Bug 2319766

Summary:	iio-sensor-proxy systemd unit service fails
Product:	[Fedora] Fedora	Reporter:	Kefah Issa <kefah.issa>
Component:	iio-sensor-proxy	Assignee:	Michel Lind <michel>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	41	CC:	baq2r1ll2, gnome-sig, igor.raits, kde-sig, manthony.nw, michel, mjs, patrick.lang, post, y9t7sypezp, zpytela
Target Milestone:	---	Keywords:	Desktop
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-11-25 08:11:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kefah Issa 2024-10-18 12:19:50 UTC

Reproducible: Always

Steps to Reproduce:
1. Install fedora 41 on Lenovo X1 2-in-1 gen 9
2. Fold the screen


Actual Results:  
Folding the screen would not rotate it in any direction

Expected Results:  
Fold the screen should rote it in 4 directions


When trying to start the service (iio-sensor-proxy.service) I get permission denied errors (respectively many selinux avc denies). 

My theory ...
The device files the service was trying to access had SE context system_u:object_r:sysfs_t

While the user under systemd service had
system_u:object_r:initrc_t


1st workaround:
Running /usr/libexec/iio-sensor-proxy directly as root works without issues, and as long as this process is running, rotation is detected properly. 

2nd work around:
sudo grep iio-sensor /var/log/audit/audit.log | grep denied | audit2allow -M iio_sensor

Then applying that changes 
semodule -i iio_sensor.pp

Restarting the laptop, everything is working fine.

Above as just workarounds, as they do not offer a working rotation detection out of a fresh fedora 41 installation.

Comment 1 Kefah Issa 2024-10-18 12:24:43 UTC

The generated iio_sensor.te file 

module iio_sensor 1.0;

require {
	type device_t;
	type sysfs_t;
	type iiosensorproxy_t;
	class file write;
	class dir { add_name write };
	class unix_dgram_socket create;
	class chr_file { open read };
}

#============= iiosensorproxy_t ==============

allow iiosensorproxy_t device_t:chr_file { open read };
allow iiosensorproxy_t self:unix_dgram_socket create;
allow iiosensorproxy_t sysfs_t:dir write;
allow iiosensorproxy_t sysfs_t:dir add_name;
allow iiosensorproxy_t sysfs_t:file write;

Comment 2 Michael Anthony 2024-10-20 09:53:39 UTC

I can confirm this bug also affects Fedora 41 Beta on Microsoft 2 in 1 and Dell tablet devices for me.

The live iso for the Beta downloaded from the Fedora site and the initial installation both work correctly.  However, after a dnf update, the screen autorotation stops working. 

The workarounds in the previous message both work for me once logged into the Gnome desktop however, the GDM login screen still does not rotate automatically.  

In previous Fedora releases, both the GDM and Gnome desktop screens rotated automatically. 

Also, in previous Fedora releases, the screen brightness responded to the surrounding light levels automatically.  I believe this funcionality is also provided via iio-sensor-proxy.

Comment 3 Steve 2024-11-07 18:31:50 UTC

This appears to be a duplicate of the following bug, which is filed against component selinux-policy:

Bug 2324181 - selinux is denying iio-sensor-proxy write access to sysfs which it needs for certain iio sensors

Comment 4 Zdenek Pytela 2024-11-25 08:11:05 UTC

The first part has been resolved, the second one continues in bz#2324181.