enricobuehler
2e753fd84d
ci / rust-arm64 (pull_request) Successful in 1m23s
ci / bun-nix (pull_request) Successful in 1m26s
ci / web (pull_request) Successful in 4m22s
ci / docs-site (pull_request) Successful in 4m32s
ci / rust (pull_request) Failing after 4m57s
android / android (pull_request) Successful in 13m27s
Field-diagnosed on Bazzite 43 (2026-08-15): the virtual DualSense/DualShock 4 binds hid-playstation, and Valve's ds_inhibit (steamos-manager) reacts to every open/close of any such hidraw by walking /proc/*/fd — it has no VID/PID or virtual filtering. SELinux denies steamos_manager_t that walk (sys_ptrace, dac_read_search, dac_override) at ~324 AVCs/sec, and setroubleshootd amplifies the flood into a box-wide fork storm (267+ procs/sec, a core burned, RSS climbing for 15+ min AFTER the denials stop) that starves the stream: gamescope 0 fps, encode submit ~150 ms/frame, tx 300 -> 1 Mbps, session death. punktfunk is the trigger, not the defect — but we ship the trigger. - packaging/bazzite/punktfunk-ds-inhibit.cil: a dontaudit drop-in (dontaudit, not allow — granting another vendor's daemon sys_ptrace/dac_* is not ours to do; the scan keeps failing quietly and ds_inhibit leaves the pad uninhibited, which is what we want anyway). The RPM ships the source under /usr/share/punktfunk/selinux/ (the policy STORE is host state, so a sysext image can only carry source); inserted idempotently by punktfunk-sysext post_merge / reapply and best-effort by the RPM %post, both keyed on the steamos-manager binary and on the module name — rename the .cil if its rules ever change, or existing installs never converge. - native/gamepad.rs: warn_if_ds_inhibit_storm in the resolve_gamepad funnel — one-shot, warn-only (a per-pad degrade has no wire channel back to the client and would strip the DS5 feature set exactly where users want it). Fires on steamos-manager running + SELinux enforcing, and puts the cause in OUR logs: the AVC lines read comm="tokio-rt-worker" and look like us. - packaging/bazzite/README.md: the failure chain, both diagnosis traps, and the setroubleshootd mask as general hardening (any AVC burst reproduces the amplifier; nothing depends on that daemon). Not pursued: suppressing the touchpad mouse node to duck ds_inhibit's selection — hid-playstation registers the touchpad from hardcoded driver code (ps_touchpad_create in dualsense_create/dualshock4_create), not from our HID descriptor, so no descriptor shaping can remove it. Verified: gamepad tests incl. the new detection test pass on linux-gnu (punktfunk-rust-ci container); clippy --all-targets -D warnings clean; the CIL compiles under secilc against a stub base (planted-error control caught); shellcheck clean on punktfunk-sysext.sh.
29 lines
2.1 KiB
Plaintext
29 lines
2.1 KiB
Plaintext
; SELinux drop-in for Bazzite / SteamOS-derived hosts: silence the audit flood Valve's
|
|
; ds_inhibit (inside steamos-manager) produces around ANY `hid-playstation` hidraw —
|
|
; which is exactly what punktfunk's virtual DualSense / DualShock 4 is (ds_inhibit
|
|
; selects by bound driver + touchpad mouse node; it has no VID/PID or virtual filtering).
|
|
;
|
|
; ds_inhibit reacts to every open/close of such a hidraw by walking /proc/*/fd/ to see
|
|
; whether Steam holds the node. The distro policy denies steamos_manager_t the three
|
|
; capabilities that walk needs, so the scan never succeeds, the state machine never
|
|
; latches, and every open/close sprays denials — ~324 AVCs/sec measured on Bazzite 43
|
|
; (2026-08-15). setroubleshootd then amplifies the flood into a box-wide fork storm
|
|
; (267+ procs/sec) that starves the stream: gamescope 0 fps, encode submit ~150 ms/frame.
|
|
;
|
|
; dontaudit, NOT allow: granting another vendor's daemon sys_ptrace/dac_override is not
|
|
; ours to do — silencing the audit noise is. The scan keeps failing quietly and
|
|
; ds_inhibit simply leaves the pad uninhibited, which is what we want anyway (the
|
|
; "inhibit" would disable the touchpad-as-mouse of a pad we created for a game). The
|
|
; underlying gap — steamos_manager_t lacking what its own ds_inhibit needs — is a
|
|
; Bazzite/Valve policy bug; this drop-in is the containment we can ship. A bare,
|
|
; un-amplified AVC is cheap, but with dontaudit not even that remains.
|
|
;
|
|
; Installed idempotently by `punktfunk-sysext` post_merge (and best-effort by the RPM
|
|
; %post) wherever steamos-manager exists; the policy store is host state, so a sysext
|
|
; image cannot carry the module itself — only this source. By hand:
|
|
; sudo semodule -i punktfunk-ds-inhibit.cil # remove: sudo semodule -r punktfunk-ds-inhibit
|
|
; ⚠ The installers key idempotence on the module NAME (= this filename): if these rules
|
|
; ever change, rename the file (and every reference) so existing installs converge.
|
|
(dontaudit steamos_manager_t self (capability (dac_override dac_read_search sys_ptrace)))
|
|
(dontaudit steamos_manager_t self (cap_userns (sys_ptrace)))
|