fix: backport device mode and system-wide conf

api/schema/v1.json

@@ -1439,6 +1439,12 @@
             "type": "string"
           }
         },
+        "device_mode": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/DeviceOption"
+          }
+        },
         "ext_defs": {
           "description": "external extension definitions to extend the component",
           "type": "object",
@@ -1450,6 +1456,12 @@
           }
         }
       }
+    },
+    "DeviceOption": {
+      "description": "device option",
+      "enum": [
+        "passthru"
+      ]
     }
   },
   "type": "object",
@@ -1594,6 +1606,9 @@
     },
     "RuntimeConfigure": {
       "$ref": "#/$defs/RuntimeConfigure"
+    },
+    "DeviceOption": {
+      "$ref": "#/$defs/DeviceOption"
     }
   }
 }

api/schema/v1.yaml

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2023 UnionTech Software Technology Co., Ltd.
+# SPDX-FileCopyrightText: 2023 - 2026 UnionTech Software Technology Co., Ltd.
 # SPDX-License-Identifier: LGPL-3.0-or-later
 #
 # NOTE:
@@ -1090,13 +1090,20 @@ $defs:
         type: object
         additionalProperties:
           type: string
+      device_mode:
+        type: array
+        items:
+          $ref: '#/$defs/DeviceOption'
       ext_defs:
         description: external extension definitions to extend the component
         type: object
         additionalProperties:
           type: array
           items:
             $ref: '#/$defs/ExtensionDefine'
+  DeviceOption:
+    description: device option
+    enum: ["passthru"]
 type: object
 properties:
   # NOTE: "properties" is auto generated by referring all types is $defs

apps/ll-cli/src/main.cpp

@@ -29,11 +29,12 @@
 #include <QJsonDocument>
 #include <QJsonObject>
 #include <QtGlobal>
 
 #include <algorithm>
 #include <functional>
+#include <map>
 #include <memory>
 #include <string_view>
 #include <thread>
 
 #include <fcntl.h>
@@ -200,6 +201,13 @@
       ->delimiter(',')
       ->allow_extra_args(false)
       ->group("");
+    const std::map<std::string, linglong::api::types::v1::DeviceOption> deviceOptionMap = {
+        { "passthru", linglong::api::types::v1::DeviceOption::Passthru },
+    };
+    cliRun->add_option("--device-mode", runOptions.deviceOptions, _("Add device options"))
+      ->delimiter(',')
+      ->transform(CLI::CheckedTransformer(deviceOptionMap, CLI::ignore_case))
+      ->allow_extra_args(false);
     cliRun->add_option("COMMAND", runOptions.commands, _("Run commands in a running sandbox"));
 }
 

configure.h.in

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2023 UnionTech Software Technology Co., Ltd.
+ * SPDX-FileCopyrightText: 2023 - 2026 UnionTech Software Technology Co., Ltd.
  *
  * SPDX-License-Identifier: LGPL-3.0-or-later
  */
@@ -22,8 +22,9 @@
 #define LINGLONG_CLIENT_NAME "@LINGLONG_CLI_BIN@"
 #define LINGLONG_CLIENT_PATH "@CMAKE_INSTALL_FULL_BINDIR@/@LINGLONG_CLI_BIN@"
 #define LINGLONG_EXPORT_PATH "@LINGLONG_EXPORT_PATH@"
+#define LINGLONG_SYSCONFDIR SYSCONFDIR "/linglong"
 // The directory where the package install hooks reside.
-#define LINGLONG_INSTALL_HOOKS_DIR "@CMAKE_INSTALL_FULL_SYSCONFDIR@/linglong/config.d"
+#define LINGLONG_INSTALL_HOOKS_DIR LINGLONG_SYSCONFDIR "/config.d"
 
 #define LINGLONG_EXPORT_VERSION "1.0.0.2"
 // The package's locale domain.

libs/api/src/linglong/api/types/v1/DeviceOption.hpp

@@ -0,0 +1,39 @@
+// This file is generated by tools/codegen.sh
+// DO NOT EDIT IT.
+
+// clang-format off
+
+//  To parse this JSON data, first install
+//
+//      json.hpp  https://github.com/nlohmann/json
+//
+//  Then include this file, and then do
+//
+//     DeviceOption.hpp data = nlohmann::json::parse(jsonString);
+
+#pragma once
+
+#include <optional>
+#include <nlohmann/json.hpp>
+#include "linglong/api/types/v1/helper.hpp"
+
+namespace linglong {
+namespace api {
+namespace types {
+namespace v1 {
+/**
+* device option
+*/
+
+using nlohmann::json;
+
+/**
+* device option
+*/
+enum class DeviceOption : int { Passthru };
+}
+}
+}
+}
+
+// clang-format on

libs/api/src/linglong/api/types/v1/Generators.hpp

@@ -59,6 +59,7 @@
 #include "linglong/api/types/v1/ExportDirs.hpp"
 #include "linglong/api/types/v1/DialogMessage.hpp"
 #include "linglong/api/types/v1/DialogHandShakePayload.hpp"
+#include "linglong/api/types/v1/DeviceOption.hpp"
 #include "linglong/api/types/v1/ContainerProcessStateInfo.hpp"
 #include "linglong/api/types/v1/CommonResult.hpp"
 #include "linglong/api/types/v1/CommonOptions.hpp"
@@ -253,6 +254,9 @@ void to_json(json & j, const UpgradeListResult & x);
 void from_json(const json & j, LinglongAPIV1 & x);
 void to_json(json & j, const LinglongAPIV1 & x);
 
+void from_json(const json & j, DeviceOption & x);
+void to_json(json & j, const DeviceOption & x);
+
 void from_json(const json & j, InteractionMessageType & x);
 void to_json(json & j, const InteractionMessageType & x);
 
@@ -1200,12 +1204,16 @@ j["version"] = x.version;
 }
 
 inline void from_json(const json & j, RuntimeConfigure& x) {
+x.deviceMode = get_stack_optional<std::vector<DeviceOption>>(j, "device_mode");
 x.env = get_stack_optional<std::map<std::string, std::string>>(j, "env");
 x.extDefs = get_stack_optional<std::map<std::string, std::vector<ExtensionDefine>>>(j, "ext_defs");
 }
 
 inline void to_json(json & j, const RuntimeConfigure & x) {
 j = json::object();
+if (x.deviceMode) {
+j["device_mode"] = x.deviceMode;
+}
 if (x.env) {
 j["env"] = x.env;
 }
@@ -1283,6 +1291,7 @@ x.commonOptions = get_stack_optional<CommonOptions>(j, "CommonOptions");
 x.commonResult = get_stack_optional<CommonResult>(j, "CommonResult");
 x.containerProcessStateInfo = get_stack_optional<ContainerProcessStateInfo>(j, "ContainerProcessStateInfo");
 x.deviceNode = get_stack_optional<DeviceNode>(j, "DeviceNode");
+x.deviceOption = get_stack_optional<DeviceOption>(j, "DeviceOption");
 x.dialogHandShakePayload = get_stack_optional<DialogHandShakePayload>(j, "DialogHandShakePayload");
 x.dialogMessage = get_stack_optional<DialogMessage>(j, "DialogMessage");
 x.exportDirs = get_stack_optional<ExportDirs>(j, "ExportDirs");
@@ -1354,6 +1363,9 @@ j["ContainerProcessStateInfo"] = x.containerProcessStateInfo;
 if (x.deviceNode) {
 j["DeviceNode"] = x.deviceNode;
 }
+if (x.deviceOption) {
+j["DeviceOption"] = x.deviceOption;
+}
 if (x.dialogHandShakePayload) {
 j["DialogHandShakePayload"] = x.dialogHandShakePayload;
 }
@@ -1467,6 +1479,18 @@ j["XDGDirectoryPermissions"] = x.xdgDirectoryPermissions;
 }
 }
 
+inline void from_json(const json & j, DeviceOption & x) {
+if (j == "passthru") x = DeviceOption::Passthru;
+else { throw std::runtime_error("Input JSON does not conform to schema!"); }
+}
+
+inline void to_json(json & j, const DeviceOption & x) {
+switch (x) {
+case DeviceOption::Passthru: j = "passthru"; break;
+default: throw std::runtime_error("Unexpected value in enumeration \"DeviceOption\": " + std::to_string(static_cast<int>(x)));
+}
+}
+
 inline void from_json(const json & j, InteractionMessageType & x) {
 if (j == "Downgrade") x = InteractionMessageType::Downgrade;
 else if (j == "Install") x = InteractionMessageType::Install;

libs/api/src/linglong/api/types/v1/LinglongAPIV1.hpp

@@ -65,6 +65,7 @@ namespace linglong {
 namespace api {
 namespace types {
 namespace v1 {
+enum class DeviceOption : int;
 enum class InteractionMessageType : int;
 enum class State : int;
 }
@@ -98,6 +99,7 @@ std::optional<CommonOptions> commonOptions;
 std::optional<CommonResult> commonResult;
 std::optional<ContainerProcessStateInfo> containerProcessStateInfo;
 std::optional<DeviceNode> deviceNode;
+std::optional<DeviceOption> deviceOption;
 std::optional<DialogHandShakePayload> dialogHandShakePayload;
 std::optional<DialogMessage> dialogMessage;
 std::optional<ExportDirs> exportDirs;

libs/api/src/linglong/api/types/v1/RuntimeConfigure.hpp

@@ -19,13 +19,24 @@
 
 #include "linglong/api/types/v1/ExtensionDefine.hpp"
 
+namespace linglong {
+namespace api {
+namespace types {
+namespace v1 {
+enum class DeviceOption : int;
+}
+}
+}
+}
+
 namespace linglong {
 namespace api {
 namespace types {
 namespace v1 {
 using nlohmann::json;
 
 struct RuntimeConfigure {
+std::optional<std::vector<DeviceOption>> deviceMode;
 std::optional<std::map<std::string, std::string>> env;
 /**
 * external extension definitions to extend the component

libs/common/src/linglong/common/dir.cpp

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2025 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2025 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: LGPL-3.0-or-later
 
@@ -47,4 +47,9 @@ std::filesystem::path getUserRuntimeConfigDir() noexcept
     return configDir / "linglong";
 }
 
+std::filesystem::path getSystemRuntimeConfigDir() noexcept
+{
+    return LINGLONG_SYSCONFDIR;
+}
+
 } // namespace linglong::common::dir

libs/common/src/linglong/common/dir.h

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: 2025 UnionTech Software Technology Co., Ltd.
+// SPDX-FileCopyrightText: 2025 - 2026 UnionTech Software Technology Co., Ltd.
 //
 // SPDX-License-Identifier: LGPL-3.0-or-later
 
@@ -25,4 +25,6 @@ std::filesystem::path getUserCacheDir() noexcept;
 
 std::filesystem::path getUserRuntimeConfigDir() noexcept;
 
+std::filesystem::path getSystemRuntimeConfigDir() noexcept;
+
 } // namespace linglong::common::dir

libs/linglong/src/linglong/cli/cli.cpp

@@ -625,7 +625,6 @@ int Cli::run(const RunOptions &options)
       .addUIdMapping(uid, uid, 1)
       .addGIdMapping(gid, gid, 1)
       .bindDefault()
-      .bindDevNode()
       .bindCgroup()
       .bindXDGRuntime()
       .bindUserGroup()
@@ -640,6 +639,28 @@ int Cli::run(const RunOptions &options)
       .forwardDefaultEnv()
       .enableSelfAdjustingMount();
 
+    bool devicePassthru = false;
+    if (runtimeConfig && runtimeConfig->deviceMode) {
+        for (const auto &option : *runtimeConfig->deviceMode) {
+            if (option == api::types::v1::DeviceOption::Passthru) {
+                devicePassthru = true;
+                break;
+            }
+        }
+    }
+    for (const auto &option : options.deviceOptions) {
+        if (option == api::types::v1::DeviceOption::Passthru) {
+            devicePassthru = true;
+            break;
+        }
+    }
+
+    if (devicePassthru) {
+        cfgBuilder.bindDev(true);
+    } else {
+        cfgBuilder.bindDevNode();
+    }
+
     std::vector<std::string> capabilities;
     // privileged mode shares host's user_namespace and add capabilities
     if (options.privileged) {

libs/linglong/src/linglong/cli/cli.h

@@ -9,6 +9,7 @@
 #include "linglong/api/dbus/v1/package_manager.h"
 #include "linglong/api/dbus/v1/task.h"
 #include "linglong/api/types/v1/CommonOptions.hpp"
+#include "linglong/api/types/v1/DeviceOption.hpp"
 #include "linglong/api/types/v1/PackageInfoDisplay.hpp"
 #include "linglong/api/types/v1/RepositoryCacheLayersItem.hpp"
 #include "linglong/cli/interactive_notifier.h"
@@ -58,6 +59,7 @@ struct RunOptions
     std::vector<std::string> extensions;
     bool privileged{ false };
     std::vector<std::string> capsAdd;
+    std::vector<api::types::v1::DeviceOption> deviceOptions;
 };
 
 struct EnterOptions