[SUGGESTION] Finer control over /sys/kernel/debug access

[nicolasdespres]

Please only include one suggestion or features request per issue!

Is your feature request related to a problem? Please describe.
Camera IA model's firmware upload progress is read from /sys/kernel/debug/imx500-fw:{imx500_device_id}/fw_progress which requires the user to be a member of the sudo group to pass through /sys/kernel/debug:

$ namei -l /sys/kernel/debug/imx500-fw:10-001a/fw_progress
f: /sys/kernel/debug/imx500-fw:10-001a/fw_progress
drwxr-xr-x root root /
dr-xr-xr-x root root sys
drwxr-xr-x root root kernel
drwxr-x--- root sudo debug                   # <----------
drwxr-xr-x root root imx500-fw:10-001a
-r--r--r-- root root fw_progress

In a school/university/training environment, it is common to have multiple human users for a single Raspberry Pi. In such an environment giving root access (via sudo) to the user used by the trainees is not always wanted.

Describe the solution you'd like
A solution would be to implement a dedicated command that does cat /sys/kernel/debug/imx500-fw:10-001a/fw_progress and spawns this command instead of opening the file at IMX500.init. The command could then be runnable by member of the sudo group. This approach is backward compatible with current behavior and allow other users to add sudo access only to that specific command instead of complete sudo access.

Describe alternatives you've considered
A dedicated debugfs group could be set for access to /sys/kernel/debug instead of the sudo group, but that give access to the entire /sys/kernel/debug directory. As far as I can tell, the picamera2 library only access this directory for monitoring the firmware upload progress.

Additional context
If the suggested approach is validated, I will send a PR.

[davidplowman]

@naushir Could we do something like this?

[naushir]

Yes, this seems reasonable. As a first pass, perhaps we should just add a PR that fails gracefully if you cannot read from /sys/kernel/debug. In such cases we log a warning and continue without a statusbar. After that, we can look to add an external reader

[naushir]

#1378 handles the first bit.

[nicolasdespres]

Thank you for your feedback. I'll send a PR by the end of the week.

[davidplowman]

Actually I was just looking at this myself, here's the result. The behaviour is:

• If you can read from /sys/kernel/debug, it will just work, as before.
• Otherwise someone with root access needs to install the feature is described in the text file. We could look into the possibility of doing that installation automatically in future.

[nicolasdespres]

I just tested your solution and it works for me.

I would only suggest to add these three lines at the end of the documentation text file:

If you want to narrow the access right to a single group:

%mygroup ALL=(root) NOPASSWD: /usr/sbin/debug_stream_imx500.sh
%mygroup ALL=(root) NOPASSWD: /usr/sbin/debug_stream_rp2040.sh

Thanks for the patch.

[davidplowman]

Thanks for trying it out, and for the documentation change which I agree is an improvement. I've updated the text to reflect that, and merged the PR. We're intending to do a release "in the next few days", so it should be generally available quite soon, hopefully!

[nicolasdespres]

Fantastic! Thank you for your responsiveness :)