Re: [meta-arm] [PATCH v3 2/2] trusted-service: remove optee udev and group settings

Hi,

How is the system going to work if op-tee client is not deployed, but libts is? E.g. if the SPMC is Hafnium and no S-EL1 OP-TEE SP is needed, but the FWU SP is used?

/George

From: [email protected] <[email protected]> on behalf of Mikko Rapeli via lists.yoctoproject.org <[email protected]>
Date: Thursday, 17 October 2024 at 09:01
To: [email protected] <[email protected]>
Cc: Mikko Rapeli <[email protected]>
Subject: [meta-arm] [PATCH v3 2/2] trusted-service: remove optee udev and group settings
optee-client now provides them and sets "tee" group for
/dev/tee* and "teepriv" group for /dev/teepriv* access.
tee-supplicant runs as "teesuppl" user account.

Signed-off-by: Mikko Rapeli <[email protected]>
---
 .../trusted-services/libts/tee-udev.rules     |  7 -------
 .../trusted-services/libts_git.bb             | 19 ++-----------------
 2 files changed, 2 insertions(+), 24 deletions(-)
 delete mode 100644 meta-arm/recipes-security/trusted-services/libts/tee-udev.rules

diff --git a/meta-arm/recipes-security/trusted-services/libts/tee-udev.rules b/meta-arm/recipes-security/trusted-services/libts/tee-udev.rules
deleted file mode 100644
index 43fafd8c..00000000
--- a/meta-arm/recipes-security/trusted-services/libts/tee-udev.rules
+++ /dev/null
@@ -1,7 +0,0 @@
-# tee devices can only be accessed by the teeclnt group members
-KERNEL=="tee[0-9]*", TAG+="systemd", MODE="0660", GROUP="teeclnt"
-
-# If a /dev/teepriv[0-9]* device is detected, start an instance of
-# tee-supplicant.service with the device name as parameter
-KERNEL=="teepriv[0-9]*", MODE="0660", OWNER="root", GROUP="tee", \
-    TAG+="systemd", ENV{SYSTEMD_WANTS}+="tee-supplicant@%k.service"
diff --git a/meta-arm/recipes-security/trusted-services/libts_git.bb b/meta-arm/recipes-security/trusted-services/libts_git.bb
index 635e4769..9d0e7373 100644
--- a/meta-arm/recipes-security/trusted-services/libts_git.bb
+++ b/meta-arm/recipes-security/trusted-services/libts_git.bb
@@ -5,24 +5,13 @@ TS_ENV = "arm-linux"

 require trusted-services.inc

-SRC_URI += "file://tee-udev.rules \
-            file://0001-Remove-TEE-driver-external-component.patch<file:///0001-Remove-TEE-driver-external-component.patch> \
-           "
+SRC_URI += "file://0001-Remove-TEE-driver-external-component.patch<file:///0001-Remove-TEE-driver-external-component.patch>"

 OECMAKE_SOURCEPATH="${S}/deployments/libts/${TS_ENV}"

 DEPENDS           += "arm-ffa-user"

-# Unix group name for dev/tee* ownership.
-TEE_GROUP_NAME ?= "teeclnt"
-
 do_install:append () {
-    if ${@oe.utils.conditional('VIRTUAL-RUNTIME_dev_manager', 'busybox-mdev', 'false', 'true', d)}; then
-        install -d ${D}${nonarch_base_libdir}/udev/rules.d/
-        install -m 755 ${UNPACKDIR}/tee-udev.rules ${D}${nonarch_base_libdir}/udev/rules.d/
-        sed -i -e "s/teeclnt/${TEE_GROUP_NAME}/" ${D}${nonarch_base_libdir}/udev/rules.d/tee-udev.rules
-    fi
-
     # Move the dynamic libraries into the standard place.
     install -d ${D}${libdir}
     mv ${D}${TS_INSTALL}/lib/libts* ${D}${libdir}
@@ -34,9 +23,5 @@ do_install:append () {
     fi
 }

-inherit ${@oe.utils.conditional('VIRTUAL-RUNTIME_dev_manager', 'busybox-mdev', '', 'useradd', d)}
-USERADD_PACKAGES = "${PN}"
-GROUPADD_PARAM:${PN} = "--system ${TEE_GROUP_NAME}"
-
-FILES:${PN} = "${libdir}/libts.so.* ${nonarch_base_libdir}/udev/rules.d/"
+FILES:${PN} = "${libdir}/libts.so.*"
 FILES:${PN}-dev = "${TS_INSTALL}/lib/cmake ${TS_INSTALL}/include ${libdir}/libts.so"
--
2.34.1