From 169dab71a063f4fab6c46f95e11d6e85b140cb8f Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Sun, 9 Aug 2026 11:20:43 -0500 Subject: feat: enable the podman API socket and ship the camera udev grant Two one-time machine setups from the winvm handoffs now happen at install time. - The devops podman block enables the rootless podman API socket. Socket-activated, so it costs nothing idle, and API clients like Pods fail with an empty window without it. enable_user_service grew an optional wants-target argument because a socket unit's [Install] is WantedBy=sockets.target. The old default.target link would never socket-activate. - install_camera_passthrough_rules ships 72-usb-passthrough-cameras.rules: GROUP="video", MODE="0660" plus the uaccess tag on the OBSBOT and BRIO USB IDs, so usbredirect can claim them for VM passthrough. The filename is load-bearing: logind's ACL is applied by 73-seat-late.rules, so the tag only works from a file sorting below 73. A test pins that property. Both are live on ratio (the old 99- rules file is retired there). Whether uaccess alone would suffice from the corrected position is untested and stays documented as a hypothesis. --- docs/design/2026-08-07-podman-socket-and-camera-udev.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'docs/design') diff --git a/docs/design/2026-08-07-podman-socket-and-camera-udev.md b/docs/design/2026-08-07-podman-socket-and-camera-udev.md index 7eb99e8..f9477a2 100644 --- a/docs/design/2026-08-07-podman-socket-and-camera-udev.md +++ b/docs/design/2026-08-07-podman-socket-and-camera-udev.md @@ -68,3 +68,18 @@ principle; it just isn't sufficient. I lost time on that, so it is recorded rather than left to be rediscovered. Both items are live on ratio and neither exists on velox. + +## Correction (winvm, 2026-08-08) + +The udev mechanism claim in section 2 above is wrong and stands corrected by +the sender: `TAG+="uaccess"` does apply to raw `SUBSYSTEM=="usb"` devices +(`70-uaccess.rules` tags them in several places). The real failure was rule +ordering — the ACL is applied by `73-seat-late.rules:16`, and a rule file +numbered `99-` adds the tag after that test has run. Every distro rule adding +the tag sorts at or below 70. + +The `GROUP="video", MODE="0660"` grant remains the verified working fix. +Untested hypothesis from the sender: a rule file numbered below 73 would +likely make uaccess work on its own (a tighter grant than the group). The +installer task ships the rule numbered below 73 with both mechanisms and +leaves the uaccess-alone test for when the camera is attached. -- cgit v1.2.3