vasilito/RedBear-OS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ec669c640ca2778fecfe302b0dbc7d88ff56cd78
RedBear-OS/config/redbear-full.toml
T
Red Bear OS Builder bdc56ddd58 polkit: implement real authorization (v0.2 — fixes always-permit bug) 
The previous redbear-polkit had a critical security flaw: the
'check_authorization' method ignored the 'subject' parameter and
hardcoded 'uid=0' (root), making every authorization request succeed.
Any caller could perform any action as 'root'. This was flagged as
5/5 security fragility in the DBUS assessment.

This commit implements real authorization in the polkit daemon:

* Subject UID extraction. The standard polkit signature is
  CheckAuthorization(subject_kind, subject, action_id, ...). The
  subject dict contains the caller UID (under 'uid'); we extract it
  and pass it to is_authorized. No more hardcoded root.

* Comprehensive policy syntax. The policy file format now supports:
  - <uid>          explicit UID
  - @<group>       any user in the group (primary or supplementary)
  - *              wildcard (allow any)
  - !<uid>         explicit deny
  - !@<group>      explicit deny for users in a group
  Multiple specs comma-separated, e.g. '@wheel, 1000, !@restricted'.

* Default-deny for unknown actions. Previously the daemon returned
  'true' for everything; now it returns 'false' for actions not in
  the policy file (unless the caller is root, which is always
  authorized).

* match_user_spec returns None for non-match. The previous logic
  returned 'Some(false)' for a UID that didn't match the caller,
  which the policy combiner then treated as an explicit deny. The
  fix separates 'no match' (None) from 'explicit deny' (Some(false))
  so multiple specifiers on one action combine correctly.

* Env-var override for tests. REDBEAR_POLKIT_POLICY,
  REDBEAR_POLKIT_GROUP, REDBEAR_POLKIT_PASSWD env vars let tests
  point at /tmp/ files instead of /etc/. 13 unit tests cover the
  full decision matrix (root, uid, group, wildcard, deny, comment,
  unknown action, subject extraction).

* Policy file staged in redbear-full.toml and redbear-mini.toml.
  The default /etc/polkit-1/policy.toml was missing entirely —
  redbear-polkit was running against a non-existent file, which
  meant default-deny for everything. The new policy.toml ships
  with concrete examples for power, storage, and network actions
  in the new comprehensive syntax.

* BackendVersion bumped to 0.2.0 to reflect the contract change.

DBUS-PLAN bumped to v3.2 (2026-07-26). §3.1 status table now lists
redbear-polkit v0.2 as done. §14.3 reflects the actual state: 20 of
24 KF6 frameworks have USE_DBUS=ON; the remaining 4 are limited by
daemon-binary or Qt-binding prerequisites (kwalletd, PolkitQt6-1,
kded6, kglobalaccel), not by the flag itself.

Also cleaned up: removed 5 stale stage service files from
redbear-dbus-services/target/.../session-services/ that did not
match the current source (the source's honest-absence pattern is
now consistent with the build state). The cleanup is a local
filesystem operation; the .gitignore already excludes that path.

Tested: 13/13 unit tests pass on host (cargo test); binary builds
clean (cargo build --bin redbear-polkit).
2026-07-26 18:29:22 +09:00

915 lines
23 KiB
TOML
Raw Blame History

# Red Bear OS Full Configuration
# Desktop/graphics ISO for bare metal and QEMU.
#
# Build: make live CONFIG_NAME=redbear-full
# QEMU: make all CONFIG_NAME=redbear-full && make qemu
#
# Extends redbear-mini with the full desktop/graphics stack:
# Wayland, Qt6, KF6, KWin, Mesa, DRM drivers, firmware, greeter.
include = ["redbear-mini.toml"]
[general]
filesystem_size = 4096
# Package groups — meta-package definitions for logical grouping of the
# desktop stack. The installer resolves all group references before
# building/installing; cycle detection surfaces typos. Reference a group
# in [packages] with `group-name = {}` to include all its packages.
[package_groups.graphics-core]
description = "Core graphics stack (DRM, Mesa, Wayland compositor)"
packages = ["redox-drm", "mesa", "libdrm", "libwayland", "wayland-protocols", "redbear-compositor", "libepoxy", "libdisplay-info", "libxcvt", "libudev"]
[package_groups.input-stack]
description = "Input device support (evdev, libinput, keymaps, IME, accessibility)"
packages = ["libevdev", "libinput", "redbear-keymapd", "redbear-ime", "redbear-accessibility"]
[package_groups.dbus-services]
description = "D-Bus system bus and session broker"
packages = ["expat", "dbus"]
[package_groups.firmware-stack]
description = "Firmware loading infrastructure"
packages = ["redbear-firmware", "firmware-loader"]
[package_groups.qt6-core]
description = "Qt 6 core modules"
packages = ["qtbase", "qtsvg"]
[package_groups.qt6-extras]
description = "Qt 6 additional modules (Wayland, sensors)"
packages = ["qtwayland", "qt6-wayland-smoke", "qt6-sensors"]
[package_groups.kf6-frameworks]
description = "KDE Frameworks 6 (full set required for KDE Plasma)"
packages = [
"kf6-extra-cmake-modules", "kf6-attica", "kf6-karchive", "kf6-kauth",
"kf6-kbookmarks", "kf6-kcmutils", "kf6-kcodecs", "kf6-kcolorscheme",
"kf6-kcompletion", "kf6-kconfig", "kf6-kconfigwidgets", "kf6-kcoreaddons",
"kf6-kcrash", "kf6-kdbusaddons", "kf6-kdeclarative", "kf6-kded6",
"kf6-kguiaddons", "kf6-ki18n", "kf6-kiconthemes", "kf6-kidletime",
"kf6-kio", "kf6-kitemmodels", "kf6-kitemviews", "kf6-kjobwidgets",
"kf6-knotifications", "kf6-kpackage", "kf6-kservice", "kf6-ksvg",
"kf6-ktextwidgets", "kf6-kwayland", "kf6-kwidgetsaddons",
"kf6-kwindowsystem", "kf6-kxmlgui", "kf6-notifyconfig", "kf6-parts",
"kf6-prison", "kf6-pty", "kf6-solid", "kf6-sonnet",
"kf6-syntaxhighlighting", "kf6-knewstuff", "kf6-kwallet",
"kf6-kglobalaccel",
]
[package_groups.desktop-session]
description = "Display manager, greeter, auth, and session bootstrap"
packages = [
"kwin", "kdecoration", "breeze", "kirigami",
"sddm", "redbear-authd", "redbear-session-launch", "seatd",
"redbear-greeter", "pam-redbear", "xwayland",
]
[package_groups.kde-desktop]
description = "Complete KDE Plasma desktop stack (all groups combined)"
packages = [
"graphics-core", "input-stack", "dbus-services", "firmware-stack",
"qt6-core", "qt6-extras", "kf6-frameworks", "desktop-session",
"icu", "konsole", "kglobalacceld", "amdgpu",
"plasma-wayland-protocols",
"plasma-framework", "plasma-workspace", "plasma-desktop",
"kde-cli-tools", "kf6-attica",
"zbus", "pipewire", "wireplumber",
]
# Convenience meta-group referencing the entire desktop. Useful as a single
# "include everything" toggle in derivative configs.
[package_groups.redbear-full-desktop]
description = "Meta: entire redbear-full desktop (alias of kde-desktop + graphics-core)"
packages = ["kde-desktop"]
[users.messagebus]
uid = 100
gid = 100
name = "messagebus"
home = "/nonexistent"
shell = "/usr/bin/zsh"
[users.greeter]
password = ""
uid = 101
gid = 101
name = "greeter"
home = "/nonexistent"
shell = "/usr/bin/zsh"
[users.root]
password = "password"
uid = 0
gid = 0
shell = "/usr/bin/zsh"
[packages]
# Runtime driver parameter control surface.
driver-params = {}
# D-Bus IPC (required by greeter/session services)
expat = {}
dbus = {}
# Firmware loading
redbear-firmware = {}
firmware-loader = {}
# NUMA topology discovery (userspace daemon)
numad = {}
# GPU/graphics stack
redox-drm = {}
mesa = {}
libdrm = {}
# X11 protocol headers (needed by libxau, libxkbcommon, xwayland)
x11proto = {}
libxkbcommon = {}
xkeyboard-config = {}
# Wayland stack
libwayland = {}
wayland-protocols = {}
redbear-compositor = {}
# Keyboard/input
libevdev = {}
libinput = {}
redbear-keymapd = {}
redbear-ime = {}
redbear-accessibility = {}
# Helper libraries for graphics/display
libepoxy = {}
libdisplay-info = {}
libxcvt = {}
libudev = {}
# Qt6 stack
qtbase = {}
qtdeclarative = {}
qtsvg = {}
qtwayland = {}
qt6-wayland-smoke = {}
qt6-sensors = {}
# KF6 Frameworks — full real-build surface for KDE Plasma 6
kf6-extra-cmake-modules = {}
kf6-attica = {}
kf6-karchive = {}
kf6-kauth = {}
kf6-kbookmarks = {}
kf6-kcmutils = {}
kf6-kcodecs = {}
kf6-kcolorscheme = {}
kf6-kcompletion = {}
kf6-kconfig = {}
kf6-kconfigwidgets = {}
kf6-kcoreaddons = {}
kf6-kcrash = {}
kf6-kdbusaddons = {}
kf6-kdeclarative = {}
kf6-kded6 = {}
kf6-kguiaddons = {}
kf6-ki18n = {}
kf6-kiconthemes = {}
kf6-kidletime = {}
kf6-kio = {}
kf6-kitemmodels = {}
kf6-kitemviews = {}
kf6-kjobwidgets = {}
kf6-knotifications = {}
kf6-kpackage = {}
kf6-kservice = {}
kf6-ksvg = {}
kf6-ktextwidgets = {}
kf6-kwayland = {}
kf6-kwidgetsaddons = {}
kf6-kwindowsystem = {}
kf6-kxmlgui = {}
kf6-notifyconfig = {}
kf6-parts = {}
kf6-prison = {}
kf6-pty = {}
kf6-solid = {}
kf6-sonnet = {}
kf6-syntaxhighlighting = {}
kf6-knewstuff = {}
kf6-kwallet = {}
kf6-kglobalaccel = {}
kirigami = {}
breeze = {}
# Plasma stack — full KDE desktop
kdecoration = {}
kwin = {}
plasma-wayland-protocols = {}
plasma-framework = {}
plasma-workspace = {}
plasma-desktop = {}
kde-cli-tools = {}
konsole = {}
kglobalacceld = {}
# ICU (Unicode/intl support)
icu = {}
# Display manager and authentication chain
redbear-authd = {}
redbear-session-launch = {}
seatd = {}
redbear-greeter = {}
pam-redbear = {}
sddm = {}
xwayland = {}
# D-Bus Rust bindings + media
zbus = {}
pipewire = {}
wireplumber = {}
# AMD GPU display
amdgpu = {}
# Core Red Bear umbrella package
redbear-meta = {}
# Power TUI
redbear-power = {}
# Native build toolchain (Phase 3: GCC + binutils running on redox)
gcc-native = "ignore"
binutils-native = {}
# llvm-native = {} # suppressed: Redox C++/pthread header gaps; not needed for greeter proof
# rust-native = {} # suppressed: depends on llvm-native; not needed for greeter proof
# Desktop fonts and icons
dejavu = {}
freefont = {}
hicolor-icon-theme = {}
pop-icon-theme = {}
# Suppress legacy desktop packages
orbdata = "ignore"
orbital = "ignore"
orbterm = "ignore"
orbutils = "ignore"
cosmic-edit = "ignore"
cosmic-files = "ignore"
cosmic-icons = "ignore"
cosmic-term = "ignore"
curl = {}
git = {}
mc = {}
[[files]]
path = "/lib/firmware/amdgpu"
data = ""
directory = true
mode = 0o755
[[files]]
path = "/usr/lib/fonts"
data = "/usr/share/fonts"
symlink = true
# ---------------------------------------------------------------------------
# Runtime directories created before any service starts
# ---------------------------------------------------------------------------
[[files]]
path = "/run/redbear-display-session"
data = ""
directory = true
mode = 0o700
[[files]]
path = "/tmp/run/redbear-greeter"
data = ""
directory = true
mode = 0o700
[[files]]
path = "/tmp/run/redbear-display-session"
data = ""
directory = true
mode = 0o700
[[files]]
path = "/usr/share/wayland-sessions"
data = ""
directory = true
mode = 0o755
[[files]]
path = "/etc/pam.d"
data = ""
directory = true
mode = 0o755
[[files]]
path = "/var/lib/sddm"
data = ""
directory = true
mode = 0o711
[[files]]
path = "/var/log/sddm"
data = ""
directory = true
mode = 0o700
[[files]]
path = "/etc/sddm"
data = ""
directory = true
mode = 0o755
# ---------------------------------------------------------------------------
# PAM configuration — SDDM routes every conversation through pam-redbear
# which proxies to redbear-authd over /run/redbear-authd.sock
# ---------------------------------------------------------------------------
[[files]]
path = "/etc/pam.d/sddm"
data = """
# PAM configuration for SDDM display manager (Red Bear OS)
#
# The auth stack authenticates against /etc/passwd+/etc/shadow via the
# pam-redbear module, which is a Rust cdylib that proxies every
# pam_authenticate call to redbear-authd over /run/redbear-authd.sock.
# redbear-authd enforces lockout (5 failures/60s → 30s lockout), validates
# argon2/SHA-crypt hashes, and issues an approval token that
# redbear-session-launch exchanges for a user shell.
#
# Session-open and account-management are pass-through because authd already
# validated the credentials; pam-redbear returns PAM_SUCCESS locally.
auth include sddm-autologin
auth include sddm-greeter
account include sddm-greeter
session include sddm-greeter
password include sddm-greeter
"""
[[files]]
path = "/etc/pam.d/sddm-greeter"
data = """
# PAM stack for the SDDM Wayland greeter (sddm-greeter-qt6).
# Every authentication conversation routes through pam-redbear.so, which
# speaks to redbear-authd. Lockout, failure delay, and VT-binding are
# enforced server-side in authd.
auth required pam_redbear.so
account required pam_redbear.so
password required pam_redbear.so
session required pam_redbear.so
"""
[[files]]
path = "/etc/pam.d/sddm-autologin"
data = """
# PAM stack for SDDM's autologin path. autologin is disabled by default in
# redbear-full ([Autologin] User=). To enable, set Autologin.User in
# /etc/sddm.conf and provide the matching password file.
auth sufficient pam_redbear.so
account sufficient pam_redbear.so
session optional pam_redbear.so
"""
[[files]]
path = "/etc/pam.d/sddm-helper"
data = """
# PAM stack for sddm-helper (the helper that launches the user session after
# authentication succeeds). Same auth path as the greeter.
auth required pam_redbear.so
account required pam_redbear.so
session required pam_redbear.so
"""
# ---------------------------------------------------------------------------
# Wayland session desktop file — SDDM enumerates /usr/share/wayland-sessions
# ---------------------------------------------------------------------------
[[files]]
path = "/usr/share/wayland-sessions/kde-wayland.desktop"
data = """
[Desktop Entry]
Type=Application
Name=KDE Plasma (Wayland)
Comment=The KDE Plasma desktop running natively on Wayland
Exec=/usr/bin/redbear-kde-session
TryExec=/usr/bin/redbear-kde-session
DesktopNames=KDE
"""
[[files]]
path = "/usr/share/wayland-sessions/redbear-wayland.desktop"
data = """
[Desktop Entry]
Type=Application
Name=Red Bear Wayland Session
Comment=Minimal Wayland session launched by redbear-session-launch
Exec=/usr/bin/redbear-session-launch --mode session --session kde-wayland
TryExec=/usr/bin/redbear-session-launch
DesktopNames=RedBear
"""
# ---------------------------------------------------------------------------
# Init services
# ---------------------------------------------------------------------------
[[files]]
path = "/etc/init.d/05_boot-essential.target"
data = """
[unit]
description = "Boot essential services target"
requires_weak = [
"00_base.target",
]
"""
[[files]]
path = "/etc/init.d/13_iommu.service"
data = """
[unit]
description = "IOMMU DMA remapping daemon"
requires_weak = [
"12_boot-late.target",
"00_driver-manager.service",
]
[service]
cmd = "/usr/bin/iommu"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/12_dbus.service"
data = """
[unit]
description = "D-Bus system bus"
requires_weak = [
"12_boot-late.target",
"00_ipcd.service",
]
[service]
cmd = "/usr/bin/dbus-daemon"
args = ["--system", "--nopidfile", "--address=unix:path=/run/dbus/system_bus_socket"]
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/13_redbear-sessiond.service"
data = """
[unit]
description = "Red Bear session broker (org.freedesktop.login1)"
requires_weak = [
"12_dbus.service",
]
[service]
cmd = "/usr/bin/redbear-sessiond"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/13_seatd.service"
data = """
[unit]
description = "seatd seat management daemon"
requires_weak = [
"12_dbus.service",
"13_redbear-sessiond.service",
]
[service]
cmd = "/usr/bin/seatd"
args = ["-l", "info"]
type = "oneshot_async"
"""
[[files]]
path = "/etc/keymaps/.gitkeep"
data = ""
[[files]]
path = "/etc/init.d/13_redbear-keymapd.service"
data = """
[unit]
description = "Runtime keymap daemon"
requires_weak = [
"10_evdevd.service",
]
[service]
cmd = "/usr/bin/redbear-keymapd"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/13_redbear-ime.service"
data = """
[unit]
description = "Input method engine daemon"
requires_weak = [
"10_evdevd.service",
]
[service]
cmd = "redbear-ime"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/13_redbear-accessibility.service"
data = """
[unit]
description = "Accessibility input filter daemon (sticky/slow/bounce keys)"
requires_weak = [
"10_evdevd.service",
]
[service]
cmd = "redbear-accessibility"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/14_redbear-upower.service"
data = """
[unit]
description = "UPower D-Bus service (org.freedesktop.UPower)"
requires_weak = [
"12_dbus.service",
]
[service]
cmd = "redbear-upower"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/14_redbear-udisks.service"
data = """
[unit]
description = "UDisks2 D-Bus service (org.freedesktop.UDisks2)"
requires_weak = [
"12_dbus.service",
]
[service]
cmd = "redbear-udisks"
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/14_redbear-polkit.service"
data = """
[unit]
description = "PolicyKit1 D-Bus service (org.freedesktop.PolicyKit1)"
requires_weak = [
"12_dbus.service",
]
[service]
cmd = "redbear-polkit"
type = "oneshot_async"
"""
[[files]]
path = "/etc/polkit-1/policy.toml"
data = """
# Red Bear OS polkit policy (v0.2 — comprehensive syntax)
#
# Format: action_id = uid, @group, *, !uid, !@group
#
# Specifiers:
# 1000 - explicit UID
# @wheel - any user in the named group (primary or supplementary)
# * - wildcard (allow any user)
# !1000 - explicit deny (overrides allows)
# !@restricted - explicit deny for users in 'restricted'
#
# UID 0 (root) is implicitly authorized for every action.
# -------- Power management (login1) --------
org.freedesktop.login1.power-off = *
org.freedesktop.login1.reboot = *
org.freedesktop.login1.suspend = *
org.freedesktop.login1.set-user-linger = 0
# -------- Storage (UDisks2) --------
org.freedesktop.udisks2.filesystem-mount = @wheel, 1000
org.freedesktop.udisks2.filesystem-mount-system = 0
# -------- NetworkManager --------
org.freedesktop.NetworkManager.settings.modify.system = 0
org.freedesktop.NetworkManager.enable-disable-wifi = @wheel, 1000
org.freedesktop.NetworkManager.enable-disable-wifi = !@restricted
"""
[[files]]
path = "/etc/init.d/18_dri-symlinks.service"
data = """
[unit]
description = "DRI device symlinks for KWin libudev fallback"
# Creates /dev/dri/renderD128 -> /scheme/drm/card0 so KWin's
# libudev-based discovery finds the GPU even when KWIN_DRM_DEVICES
# is not honored (libudev 252+ ignores KWIN_DRM_DEVICES if
# the device is detectable via udev). This is the
# libudev-discoverable fallback path; the primary path
# is still KWIN_DRM_DEVICES=/scheme/drm/card0.
requires_weak = [
"00_driver-manager.service",
"12_dbus.service",
]
[service]
cmd = "/bin/sh"
args = ["-c", "mkdir -p /dev/dri && ln -sfn /scheme/drm/card0 /dev/dri/card0 && ln -sfn /scheme/drm/card0 /dev/dri/renderD128 && ln -sfn /scheme/drm/card0 /dev/dri/controlD64"]
type = "oneshot"
"""
[[files]]
path = "/etc/init.d/19_redbear-authd.service"
data = """
[unit]
description = "Red Bear authentication daemon"
requires_weak = [
"12_dbus.service",
]
[service]
cmd = "/usr/bin/redbear-authd"
envs = { QT_PLUGIN_PATH = "/usr/plugins", QT_QPA_PLATFORM_PLUGIN_PATH = "/usr/plugins/platforms", QML2_IMPORT_PATH = "/usr/qml", XCURSOR_THEME = "Pop", XKB_CONFIG_ROOT = "/usr/share/X11/xkb", KWIN_DRM_DEVICES = "/scheme/drm/card0" }
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/29_activate_console.service"
data = """
[unit]
description = "Activate fallback console VT"
requires_weak = [
"05_boot-essential.target",
]
[service]
cmd = "inputd"
args = ["-A", "2"]
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/30_console.service"
data = """
[unit]
description = "Console terminals"
requires_weak = [
"29_activate_console.service",
]
[service]
cmd = "getty"
args = ["2"]
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/31_debug_console.service"
data = """
[unit]
description = "Debug console on serial port"
requires_weak = [
"29_activate_console.service",
]
[service]
cmd = "getty"
args = ["/scheme/debug/no-preserve", "-J"]
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/99_diag_serial.service"
data = """
[unit]
description = "Serial diagnostic marker"
requires_weak = [
"31_debug_console.service",
"30_console.service",
"12_dbus.service",
]
[service]
cmd = "zsh"
args = ["-c", "echo BOOT_COMPLETE_SERIAL_MARKER"]
type = "oneshot"
"""
[[files]]
path = "/etc/login.defs"
data = """
UID_MIN 0
UID_MAX 65535
GID_MIN 0
GID_MAX 65535
SYS_UID_MIN 0
SYS_UID_MAX 999
SYS_GID_MIN 0
SYS_GID_MAX 999
"""
# ---------------------------------------------------------------------------
# SDDM — real Wayland display manager (replaces legacy redbear-greeterd by
# default; legacy path remains gated by the enable-legacy-greeter sentinel)
# ---------------------------------------------------------------------------
[[files]]
path = "/etc/sddm.conf"
data = """
[Theme]
Current=maya
[Users]
MinimumUid=0
MaximumUid=65535
[Wayland]
CompositorCommand=/usr/bin/redbear-compositor
SessionDir=/usr/share/wayland-sessions
# KWin DRM device path. KWin's drm_backend.cpp uses libudev to
# enumerate /dev/dri/renderDN. On Redox, the DRM device is exposed
# at /scheme/drm/card0; we set KWIN_DRM_DEVICES so KWin skips
# udev enumeration and uses the explicit device list. The
# /dev/dri/renderD128 symlink below makes KWin's libudev fallback
# also work, so the path is robust to the user's libudev version
# (libudev 252+ ignores KWIN_DRM_DEVICES if the device is
# detectable via udev).
KWIN_DRM_DEVICES=/scheme/drm/card0
[Autologin]
User=
Session=
# X11 is intentionally disabled on Red Bear. KWin runs the Wayland backend;
# any X client goes through Xwayland only on explicit request.
Enable=false
# KWin Wayland device binding. The /dev/dri/renderD128 symlink points
# at /scheme/drm/card0 so KWin's libudev enumeration finds the GPU
# even when KWIN_DRM_DEVICES is not honored. The symlink is created
# by the 19_dri-symlinks.service init entry below.
"""
[[files]]
path = "/etc/init.d/21_sddm.service"
data = """
[unit]
description = "SDDM display manager (Wayland)"
# Service ordering: SDDM is the graphical login surface for the system.
# Driver-manager must have settled so /scheme/drm/card0 exists before SDDM
# launches its compositor; dbus is required for SDDM's IPC; authd is required
# for PAM-backed authentication; sessiond/seatd are required for SDDM's
# seat/session management.
requires_weak = [
"00_driver-manager.service",
"12_dbus.service",
"13_redbear-sessiond.service",
"13_seatd.service",
"19_redbear-authd.service",
]
[service]
cmd = "/usr/bin/sddm"
args = ["--no-daemon"]
envs = { QT_PLUGIN_PATH = "/usr/plugins", QT_QPA_PLATFORM_PLUGIN_PATH = "/usr/plugins/platforms", QML2_IMPORT_PATH = "/usr/qml", XCURSOR_THEME = "Pop", XKB_CONFIG_ROOT = "/usr/share/X11/xkb", KWIN_DRM_DEVICES = "/scheme/drm/card0", DISPLAY = ":0", WAYLAND_DISPLAY = "wayland-0", XDG_RUNTIME_DIR = "/tmp/run/redbear-greeter", XDG_SESSION_TYPE = "wayland", REDBEAR_DRM_WAIT_SECONDS = "30" }
type = "oneshot_async"
"""
# Legacy greeter (redbear-greeterd) — kept for testing/rollback. Disabled
# by default. The sentinel file /etc/redbear/enable-legacy-greeter, which
# the image does NOT install, re-enables it.
[[files]]
path = "/etc/init.d/20_greeter.service"
data = """
[unit]
description = "Red Bear greeter service (legacy, disabled by default)"
condition_path_exists = ["/etc/redbear/enable-legacy-greeter"]
requires_weak = [
"00_driver-manager.service",
"12_dbus.service",
"13_redbear-sessiond.service",
"13_seatd.service",
"19_redbear-authd.service",
]
[service]
cmd = "/usr/bin/redbear-greeterd"
envs = { VT = "3", REDBEAR_GREETER_USER = "greeter", KWIN_DRM_DEVICES = "/scheme/drm/card0", REDBEAR_DRM_WAIT_SECONDS = "30", REDBEAR_GREETER_RUNTIME_DIR = "/tmp/run/redbear-greeter" }
type = "oneshot_async"
"""
[[files]]
path = "/etc/init.d/20_display.service"
data = """
[unit]
description = "KDE session assembly helper (legacy, disabled by default)"
condition_path_exists = ["/etc/redbear/enable-legacy-greeter"]
requires_weak = [
"12_dbus.service",
"13_redbear-sessiond.service",
"13_seatd.service",
"19_redbear-authd.service",
]
[service]
cmd = "/usr/bin/redbear-session-launch"
args = ["--username", "root", "--mode", "session", "--session", "kde-wayland", "--vt", "4", "--runtime-dir", "/tmp/run/redbear-display-session", "--wayland-display", "wayland-display"]
envs = { QT_PLUGIN_PATH = "/usr/plugins", QT_QPA_PLATFORM_PLUGIN_PATH = "/usr/plugins/platforms", QML2_IMPORT_PATH = "/usr/qml", XCURSOR_THEME = "Pop", XKB_CONFIG_ROOT = "/usr/share/X11/xkb", REDBEAR_KDE_SESSION_BACKEND = "virtual", REDBEAR_KDE_SESSION_STATE_DIR = "/run/redbear-display-session" }
type = "oneshot_async"
"""
[groups.greeter]
gid = 101
members = ["greeter"]
[groups.messagebus]
gid = 100
members = ["messagebus"]
# ---------------------------------------------------------------------------
# Driver dispatch — Redox's driver-manager consults /lib/drivers.d/*.toml
# ---------------------------------------------------------------------------
[[files]]
path = "/lib/drivers.d/30-graphics.toml"
data = """
[[driver]]
name = "redox-drm"
description = "DRM/KMS display driver (AMD + Intel + VirtIO)"
priority = 60
command = ["/usr/bin/redox-drm"]
[[driver.match]]
class = 0x03
[[driver]]
name = "virtio-gpud"
description = "VirtIO GPU driver"
priority = 60
command = ["/usr/lib/drivers/virtio-gpud"]
[[driver.match]]
vendor = 0x1AF4
class = 0x03
[[driver]]
name = "redox-drm"
description = "Intel GPU display driver"
priority = 61
command = ["/usr/bin/redox-drm"]
[[driver.match]]
vendor = 0x8086
class = 0x03
subclass = 0x00
[[driver]]
name = "redox-drm"
description = "AMD GPU display driver"
priority = 61
command = ["/usr/bin/redox-drm"]
[[driver.match]]
vendor = 0x1002
class = 0x03
subclass = 0x00
# VirtIO GPU (QEMU virtio-gpu / VirGL, e.g. 1AF4:1050 class 03) — bind redox-drm
# above the base virtio-gpud (@60) so the desktop gets a real /scheme/drm/card0
# (redox-drm VirtIO KMS) instead of virtio-gpud's VT-only scanout. Subclass
# omitted: QEMU reports virtio-gpu as class 0x03 subclass 0x80, not 0x00.
[[driver]]
name = "redox-drm"
description = "VirtIO GPU display driver (VirGL/KMS)"
priority = 61
command = ["/usr/bin/redox-drm"]
[[driver.match]]
vendor = 0x1AF4
class = 0x03
"""
[[files]]
path = "/etc/environment.d/90-dbus.conf"
data = """
DBUS_SYSTEM_BUS_ADDRESS=unix:path=/run/dbus/system_bus_socket
"""
Reference in New Issue View Git Blame Copy Permalink