| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Remove the use of a systemd user session to align with how upstream
runs Weston, and to allow using all systemd sandboxing features with
the compositor and homescreen, launcher, etc. applications. The
changes for this touched enough packagegroups and images that further
rework was done to address some of the cleanup described in SPEC-4813,
see below for details.
Changes:
- Remove agl-session and update various recipes that were manually
adding dependencies to the user session it created. The compositor
(be it weston or agl-compositor) and Wayland clients now run in the
system session as non-root users.
- Revive agl-users recipe, this time living in meta-agl-core, with
the purpose of creating the agl-driver user. For simplicity,
agl-compositor is always run as the agl-driver user, as opposed to
trying to wrangle running it as different users depending on build
configuration. This can potentially be made more configurable if a
downstream user has a usecase to be able to specify another user.
- Fully split agl-compositor's systemd unit with a tweaked fork of the
weston-init recipe and unit which lives in meta-agl-core. This will
be easier to maintain than the attempt to reuse weston-init for
builds without meta-app-framework that was done previously.
- Create packagegroup-agl-graphical-compositor, distinct from the
weston packagegroup. This should make it more straightforward for
downstreams that want agl-compositor or weston.
- Rename agl-image-agl-compositor to agl-image-compositor to remove
redundancy.
- Tweak the logic for the inclusion of a few debug packages (e.g.
agl-shell-activator) to ensure they only show up in images when
agl-devel is enabled.
- Split weston-terminal and the required icon resources into separate
packages in our weston bbappend to avoid pulling in weston just to
get the terminal for testing.
- Add a agl-core-image.bbclass to use as a base for images.
- Move our cross-SDK configuration to a agl-crosssdk.bbclass to ease
reuse.
- Remove various empty packagegroups.
- Unify image .inc files with their .bb files as a simplification,
and to move towards more how upstream Yocto Project does things.
- Split pipewire tools into their own -devel packagegroup.
- Remove rcar3 additions to packagegroup-agl-graphical-multimedia, as
that packagegroup is not machine-specific. They will be added back
in via a change in meta-agl-demo. If a downstream user desires a
platform-specific packagegroup for such packages in meta-agl-core,
this can be revisited, though a different implementation should be
used.
- Replace some :append usage with += to avoid creating problems
for downstream users.
Bug-AGL: SPEC-4714, SPEC-4813
Change-Id: I55b29bf749f0d5d50993a362c665bce62b785f67
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28996
Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
Previously agl-driver user was part of applaunchd group for D-Bus activation
to work woth the correct access rights. Now that D-Bus activation has been
removed from applaunchd, agl-driver user no longer needs to be in the same
group with applaunchd.
Bug-AGL: SPEC-4801
Change-Id: Ia473b391432d8c797cd38c0841f7fe655dcdb8e6
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28930
Reviewed-by: Scott Murray <scott.murray@konsulko.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
|
|
Since applaunchd needs to start/stop systemd units, the user is granted
elevated systemd unit-management permissions via PolKit policy. If applaunchd
and all the apps run under the same agl-driver user, all the apps have these
elevated systemd permissions too. Separating them into different users allows
removing elevated systemd unit-management permission from individual apps, but
leaving such permission for applaunchd, which enhances overall security of
the system.
- add new applaunchd user and group
- switch applaunchd (gRPC) service to be started under new user
- since HTML5 apps haven't migrated to gRPC yet and still use D-Bus API,
applaunchd-dbus gets activated by agl-session and runs under agl-driver
- temporarily add agl-driver user into the applaunchd group and switch
PolKit policy to check for applaunchd group, instead of the user
- once D-Bus API is completely deprecated, agl-driver user can be removed
from applaunchd group
Bug-AGL: SPEC-4579
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Change-Id: I75384177578bba6cb458a81df6a9dc1738c972e0
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/28039
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
Changes to support the move to systemd unit based app enumeration in
applaunchd:
- Bump applaunchd SRCREV to pick up enumeration changes.
- Tweak the polkit rule to match agl-app* instead of agl-app@*
to allow more flexibility with respect to different app templates.
- Tweak the Description field definition in the agl-app service
template to just use the instance name, as that field is now used
for the application display name by applaunchd.
- Add a agl-app-web service template for web apps.
- Add a agl-app.bbclass for use in application recipes to simplify
installation of the now required systemd template instances and
potential generation of override files to tweak application
configuration.
- Split the agl-app and agl-app-web templates into their own packages
in the applaunchd recipe so they can be depended on by applications
as required.
- Move applaunchd installed systemd units and override files to
/lib/systemd/system since that matches the upstream recommendation
for units installed as part of the system installation.
Bug-AGL: SPEC-4466
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Change-Id: I32ff6c9624850662856b79a2b14b33a05e7f9a65
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27835
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
Reviewed-by: Jose Dapena Paz <jdapena@igalia.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
Bug-AGL: SPEC-4466
Signed-off-by: Denys Dmytriyenko <denys@konsulko.com>
Change-Id: I8007aacc12f8b6bdfbca660c994d321ef1b5eca7
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27751
Reviewed-by: Scott Murray <scott.murray@konsulko.com>
Reviewed-by: Marius Vlad <marius.vlad@collabora.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
- Update agl-session recipe to add agl-driver to pipewire
group
- Apps in the new framework can access pipewire services
if agl-driver is a part of pipewire group.
Bug-AGL: SPEC-4210
Signed-off-by: Ashok Sidipotu <ashok.sidipotu@collabora.com>
Change-Id: Iba3856006b36c0182aaa0e36e8e98f85d9c49af3
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27100
Reviewed-by: Georgios Kiagiadakis <george.kiagiadakis@collabora.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
|
|
Tweak agl-driver user definition in agl-session recipe to ensure
it is a member of the video and display groups (the latter has
been added back to the static group file). This is required to
avoid agl-compositor startup failures on rcar3. The display
group membership potentially could be dropped if we were to
bbappend rcar3's gles-user-module recipe to tweak its udev rules.
For now, take the most straightforward approach.
Bug-AGL: SPEC-4161
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Change-Id: I7237ade5d8680655f17716ac048349a476eb5f29
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27060
Tested-by: Jenkins Job builder account
ci-image-build: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
|
|
Add installation of a systemd user-environment-generator scriptlet
to the agl-session recipe to ensure that XDG_DATA_DIRS is set to a
reasonable default value. This is required for locating D-Bus
activation .service files and icons.
Bug-AGL: SPEC-4182
Signed-off-by: Scott Murray <scott.murray@konsulko.com>
Change-Id: I5d1a72022ca97f25a915b64205bf70ab33516ec6
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/27048
Reviewed-by: Arnaud Ferraris <arnaud.ferraris@collabora.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
For the new App FW, we want to create a systemd user session, to be
started on boot, which will be used to start the compositor and all user
background services.
This commit adds the corresponding target and service file (enabled by
default) so the session is started on boot.
Bug-AGL: SPEC-4161
Signed-off-by: Arnaud Ferraris <arnaud.ferraris@collabora.com>
Change-Id: I51ca7e0c1a994c6798b20b2592bec56a07f41c98
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/c/AGL/meta-agl/+/26974
ci-image-build: Jenkins Job builder account
Tested-by: Jenkins Job builder account
ci-image-boot-test: Jenkins Job builder account
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
This is the last larger commit in this series and deals with the graphical part.
We introduce the graphical profiles:
- meta-agl-profile-graphical
-- meta-agl-profile-graphical-html5
-- meta-agl-profile-graphical-qt5
Notable changes:
- weston-ini-conf moved to the meta-agl-bsp layer. Most BSPs have bbappends, so we need to have the recipes present (but unused) even in the console images.
- new image: agl-image-boot = terminal-only + network + package-manaager. Ready for using package-feeds
- new image/sdk: agl-image-minimal-crosssdk
- agl-service-mediaplayer has a dependency on weston, thus it cannot be in the 'core'. Moved it to profile-graphical.
- The wayland-ivi-extension moved to the agl-demo-platform.
- The app-framework layer included and pulled 'web-runtime' as dependency. This broke console-only images. This has been moved to be in meta-agl-demo only for now.
- added and massaged the agl-features.
- found and added a useful script 'oe-depends-dot' that helps to work with the dot files (produced with bitbake -g)
Todo:
- we'll need another pass through the packagegroups. The dependencies for the layers/profiles are now sorted-out but we might have to add/shuffle a few packages.
For further details, see meta-agl/docs/profiles.md.
v2: fix meta-agl/meta-security/conf/layer.conf - the immediate expansion previously used in there caused some recipes not being added to BBFILES.
v3: fix packagegroup renaming (packagegroup-agl-devel -> packagegroup-agl-core-devel)
v4: fix missing packagegroup inclusion (tnx Jose, Scott, Stephane)
v5: fix missing packagegroup inclusion
v6: explicitely put profile-graphical-qt5 on-top of profile-graphical
v7: re-add 'procps' when agl-devel feature is on
Bug-AGL: SPEC-145
Change-Id: I24cdcd1118932758d0c55d333338238f2a770877
Signed-off-by: Jan-Simon Möller <jsmoeller@linuxfoundation.org>
|
|
Bug-AGL: SPEC-1121
Change-Id: Id31e34af1276682dbe39457a145889f0d0c7e7c3
Signed-off-by: Romain Forlot <romain.forlot@iot.bzh>
|
|
While dealing with systemd as a launcher, it appeared
a limitation. If the template argument of units is used
to designate the user it can not be different that the
UID as a number because systemd enforce XDG_RUNTIME_DIR
to be /run/user/<UID>.
Thus using UID is the way to go to use template mechanic
of systemd and use systemd as launcher. This is of
importance because we don't expect systemd user to have
full capabilities. Instead the framework will continue
to leverage systemd launching mechanism but at a system
level, with full capabilities but wil only allow user
applications to deal with systemd --user. This impose to
use UID as template parameters.
The problem is then to set the user directory to the
correct value knowing only the UID and using only
possibilities of units. The only way is to have user
home directories of the form /SOMETHING/<UID> (where
SOMETHING is merely "home").
This can be achieved either by setting a symbolic link
(hard link tto directories are forbidden) or by simply
using the scheme /home/UID in all cases.
At the end, users within AGL will not receive nick names
but will receive allocated UID. So, at the end, it is
not a problem to use the regular naming scheme /home/UID,
a scheme that will probably never be seen except by tools
or experts.
This patch implement this choice.
Change-Id: I225958fa627894cb966f52a06ebd8a914058d429
Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/12137
Tested-by: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
ci-image-build: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
Reviewed-by: Stéphane Desneux <stephane.desneux@iot.bzh>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
agl-ivi-image is using agl-login-manager and agl-desktop-config.
However, those aren't included in meta-agl layer.
So agl-ivi-image isn't built only with meta-agl layer.
Bug-AGL: SPEC-625
Change-Id: Ied4bbec9c72d2f7cac5b01c2465fe395c2e5497c
Signed-off-by: Changhyeok Bae <changhyeok.bae@gmail.com>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/9587
Reviewed-by: Martin Kelly <mkelly@xevo.com>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
Tested-by: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
ci-image-build: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
ci-image-boot-test: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
|
|
* Create a user/group display
* Allow weston to start without mandatory root user
* start weston-terminal for each user
Bug-AGL: SPEC-546
Change-Id: Id50acdbf5f7c07d5e0440575d42998b8819b5547
Signed-off-by: Ronan Le Martret <ronan.lemartret@iot.bzh>
Reviewed-on: https://gerrit.automotivelinux.org/gerrit/9135
Tested-by: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
ci-image-build: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
ci-image-boot-test: Jenkins Job builder account <agl-jobbuilder@automotivelinux.org>
Reviewed-by: Dominig ar Foll <dominig.arfoll@fridu.net>
Reviewed-by: José Bollo <jobol@nonadev.net>
Reviewed-by: Stéphane Desneux <stephane.desneux@iot.bzh>
Reviewed-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org>
|
|
This setting is introduced primarily to allow the
recipe agl-users to run in a correct environment.
Change-Id: Ib0bd7c8e6520bd87dbb26d9c011f5cb4672f44c7
Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
|
|
meta-app-framework is a layer containing the AGL App Framework recipes
4 new layers are added for application framework:
* meta-intel-iot-security/meta-security-smack
* meta-intel-iot-security/meta-security-framework
* meta-agl/meta-agl-security
* meta-agl/meta-app-framework
Configuration file changes to support AppFw:
* activation of Smack and Cynara
* modify the tar command to be used to support Smack extended attributes
Change-Id: Idc8abdc8869787feb4b534ee45bf7b5d3dde3632
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
|
|
This reverts commit 80f4d503fc5bb2564b72b72daedebf74612c30f3.
Change-Id: I94605d4c0ef80433fa6eaa05e63a9c6cf69baea4
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
|
|
meta-app-framework is a layer containing the AGL App Framework recipes
4 new layers are added for application framework:
* meta-intel-iot-security/meta-security-smack
* meta-intel-iot-security/meta-security-framework
* meta-agl/meta-agl-security
* meta-agl/meta-app-framework
In the templates files, the following changes were done:
* activation of Smack and Cynara
* modify the tar command to be used to support Smack extended attributes
Change-Id: If369221ca7614fe0072f2a0f99a5051ef2af831d
Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
|
Scott Murray
Denys Dmytriyenko
Ashok Sidipotu
Arnaud Ferraris
Jan-Simon Möller
Romain Forlot
José Bollo
Changhyeok Bae
Ronan Le Martret
Stephane Desneux