User gpio-manager has no permission to run the DBus daemon

[o-alquimista]

Based on the DBus policy below...

  <!-- Daemon must run as the `gpio-manager` user. -->
  <policy user="gpio-manager">
    <allow own="io.gpiod1"/>
  </policy>

I've created the following system user:

gpio-manager:x:107:65533:libgpiod DBus daemon:/dev/null:/sbin/nologin

Attempting to run the DBus daemon as that user results in permission errors.

$ doas -u gpio-manager gpio-manager
gpio-manager-Message: 23:14:23.745: initializing gpio-manager
gpio-manager-Message: 23:14:23.747: gpio-manager started

(gpio-manager:30557): gpio-manager-CRITICAL **: 23:14:23.751: failed to open GPIO chip /dev/gpiochip0: unable to open GPIO chip '/dev/gpiochip0': Permission denied

(gpio-manager:30557): gpio-manager-CRITICAL **: 23:14:23.751: failed to open GPIO chip /dev/gpiochip1: unable to open GPIO chip '/dev/gpiochip1': Permission denied

(gpio-manager:30557): gpio-manager-ERROR **: 23:14:23.752: name 'io.gpiod1' lost on the bus
Trace/breakpoint trap
$ 

Running as root, it works:

$ doas gpio-manager
gpio-manager-Message: 23:15:11.453: initializing gpio-manager
gpio-manager-Message: 23:15:11.456: gpio-manager started

$ gpiocli detect
gpiochip0 [pinctrl-bcm2711] (58 lines)
gpiochip1 [raspberrypi-exp-gpio] (8 lines)

Any idea why?

I'm on Alpine Linux, building from source. Alpine did package v2.2, but did not enable DBus.

---

UPDATE: forgot to reload DBus

Reloading DBus allowed it to be started as the user gpio-manager, but it still does not have permission to read /dev/gpiochip0 and /dev/gpiochip1.

Dec  6 00:55:53 oxygen daemon.err libgpiod: gpio-manager-Message: 00:55:53.629: initializing gpio-manager
Dec  6 00:55:53 oxygen daemon.err libgpiod: gpio-manager-Message: 00:55:53.631: gpio-manager started
Dec  6 00:55:53 oxygen daemon.err libgpiod: 
Dec  6 00:55:53 oxygen daemon.err libgpiod: (gpio-manager:31537): gpio-manager-CRITICAL **: 00:55:53.635: failed to open GPIO chip /dev/gpiochip0: unable to open GPIO chip '/dev/gpiochip0': Permission denied
Dec  6 00:55:53 oxygen daemon.err libgpiod: 
Dec  6 00:55:53 oxygen daemon.err libgpiod: (gpio-manager:31537): gpio-manager-CRITICAL **: 00:55:53.635: failed to open GPIO chip /dev/gpiochip1: unable to open GPIO chip '/dev/gpiochip1': Permission denied

On the filesystem, they are owned by root:root.

$ ls -al /dev
crw-rw----    1 root     root      254,   0 Dec 31  1969 gpiochip0
crw-rw----    1 root     root      254,   1 Dec 31  1969 gpiochip1

Would it be unwise to change the ownership of these devices?

[brgl]

Do you have udev rules in place to make them accessible to the gpio group? The file is in the repo: https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/dbus/data/90-gpio.rules

[o-alquimista]

I must have missed that file. So the gpio-manager user must be a member of group gpio?

[brgl]

Yes, please see how I integrated it in meta-openembedded: https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libgpiod/libgpiod_2.2.bb

This is what distros should do in general.

[o-alquimista]

Thanks, it's working now.

For future reference

Because I use mdev (Busybox device manager), I had to translate the udev rules:

# /etc/mdev.conf
# libgpiod
SUBSYSTEM=gpio;gpiochip[0-9]*   root:gpio 0660

And the gpio-manager user:

# adduser -S -H -s /sbin/nologin -G gpio -g 'libgpiod DBus daemon' -h /dev/null gpio-manager
gpio-manager:x:107:107:libgpiod DBus daemon:/dev/null:/sbin/nologin

[brgl]

In any case the way it's integrated in meta-openembedded and the files in the repo are just an example - you can as well make it run as root and not play with udev at all.