Bug 2319766 - iio-sensor-proxy systemd unit service fails
Summary: iio-sensor-proxy systemd unit service fails
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: iio-sensor-proxy
Version: 41
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Michel Lind
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-18 12:19 UTC by Kefah Issa
Modified: 2024-11-25 08:11 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-11-25 08:11:05 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Kefah Issa 2024-10-18 12:19:50 UTC
Reproducible: Always

Steps to Reproduce:
1. Install fedora 41 on Lenovo X1 2-in-1 gen 9
2. Fold the screen


Actual Results:  
Folding the screen would not rotate it in any direction

Expected Results:  
Fold the screen should rote it in 4 directions


When trying to start the service (iio-sensor-proxy.service) I get permission denied errors (respectively many selinux avc denies). 

My theory ...
The device files the service was trying to access had SE context system_u:object_r:sysfs_t

While the user under systemd service had
system_u:object_r:initrc_t


1st workaround:
Running /usr/libexec/iio-sensor-proxy directly as root works without issues, and as long as this process is running, rotation is detected properly. 

2nd work around:
sudo grep iio-sensor /var/log/audit/audit.log | grep denied | audit2allow -M iio_sensor

Then applying that changes 
semodule -i iio_sensor.pp

Restarting the laptop, everything is working fine.

Above as just workarounds, as they do not offer a working rotation detection out of a fresh fedora 41 installation.

Comment 1 Kefah Issa 2024-10-18 12:24:43 UTC
The generated iio_sensor.te file 

module iio_sensor 1.0;

require {
	type device_t;
	type sysfs_t;
	type iiosensorproxy_t;
	class file write;
	class dir { add_name write };
	class unix_dgram_socket create;
	class chr_file { open read };
}

#============= iiosensorproxy_t ==============

allow iiosensorproxy_t device_t:chr_file { open read };
allow iiosensorproxy_t self:unix_dgram_socket create;
allow iiosensorproxy_t sysfs_t:dir write;
allow iiosensorproxy_t sysfs_t:dir add_name;
allow iiosensorproxy_t sysfs_t:file write;

Comment 2 Michael Anthony 2024-10-20 09:53:39 UTC
I can confirm this bug also affects Fedora 41 Beta on Microsoft 2 in 1 and Dell tablet devices for me.

The live iso for the Beta downloaded from the Fedora site and the initial installation both work correctly.  However, after a dnf update, the screen autorotation stops working. 

The workarounds in the previous message both work for me once logged into the Gnome desktop however, the GDM login screen still does not rotate automatically.  

In previous Fedora releases, both the GDM and Gnome desktop screens rotated automatically. 

Also, in previous Fedora releases, the screen brightness responded to the surrounding light levels automatically.  I believe this funcionality is also provided via iio-sensor-proxy.

Comment 3 Steve 2024-11-07 18:31:50 UTC
This appears to be a duplicate of the following bug, which is filed against component selinux-policy:

Bug 2324181 - selinux is denying iio-sensor-proxy write access to sysfs which it needs for certain iio sensors

Comment 4 Zdenek Pytela 2024-11-25 08:11:05 UTC
The first part has been resolved, the second one continues in bz#2324181.


Note You need to log in before you can comment on or make changes to this bug.