Skip to content
Closed
Show file tree
Hide file tree
Changes from 9 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions docs/PERMISSION_SETTING.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
# Permission setting for non-root users' usage of Remoteproc Runtime
Comment thread
yejseo01 marked this conversation as resolved.
Outdated

For non-root users to use Remoteproc Runtime, the remoteproc driver and the container engine must be accessible for this user.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
For non-root users to use Remoteproc Runtime, the remoteproc driver and the container engine must be accessible for this user.
Remoteproc Runtime processes must run with privilege to access the remoteproc sysfs entries. Remoteproc Runtime is typically invoked by the container engine, not the user directly, so the container engine process is actually the process which needs the relevant permissions.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't checked the user id inside the container engine, but I didn't need to add the container engine's user directly to the remoteproc authorized group to make it work. The suspicion I have is the container spawned in either a root or the user that spawned


## How to set remoteproc driver to be accessible by non-root users
Comment thread
yejseo01 marked this conversation as resolved.
Outdated

Usually, remoteproc driver can only be accessible to root. To change this setting, follow the below instructions:
Comment thread
yejseo01 marked this conversation as resolved.
Outdated

1. Create a group and add your user:

```
sudo groupadd remoteproc
sudo usermod -aG remoteproc "$USER"
```

Log out and log back in to refresh group membership

2. Use systemd-tmpfiles to set mode/owner on every boot (and re-apply easily):
Comment thread
yejseo01 marked this conversation as resolved.

Create /etc/tmpfiles.d/remoteproc.conf with following:
Comment thread
yejseo01 marked this conversation as resolved.
Outdated

```
f /sys/class/remoteproc/remoteproc0/state 0664 root remoteproc - -
f /sys/class/remoteproc/remoteproc0/firmware 0664 root remoteproc - -
f /sys/class/remoteproc/remoteproc0/name 0664 root remoteproc - -
```

Add similar lines for each additional remoteproc device (e.g., remoteproc1, remoteproc2, etc.) as needed.

3. Apply the change in remoteproc.conf:
```
sudo systemd-tmpfiles --create /etc/tmpfiles.d/remoteproc.conf
```
4. Log in as a user in the remoteproc group and try the following commands to make sure that you can access the remoteproc driver as this user:
```
# read state
cat /sys/class/remoteproc/remoteproc0/state
# start/stop
echo start | tee /sys/class/remoteproc/remoteproc0/state
echo stop | tee /sys/class/remoteproc/remoteproc0/state
```

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need a last step here noting that the container engine needs to be added to this new group?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't need to add the container engine to the new group to make this work without root. What would the user be in a spawned container??


## Ensure your container engine is accessible by the user

The user must be able to access the container engine. For example, if you are using Docker, you need to add the user to the `docker` group:

```
sudo usermod -aG docker "$USER"
```

After running the command above, log out and log in again to refresh group membership.
Comment thread
yejseo01 marked this conversation as resolved.
Outdated
4 changes: 4 additions & 0 deletions docs/USAGE.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,10 @@ Remoteproc Runtime supports several container engines, but the specifics of inte
- **[Container Runtime (Podman)](#container-runtime-podman)** - For Podman deployments
- **[Container Runtime (standalone)](#container-runtime-standalone)** - For direct OCI runtime usage

Accessing and controlling remoteproc devices typically requires root permissions unless you [set the systemd-tmpfiles](./PERMISSION_SETTING.md). This is because the driver interfaces are located in the /sys/class directory.

To ensure Remoteproc Runtime has the necessary privileges, either run your container engine (e.g., Docker daemon, K3S, or Podman) with root privileges (typically via `sudo`), or follow the [permission setting instructions](./PERMISSION_SETTING.md).
Comment thread
yejseo01 marked this conversation as resolved.
Outdated

### Containerd Shim (Docker, K3s, etc)

1. **Install the shim and runtime**
Expand Down