framestream: rename the socket where link() is denied #8
Loading…
Reference in a new issue
No description provided.
Delete branch "asxpi/libtacky:fix/android-frame-streams"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Android's SELinux policy denies apps link() on their own files
(neverallow all_untrusted_apps file_type:file link; the default
create_file_perms carry no link since 2015). tfs_stream_create() binds
the socket inside a private 0700 directory and hard-links it to its
public tv-.sock name, so on Android every frame stream failed:
avc: denied { link } for name="s" ... tclass=sock_file
tacky: preview frame stream could not be created
tacky: incoming frame stream could not be created
and a video call showed neither the self-view nor the peer's video,
while the camera still captured and sent.
Where link() fails with EACCES or EPERM, rename the bound socket to its
name instead, which those perms do allow: the same inode, already 0600,
moved out of the private directory. rename() would replace a name that
is already taken, so a name that exists is skipped first; in a sticky
/tmp another user's file cannot be replaced anyway. The name keeps its
form, so readers and tfs_stream_sweep() are unchanged.
Tested on a Pixel 9 (Android 16): both streams are created and a video
call shows both pictures. On Linux, with link() wrapped to fail with
EACCES, the stream is created 0600, a reader connects, and destroy
leaves the directory empty.
Written and tested on v1.0.0-rc7 (
b40975d6); rebased onto develop (7b31417d), where it applies cleanly.🤖 Generated with Claude Code
Android's SELinux policy denies apps link() on their own files (neverallow all_untrusted_apps file_type:file link; the default create_file_perms carry no link since 2015). tfs_stream_create() binds the socket inside a private 0700 directory and hard-links it to its public tv-<hex>.sock name, so on Android every frame stream failed: avc: denied { link } for name="s" ... tclass=sock_file tacky: preview frame stream could not be created tacky: incoming frame stream could not be created and a video call showed neither the self-view nor the peer's video, while the camera still captured and sent. Where link() fails with EACCES or EPERM, rename the bound socket to its name instead, which those perms do allow: the same inode, already 0600, moved out of the private directory. rename() would replace a name that is already taken, so a name that exists is skipped first; in a sticky /tmp another user's file cannot be replaced anyway. The name keeps its form, so readers and tfs_stream_sweep() are unchanged. Tested on a Pixel 9 (Android 16): both streams are created and a video call shows both pictures. On Linux, with link() wrapped to fail with EACCES, the stream is created 0600, a reader connects, and destroy leaves the directory empty. Assisted-by: Claude:opus-5-5Merged by hand into develop (merge commit in the
8411e18fline) and released in v1.0.0-rc10; thank you. PR #10 went in with a review follow-up (6996b1f9: the wire-answer parse under test, a deadline on the poll, the resolve() doc). Closing, since a hand merge is not marked merged here.Pull request closed