summaryrefslogtreecommitdiffstats
path: root/meta-app-framework/recipes-config/agl-session
AgeCommit message (Collapse)AuthorFilesLines
2022-10-08meta-app-framework: applaunchd: run under a separate userDenys Dmytriyenko1-1/+5
Since applaunchd needs to start/stop systemd units, the user is granted elevated systemd unit-management permissions via PolKit policy. If applaunchd and all the apps run under the same agl-driver user, all the apps have these elevated systemd permissions too. Separating them into different users allows removing elevated systemd unit-management permission from individual apps, but leaving such permission for applaunchd, which enhances overall security of the system. - add new applaunchd user and group - switch applaunchd (gRPC) service to be started under new user - since HTML5 apps haven't migrated to gRPC yet and still use D-Bus API, applaunchd-dbus gets activated by agl-session and runs under agl-driver - temporarily add agl-driver user into the applaunchd group and switch PolKit policy to check for applaunchd group, instead of the user - once D-Bus API is completely deprecated, agl-driver user can be removed from applaunchd group Bug-AGL: SPEC-4579 Signed-off-by: Denys Dmytriyenko <denys@konsulko.com> Change-Id: I75384177578bba6cb458a81df6a9dc1738c972e0 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28039 Tested-by: Jenkins Job builder account ci-image-build: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
2022-01-30meta-app-framework: add agl-driver to pipewire groupAshok Sidipotu1-1/+2
- Update agl-session recipe to add agl-driver to pipewire group - Apps in the new framework can access pipewire services if agl-driver is a part of pipewire group. Bug-AGL: SPEC-4210 Signed-off-by: Ashok Sidipotu <ashok.sidipotu@collabora.com> Change-Id: Iba3856006b36c0182aaa0e36e8e98f85d9c49af3 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27100 Reviewed-by: Georgios Kiagiadakis <george.kiagiadakis@collabora.com> Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Tested-by: Jenkins Job builder account ci-image-build: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account
2021-12-22meta-app-framework: tweak agl-driver definitionScott Murray1-1/+3
Tweak agl-driver user definition in agl-session recipe to ensure it is a member of the video and display groups (the latter has been added back to the static group file). This is required to avoid agl-compositor startup failures on rcar3. The display group membership potentially could be dropped if we were to bbappend rcar3's gles-user-module recipe to tweak its udev rules. For now, take the most straightforward approach. Bug-AGL: SPEC-4161 Signed-off-by: Scott Murray <scott.murray@konsulko.com> Change-Id: I7237ade5d8680655f17716ac048349a476eb5f29 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27060 Tested-by: Jenkins Job builder account ci-image-build: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account
2021-12-21meta-app-framework: agl-session: Ensure XDG_DATA_DIRS is setScott Murray2-1/+16
Add installation of a systemd user-environment-generator scriptlet to the agl-session recipe to ensure that XDG_DATA_DIRS is set to a reasonable default value. This is required for locating D-Bus activation .service files and icons. Bug-AGL: SPEC-4182 Signed-off-by: Scott Murray <scott.murray@konsulko.com> Change-Id: I5d1a72022ca97f25a915b64205bf70ab33516ec6 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27048 Reviewed-by: Arnaud Ferraris <arnaud.ferraris@collabora.com> Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
2021-12-17meta-app-framework: add new agl-session recipeArnaud Ferraris3-0/+64
For the new App FW, we want to create a systemd user session, to be started on boot, which will be used to start the compositor and all user background services. This commit adds the corresponding target and service file (enabled by default) so the session is started on boot. Bug-AGL: SPEC-4161 Signed-off-by: Arnaud Ferraris <arnaud.ferraris@collabora.com> Change-Id: I51ca7e0c1a994c6798b20b2592bec56a07f41c98 Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/26974 ci-image-build: Jenkins Job builder account Tested-by: Jenkins Job builder account ci-image-boot-test: Jenkins Job builder account Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>