trcc-linux 4.1.1__tar.gz → 4.2.1__tar.gz

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/.gitignore

@@ -99,6 +99,9 @@ trcc_setup.h
 # Dev tooling
 setup_tools/
 tools/
+node_modules/
+package-lock.json
+package.json
 
 # Old udev/systemd files (replaced by trcc setup-udev)
 99-trcc.rules

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trcc-linux
-Version: 4.1.1
+Version: 4.2.1
 Summary: Linux implementation of Thermalright LCD Control Center
 Project-URL: Homepage, https://github.com/Lexonight1/thermalright-trcc-linux
 Project-URL: Documentation, https://github.com/Lexonight1/thermalright-trcc-linux#readme
@@ -220,7 +220,7 @@ rpm-ostree install sg3_utils && echo "Reboot now, then run the next block" && sy
 ```
 After reboot:
 ```bash
-python3 -m venv ~/trcc-env && source ~/trcc-env/bin/activate && pip install trcc-linux && sudo trcc setup-udev && trcc install-desktop
+python3 -m venv ~/trcc-env && source ~/trcc-env/bin/activate && pip install trcc-linux && sudo trcc setup-udev && trcc setup-selinux && trcc install-desktop
 ```
 Launch: `source ~/trcc-env/bin/activate && trcc gui`
 
@@ -277,6 +277,7 @@ trcc led-mode breathing   # Set LED effect mode
 trcc serve                # Start REST API server
 trcc setup                # Interactive setup wizard (CLI)
 trcc setup-gui            # Setup wizard (GUI)
+trcc setup-selinux        # Install SELinux USB policy (Bazzite/Silverblue)
 trcc doctor               # Check system dependencies
 trcc report               # Generate diagnostic report
 trcc setup-udev           # Install udev rules
@@ -284,7 +285,7 @@ trcc install-desktop      # Install app menu entry and icon
 trcc uninstall            # Remove TRCC completely
 ```
 
-See the **[CLI Reference](doc/CLI_REFERENCE.md)** for all 38 commands, options, and troubleshooting.
+See the **[CLI Reference](doc/CLI_REFERENCE.md)** for all 39 commands, options, and troubleshooting.
 
 ## Documentation
 

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/README.md

@@ -158,7 +158,7 @@ rpm-ostree install sg3_utils && echo "Reboot now, then run the next block" && sy
 ```
 After reboot:
 ```bash
-python3 -m venv ~/trcc-env && source ~/trcc-env/bin/activate && pip install trcc-linux && sudo trcc setup-udev && trcc install-desktop
+python3 -m venv ~/trcc-env && source ~/trcc-env/bin/activate && pip install trcc-linux && sudo trcc setup-udev && trcc setup-selinux && trcc install-desktop
 ```
 Launch: `source ~/trcc-env/bin/activate && trcc gui`
 
@@ -215,6 +215,7 @@ trcc led-mode breathing   # Set LED effect mode
 trcc serve                # Start REST API server
 trcc setup                # Interactive setup wizard (CLI)
 trcc setup-gui            # Setup wizard (GUI)
+trcc setup-selinux        # Install SELinux USB policy (Bazzite/Silverblue)
 trcc doctor               # Check system dependencies
 trcc report               # Generate diagnostic report
 trcc setup-udev           # Install udev rules
@@ -222,7 +223,7 @@ trcc install-desktop      # Install app menu entry and icon
 trcc uninstall            # Remove TRCC completely
 ```
 
-See the **[CLI Reference](doc/CLI_REFERENCE.md)** for all 38 commands, options, and troubleshooting.
+See the **[CLI Reference](doc/CLI_REFERENCE.md)** for all 39 commands, options, and troubleshooting.
 
 ## Documentation
 

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trcc-linux"
-version = "4.1.1"
+version = "4.2.1"
 description = "Linux implementation of Thermalright LCD Control Center"
 readme = "README.md"
 license = "GPL-3.0-or-later"

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/src/trcc/__version__.py

@@ -1,6 +1,6 @@
 """TRCC Linux version information."""
 
-__version__ = "4.1.1"
+__version__ = "4.2.1"
 __version_info__ = tuple(int(x) for x in __version__.split("."))
 
 # Version history:
@@ -131,3 +131,14 @@ __version_info__ = tuple(int(x) for x in __version__.split("."))
 # 4.1.1  - Fix pyright error in setup wizard GUI (QLayoutItem.widget() optional
 #          narrowing). Update all docs for v4.1.0: adapters/ layout, setup wizard
 #          commands, current test count (2290), file references. 2290 tests.
+# 4.2.0  - SELinux support: new `trcc setup-selinux` command installs USB policy
+#          module (trcc_usb.te) for Bazzite/Silverblue/Fedora SELinux systems.
+#          SELinux step in setup wizard (CLI + GUI). Fix bulk EBUSY on SELinux:
+#          detect silent detach_kernel_driver() blocking, skip set_configuration()
+#          if device already configured, clear error message. Distro-specific
+#          install hints for checkmodule/semodule_package. Fix CI workflows
+#          triggering on stable branch. 2300 tests.
+# 4.2.1  - Fix bulk claim_interface EBUSY: retry with device reset on stale
+#          USB claims (crashed process, suspend/resume, device re-enumeration).
+#          Fix SELinux detection: detach_kernel_driver error path now correctly
+#          sets selinux_blocked flag for actionable error messages. 2303 tests.

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/src/trcc/adapters/device/bulk.py

@@ -91,51 +91,111 @@ class BulkDevice:
         if dev is None:
             raise RuntimeError(f"USB device {self.vid:04x}:{self.pid:04x} not found")
 
-        # Detach kernel driver before set_configuration() to avoid EBUSY.
-        # Can't rely on get_active_configuration() — it throws if no config
-        # is active yet.  Try interfaces 0-3 (covers all known devices).
+        # Detach kernel drivers (best effort — SELinux may silently block this).
+        selinux_blocked = False
         for i in range(4):
             try:
                 if dev.is_kernel_driver_active(i):  # type: ignore[union-attr]
                     dev.detach_kernel_driver(i)  # type: ignore[union-attr]
-                    log.debug("Detached kernel driver from interface %d", i)
-            except (usb.core.USBError, NotImplementedError) as e:
+                    # Verify detach actually worked (SELinux silently blocks it)
+                    if dev.is_kernel_driver_active(i):  # type: ignore[union-attr]
+                        selinux_blocked = True
+                        log.warning("Kernel driver still active on interface %d after "
+                                    "detach — SELinux may be blocking USB ioctls", i)
+                    else:
+                        log.debug("Detached kernel driver from interface %d", i)
+            except usb.core.USBError as e:
                 log.debug("Could not detach kernel driver from interface %d: %s", i, e)
+                # Check if driver is still active after the error — if so, SELinux
+                # likely blocked the ioctl (the error alone doesn't tell us).
+                try:
+                    if dev.is_kernel_driver_active(i):  # type: ignore[union-attr]
+                        selinux_blocked = True
+                        log.warning("Kernel driver still active on interface %d "
+                                    "after detach error — SELinux may be blocking", i)
+                except (usb.core.USBError, NotImplementedError):
+                    pass
+            except NotImplementedError:
+                pass
 
+        # Skip set_configuration() if device already has an active config.
+        # On SELinux (Bazzite, Silverblue) detach_kernel_driver() is silently
+        # blocked, so set_configuration() always fails with EBUSY.  The kernel
+        # has already configured the device — just use the existing config.
+        cfg = None
         try:
-            dev.set_configuration()  # type: ignore[union-attr]
+            cfg = dev.get_active_configuration()  # type: ignore[union-attr]
+            log.debug("Device already configured, skipping set_configuration()")
         except usb.core.USBError:
-            # SELinux or other security modules may block detach_kernel_driver
-            # silently.  Reset the device to force-release all drivers, then retry.
-            log.warning("set_configuration() failed, resetting device and retrying")
+            log.debug("No active configuration, calling set_configuration()")
+            try:
+                dev.set_configuration()  # type: ignore[union-attr]
+            except usb.core.USBError:
+                log.warning("set_configuration() failed, resetting device and retrying")
+                dev.reset()  # type: ignore[union-attr]
+                import time
+                time.sleep(0.5)
+                dev = usb.core.find(idVendor=self.vid, idProduct=self.pid)
+                if dev is None:
+                    raise RuntimeError(
+                        f"USB device {self.vid:04x}:{self.pid:04x} not found after reset"
+                    )
+                for i in range(4):
+                    try:
+                        if dev.is_kernel_driver_active(i):  # type: ignore[union-attr]
+                            dev.detach_kernel_driver(i)  # type: ignore[union-attr]
+                    except (usb.core.USBError, NotImplementedError):
+                        pass
+                dev.set_configuration()  # type: ignore[union-attr]
+            cfg = dev.get_active_configuration()  # type: ignore[union-attr]
+
+        # Prefer vendor-specific interface (bInterfaceClass=255)
+        intf = None
+        for candidate in cfg:
+            if candidate.bInterfaceClass == 255:  # type: ignore[union-attr]
+                intf = candidate
+                break
+        if intf is None:
+            intf = cfg[(0, 0)]  # type: ignore[index]
+
+        try:
+            usb.util.claim_interface(dev, intf.bInterfaceNumber)  # type: ignore[union-attr]
+        except usb.core.USBError as e:
+            if e.errno != 16:  # Not EBUSY — unknown error
+                raise
+            if selinux_blocked:
+                raise RuntimeError(
+                    "USB interface busy — SELinux is blocking USB device access. "
+                    "Run 'sudo trcc setup-selinux' to install the policy module, "
+                    "then unplug and replug the device."
+                ) from e
+            # EBUSY without SELinux — stale claim from crashed process, suspend,
+            # or device re-enumeration.  Reset the device and retry once.
+            log.warning("claim_interface() EBUSY — resetting device and retrying")
             dev.reset()  # type: ignore[union-attr]
             import time
             time.sleep(0.5)
-            # Re-find after reset (handle is invalidated)
             dev = usb.core.find(idVendor=self.vid, idProduct=self.pid)
             if dev is None:
                 raise RuntimeError(
                     f"USB device {self.vid:04x}:{self.pid:04x} not found after reset"
-                )
+                ) from e
             for i in range(4):
                 try:
                     if dev.is_kernel_driver_active(i):  # type: ignore[union-attr]
                         dev.detach_kernel_driver(i)  # type: ignore[union-attr]
                 except (usb.core.USBError, NotImplementedError):
                     pass
-            dev.set_configuration()  # type: ignore[union-attr]
-        cfg = dev.get_active_configuration()  # type: ignore[union-attr]
-
-        # Prefer vendor-specific interface (bInterfaceClass=255)
-        intf = None
-        for candidate in cfg:
-            if candidate.bInterfaceClass == 255:  # type: ignore[union-attr]
-                intf = candidate
-                break
-        if intf is None:
-            intf = cfg[(0, 0)]  # type: ignore[index]
-
-        usb.util.claim_interface(dev, intf.bInterfaceNumber)  # type: ignore[union-attr]
+            # Re-acquire configuration and interface after reset
+            cfg = dev.get_active_configuration()  # type: ignore[union-attr]
+            intf = None
+            for candidate in cfg:
+                if candidate.bInterfaceClass == 255:  # type: ignore[union-attr]
+                    intf = candidate
+                    break
+            if intf is None:
+                intf = cfg[(0, 0)]  # type: ignore[index]
+            usb.util.claim_interface(dev, intf.bInterfaceNumber)  # type: ignore[union-attr]
 
         self._ep_out = usb.util.find_descriptor(
             intf,

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/src/trcc/adapters/infra/doctor.py

@@ -75,6 +75,15 @@ _INSTALL_MAP: dict[str, dict[str, str]] = {
     'libxcb-cursor': {
         'apt': 'libxcb-cursor0',
     },
+    'checkmodule': {
+        'dnf': 'checkpolicy', 'apt': 'checkpolicy', 'pacman': 'checkpolicy',
+        'zypper': 'checkpolicy', 'rpm-ostree': 'checkpolicy',
+    },
+    'semodule_package': {
+        'dnf': 'policycoreutils', 'apt': 'semodule-utils',
+        'pacman': 'semodule-utils', 'zypper': 'policycoreutils',
+        'rpm-ostree': 'policycoreutils',
+    },
 }
 
 # sudo prefix per package manager
@@ -542,6 +551,57 @@ def check_udev() -> UdevResult:
         return UdevResult(ok=True, message='udev rules installed')
 
 
+@dataclass
+class SelinuxResult:
+    """Result of SELinux policy check."""
+    ok: bool
+    message: str
+    enforcing: bool = False
+    module_loaded: bool = False
+
+
+def check_selinux() -> SelinuxResult:
+    """Check if SELinux is enforcing and if trcc_usb policy module is loaded.
+
+    Returns ok=True when no action is needed: SELinux absent, permissive,
+    disabled, or enforcing with the trcc_usb module already loaded.
+    """
+    import subprocess
+
+    # Check if SELinux is present and enforcing
+    try:
+        r = subprocess.run(
+            ['getenforce'], capture_output=True, text=True, timeout=5,
+        )
+        status = r.stdout.strip().lower()
+    except FileNotFoundError:
+        return SelinuxResult(ok=True, message='SELinux not installed')
+    except Exception:
+        return SelinuxResult(ok=True, message='SELinux status unknown')
+
+    if status != 'enforcing':
+        return SelinuxResult(ok=True, message=f'SELinux {status} (no policy needed)')
+
+    # SELinux is enforcing — check if trcc_usb module is loaded
+    try:
+        r = subprocess.run(
+            ['semodule', '-l'], capture_output=True, text=True, timeout=10,
+        )
+        loaded = 'trcc_usb' in r.stdout
+    except (FileNotFoundError, Exception):
+        loaded = False
+
+    if loaded:
+        return SelinuxResult(
+            ok=True, message='SELinux enforcing — trcc_usb module loaded',
+            enforcing=True, module_loaded=True,
+        )
+    return SelinuxResult(
+        ok=False, message='SELinux enforcing — USB policy not installed',
+        enforcing=True, module_loaded=False,
+    )
+
+
 def check_desktop_entry() -> bool:
     """Check if .desktop file is installed."""
     from pathlib import Path
@@ -611,6 +671,17 @@ def run_doctor() -> int:
     if not _check_udev_rules():
         all_ok = False
 
+    # SELinux
+    se = check_selinux()
+    if se.enforcing:
+        print()
+        if se.ok:
+            print(f"  {_OK}  {se.message}")
+        else:
+            print(f"  {_MISS}  {se.message}")
+            print("         run: sudo trcc setup-selinux")
+            all_ok = False
+
     # Summary
     print()
     if all_ok:

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/src/trcc/cli.py

@@ -362,6 +362,12 @@ def _cmd_setup_udev(
     return SystemCommands.setup_udev(dry_run=dry_run)
 
 
+@app.command("setup-selinux")
+def _cmd_setup_selinux() -> int:
+    """Install SELinux policy module for USB device access."""
+    return SystemCommands.setup_selinux()
+
+
 @app.command("install-desktop")
 def _cmd_install_desktop() -> int:
     """Install application menu entry and icon."""
@@ -2112,6 +2118,110 @@ class SystemCommands:
             print(f"Error: {e}")
             return 1
 
+    @staticmethod
+    def setup_selinux():
+        """Install SELinux policy module allowing USB device access.
+
+        Compiles trcc_usb.te → .mod → .pp, then loads via semodule.
+        Required on SELinux-enforcing systems (Bazzite, Silverblue) where
+        detach_kernel_driver() is silently blocked.
+        """
+        import shutil
+        import tempfile
+
+        # Must be root
+        if os.geteuid() != 0:
+            return _sudo_reexec("setup-selinux")
+
+        # Check if SELinux is enforcing
+        try:
+            r = subprocess.run(
+                ["getenforce"], capture_output=True, text=True, timeout=5,
+            )
+            status = r.stdout.strip().lower()
+        except FileNotFoundError:
+            print("SELinux not installed — nothing to do.")
+            return 0
+
+        if status != 'enforcing':
+            print(f"SELinux is {status} — no policy needed.")
+            return 0
+
+        # Check if already loaded
+        try:
+            r = subprocess.run(
+                ["semodule", "-l"], capture_output=True, text=True, timeout=10,
+            )
+            if 'trcc_usb' in r.stdout:
+                print("SELinux module trcc_usb already loaded.")
+                return 0
+        except FileNotFoundError:
+            print("semodule not found — cannot manage SELinux policies.")
+            return 1
+
+        # Check for checkmodule and semodule_package
+        from trcc.adapters.infra.doctor import _detect_pkg_manager, _install_hint
+        pm = _detect_pkg_manager()
+
+        missing: list[str] = []
+        for tool in ('checkmodule', 'semodule_package'):
+            if not shutil.which(tool):
+                missing.append(tool)
+        if missing:
+            for tool in missing:
+                print(f"  {tool} not found — {_install_hint(tool, pm)}")
+            return 1
+
+        # Find .te source (shipped in package data)
+        te_src = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'data', 'trcc_usb.te')
+        if not os.path.isfile(te_src):
+            print(f"SELinux policy source not found: {te_src}")
+            return 1
+
+        # Compile and install in temp directory
+        try:
+            with tempfile.TemporaryDirectory() as tmp:
+                import shutil as sh
+                te_path = os.path.join(tmp, 'trcc_usb.te')
+                mod_path = os.path.join(tmp, 'trcc_usb.mod')
+                pp_path = os.path.join(tmp, 'trcc_usb.pp')
+
+                sh.copy2(te_src, te_path)
+
+                # checkmodule -M -m -o trcc_usb.mod trcc_usb.te
+                r = subprocess.run(
+                    ['checkmodule', '-M', '-m', '-o', mod_path, te_path],
+                    capture_output=True, text=True,
+                )
+                if r.returncode != 0:
+                    print(f"checkmodule failed: {r.stderr.strip()}")
+                    return 1
+
+                # semodule_package -o trcc_usb.pp -m trcc_usb.mod
+                r = subprocess.run(
+                    ['semodule_package', '-o', pp_path, '-m', mod_path],
+                    capture_output=True, text=True,
+                )
+                if r.returncode != 0:
+                    print(f"semodule_package failed: {r.stderr.strip()}")
+                    return 1
+
+                # semodule -i trcc_usb.pp
+                r = subprocess.run(
+                    ['semodule', '-i', pp_path],
+                    capture_output=True, text=True,
+                )
+                if r.returncode != 0:
+                    print(f"semodule install failed: {r.stderr.strip()}")
+                    return 1
+
+            print("Installed SELinux module trcc_usb (USB device access for TRCC).")
+            return 0
+
+        except Exception as e:
+            print(f"Error installing SELinux policy: {e}")
+            return 1
+
     @staticmethod
     def install_desktop():
         """Install .desktop menu entry and icon for app launchers.
@@ -2302,6 +2412,7 @@ StartupWMClass=trcc-linux
         from trcc.adapters.infra.doctor import (
             check_desktop_entry,
             check_gpu,
+            check_selinux,
             check_system_deps,
             check_udev,
             get_setup_info,
@@ -2312,8 +2423,8 @@ StartupWMClass=trcc-linux
 
         actions: list[str] = []
 
-        # ── Step 1/4: System dependencies ────────────────────────────
-        print("  Step 1/4: System dependencies")
+        # ── Step 1/5: System dependencies ────────────────────────────
+        print("  Step 1/5: System dependencies")
         deps = check_system_deps(info.pkg_manager)
         missing_required: list[str] = []
         missing_optional: list[str] = []
@@ -2351,8 +2462,8 @@ StartupWMClass=trcc-linux
 
         print()
 
-        # ── Step 2/4: GPU detection ──────────────────────────────────
-        print("  Step 2/4: GPU detection")
+        # ── Step 2/5: GPU detection ──────────────────────────────────
+        print("  Step 2/5: GPU detection")
         gpus = check_gpu()
         if not gpus:
             print("    [--]  No discrete GPU detected")
@@ -2375,8 +2486,8 @@ StartupWMClass=trcc-linux
                         print(f"    [!!] pip failed (exit {result.returncode})")
         print()
 
-        # ── Step 3/4: USB device permissions ─────────────────────────
-        print("  Step 3/4: USB device permissions")
+        # ── Step 3/5: USB device permissions ─────────────────────────
+        print("  Step 3/5: USB device permissions")
         udev = check_udev()
         if udev.ok:
             print(f"    [OK]  {udev.message}")
@@ -2392,8 +2503,26 @@ StartupWMClass=trcc-linux
                     print("    [!!] udev setup failed")
         print()
 
-        # ── Step 4/4: Desktop integration ────────────────────────────
-        print("  Step 4/4: Desktop integration")
+        # ── Step 4/5: SELinux policy ───────────────────────────────────
+        se = check_selinux()
+        if se.enforcing:
+            print("  Step 4/5: SELinux policy")
+            if se.ok:
+                print(f"    [OK]  {se.message}")
+            else:
+                print(f"    [!!]  {se.message}")
+                if SystemCommands._confirm(
+                    "Install SELinux USB policy? (requires sudo)", auto_yes,
+                ):
+                    rc = SystemCommands.setup_selinux()
+                    if rc == 0:
+                        actions.append("Installed SELinux policy")
+                    else:
+                        print("    [!!] SELinux setup failed")
+            print()
+
+        # ── Step 5/5: Desktop integration ────────────────────────────
+        print("  Step 5/5: Desktop integration")
         if check_desktop_entry():
             print("    [OK]  Application menu entry installed")
         else:

trcc_linux-4.2.1/src/trcc/data/trcc_usb.te

@@ -0,0 +1,9 @@
+module trcc_usb 1.0;
+
+require {
+    type unconfined_t;
+    type usb_device_t;
+    class chr_file { getattr ioctl open read write };
+}
+
+allow unconfined_t usb_device_t:chr_file { getattr ioctl open read write };

{trcc_linux-4.1.1 → trcc_linux-4.2.1}/src/trcc/install/gui.py

@@ -206,7 +206,9 @@ class SetupWizard(QWidget):
         self._rows.clear()
         while self._checks_lay.count():
             item = self._checks_lay.takeAt(0)
-            w = item.widget() if item else None
+            if item is None:
+                continue
+            w = item.widget()
             if w is not None:
                 w.deleteLater()
 
@@ -243,6 +245,7 @@ class SetupWizard(QWidget):
         from trcc.adapters.infra.doctor import (
             check_desktop_entry,
             check_gpu,
+            check_selinux,
             check_system_deps,
             check_udev,
             get_setup_info,
@@ -283,8 +286,22 @@ class SetupWizard(QWidget):
             install_cmd=udev_cmd,
         )
 
-        # Step 5 — desktop entry
-        self._section('Step 5: Desktop Integration')
+        # Step 5 — SELinux (only shown when enforcing)
+        se = check_selinux()
+        if se.enforcing:
+            self._section('Step 5: SELinux Policy')
+            se_cmd = (
+                '' if se.ok
+                else 'sudo ' + self._trcc_prefix() + ' setup-selinux'
+            )
+            self._add_dep(
+                'SELinux USB policy', se.ok, True,
+                note='' if se.ok else se.message,
+                install_cmd=se_cmd,
+            )
+
+        # Step 6 — desktop entry
+        self._section('Step 6: Desktop Integration')
         desk = check_desktop_entry()
         desk_cmd = '' if desk else self._trcc_prefix() + ' install-desktop'
         self._add_dep(