/dev/vchiq is too restricted on Raspberry Pi 4 production image

pleschev · October 31, 2020, 12:18pm

Raspbian GNU/Linux 10 (buster) has the following permissions:

crw-rw---- 1 root video 243, 0 Oct 26 07:17 /dev/vchiq

Using the Raspberry Pi 4 production image, /dev/vchiq has the following permissions:

crw------- 1 root root 243, 0 Aug  6 07:25 /dev/vchiq

Can you please allow users in the video group access to this device in your image? I’m unable to get a non-root user to run omxplayer

The workaround that I have in place is:

Entering the HostOS Terminal and running:

chmod 777 /dev/vchiq

and then restarting the container / service in question. This is reset after every reboot of the host.

kaisoz · November 2, 2020, 11:33am

Hi!

Unfortunately, adding such change would require a operating system update to include it so is not a trivial task.
However, you can automate your workaround in a custom boot script as described here: Custom Boot Action/Script

Thanks for your message!

alexgg · November 2, 2020, 11:40am

Hi, a better way to achieve this would be to add a custom udev rule that will change the device node permissions on detection. See https://www.balena.io/docs/reference/OS/configuration/#udevrules on documentation about customer udev rules.

pleschev · November 6, 2020, 11:22pm

Thank you @alexgg & @kaisoz for taking a look!

I’ve gone off and implemented this approach and it works well:

github.com

pleschev/configizer/blob/master/config.sh#L58


      
          
          # Edit/add the UDEVRULES variable to add your UDEV rules
          # Please don't change the line just below this:
          declare -A UDEVRULES
          # * Step 1: `jq -sR . < rulefilename` and replace the outside the outside double quotes " with single quotes '
          # * Add a new line as UDEVRULES[rulename]='<the contents of the previous step>'
          # * To add multiple rules, create multiple lines with different rulenames
          # * An example rule is just below.
          # UDEVRULES[20-something]='ACTION==\"add\", SUBSYSTEM==\"net\", ATTRS{idVendor}==\"7392\", ATTRS{idProduct}==\"7811\", NAME=\"extAP\"\n'
          
          UDEVRULES[20-vchiq]='SUBSYSTEM==\"vchiq\",GROUP=\"video\",MODE=\"0660\"'
          
          # Whether or not restart the engine if the supervisor restart failed.
          FORCE_SUPERVISOR_RESTART="no"
          
          ###
          # End of script configuration
          ###
          
          set -o errexit -o pipefail

Thank you!