Re: [PATCH v2] optee-client: use udev rule and systemd service from upstream

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Wed, Oct 16, 2024 at 01:54:45PM -0400, Jon Mason wrote:
> On Tue, Oct 15, 2024 at 04:35:12PM +0300, Mikko Rapeli wrote:
> > Use backported upstream patch for udev rule and systemd service file.
> > sysvinit script is still used from meta-arm. Don't install systemd
> > service without systemd distro feature, other way round for
> > sysvinit script.
> > 
> > tee-supplicant started by systemd service runs as non-root teesuppl
> > user with teepriv group. sysvinit still runs as root since busybox
> > start-stop-daemon doesn't support -g group parameter and -u teesuppl
> > doesn't seem to change the effective user.
> > 
> > udev rules allow non-root /dev/tee* access from tee and
> > /dev/teepriv* access from teepriv groups.
> > 
> > Tested sysvinit changes with:
> > 
> > $ kas build ci/qemuarm64-secureboot.yml:ci/poky.yml:ci/testimage.yml
> > 
> > and systemd changes with:
> > 
> > $ kas build ci/qemuarm64-secureboot.yml:ci/poky.yml:ci/testimage.yml:ci/uefi-secureboot.yml
> 
> While this testcase works, the following does not:
> $ kas build ci/qemuarm64-secureboot.yml:ci/qemuarm64-secureboot-ts.yml:ci/uefi-secureboot.yml:ci/testimage.yml
> 
> https://gitlab.com/jonmason00/meta-arm/-/jobs/8091040284

Sorry, I missed this configuration and the additional tee udev rule in
meta-arm/recipes-security/trusted-services/libts/tee-udev.rules
and group settings in meta-arm/recipes-security/trusted-services/libts_git.bb

Will send a v3 with fixes.

Cheers,

-Mikko