccess #

sessiond-uaccess is a sessiond client that grants device-node access to active local sessions by writing POSIX ACL entries.

Installation #

sessiond-uaccess requires sessiond to be installed and enabled first.

On finix with flakes:

{
  inputs.sessiond-uaccess.url = "git+https://tangled.org/r0chd.pl/sessiond-uaccess";
}

{ inputs, pkgs, ... }:
{
  imports = [
    inputs.sessiond-uaccess.finixModules.default
  ];

  services.sessiond-uaccess = {
    enable = true;
    package = inputs.sessiond-uaccess.packages.${pkgs.system}.default;
  };
}

With npins:

npins add git --name sessiond-uaccess https://tangled.org/r0chd.pl/sessiond-uaccess --branch master

{ pkgs, ... }:
let
  sources = import ./npins;
  sessiond-uaccess = import sources.sessiond-uaccess.outPath { };
in
{
  imports = [
    sessiond-uaccess.finixModules.default
  ];

  services.sessiond-uaccess = {
    enable = true;
    package = sessiond-uaccess.packages.sessiond-uaccess;
  };
}

To build it manually:

cargo build --release

The binary is written to target/release/sessiond-uaccess.

Usage #

sessiond-uaccess --rules-dirs PATH [--rules-dirs PATH...]

sessiond-uaccess connects to /run/sessiond/sessiond.sock, loads every *.lua file from each existing rules directory, scans existing udev devices, and then keeps listening for new udev devices and session changes.

mdevd #

sessiond-uaccess can be used with mdevd and libudev-zero. Start mdevd with -O 4 so it rebroadcasts processed uevents to the netlink group used by the libudev monitor:

mdevd -O 4

Rules #

Rules are Lua files that call device with an access mode and match function:

device {
  access = "rw",
  match = function(dev)
    return dev.subsystem == "sound"
  end,
}

The default rules in rules/70-uaccess.lua cover sound devices, cameras, DRI devices, render and accelerator nodes, AMD KFD, KVM, rfkill, and optical drives.