Skip to content

Harden cog and kodi display device handling #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alchark merged 1 commit into from
Jul 1, 2026
Merged

Harden cog and kodi display device handling #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions overlays/configs/systemd/system/cog-seat1.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,14 +35,16 @@ ProtectHome=read-only
ReadWritePaths=/var/lib/flipctl
ReadWritePaths=/run/user/999

# Device cgroup allowlist
DevicePolicy=closed
DeviceAllow=/dev/dri/card0 rw
DeviceAllow=/dev/dri/by-path/platform-2acf0000.spi-cs-0-card rw
DeviceAllow=/dev/dri/renderD128 rw
DeviceAllow=/dev/dri/card1 rw
DeviceAllow=/dev/input/event0 rw
DeviceAllow=/dev/input/event1 rw
InaccessiblePaths=/dev/dri/card2

TemporaryFileSystem=/dev/dri
BindPaths=/dev/dri/by-path/platform-2acf0000.spi-cs-0-card:/dev/dri/card0
BindPaths=/dev/dri/by-path/platform-27800000.gpu-card:/dev/dri/card1
BindPaths=/dev/dri/by-path/platform-27800000.gpu-render:/dev/dri/renderD128

ExecStartPre=/bin/sh -lc 'test -e /dev/dri/card0 && test -e /dev/input/event0'
ExecStart=/usr/bin/cog -P drm -O renderer=gles http://localhost:8899
Expand Down
8 changes: 5 additions & 3 deletions overlays/home/user/.kodi/kodi-display-gate
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
#!/bin/sh
# Block until at least one card2 connector is connected, then exit 0.
# Block until a DP/HDMI connector (the main display) reports connected, then exit 0.
# Match the connector on ANY card -- DRM card numbers renumber across kernel builds
# (the main display is not always card2), so never hardcode cardN.
while :; do
for c in DP-1 HDMI-A-1; do
[ "$(cat /sys/class/drm/card2-$c/status 2>/dev/null)" = connected ] && exit 0
for f in /sys/class/drm/card*-DP-1/status /sys/class/drm/card*-HDMI-A-1/status; do
[ "$(cat "$f" 2>/dev/null)" = connected ] && exit 0
done
sleep 1
done