trcc-linux 4.2.8__tar.gz → 5.0.1__tar.gz

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/.gitignore

@@ -124,3 +124,6 @@ trcc_callgraph*
 
 # Large binary docs
 doc/*.pdf
+
+# C# audit docs (reference only, not for distribution)
+doc/audit/

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trcc-linux
-Version: 4.2.8
+Version: 5.0.1
 Summary: Linux implementation of Thermalright LCD Control Center
 Project-URL: Homepage, https://github.com/Lexonight1/thermalright-trcc-linux
 Project-URL: Documentation, https://github.com/Lexonight1/thermalright-trcc-linux#readme

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "trcc-linux"
-version = "4.2.8"
+version = "5.0.1"
 description = "Linux implementation of Thermalright LCD Control Center"
 readme = "README.md"
 license = "GPL-3.0-or-later"

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/src/trcc/__version__.py

@@ -1,6 +1,6 @@
 """TRCC Linux version information."""
 
-__version__ = "4.2.8"
+__version__ = "5.0.1"
 __version_info__ = tuple(int(x) for x in __version__.split("."))
 
 # Version history:
@@ -174,3 +174,17 @@ __version_info__ = tuple(int(x) for x in __version__.split("."))
 #          Fix LED device handshake warning on boot: route LED devices
 #          directly to LED panel in auto-select, skipping LCD handshake.
 #          2311 tests.
+# 5.0.0  - Complete Windows C# feature parity: full gap audit (35 items
+#          resolved). HIGH: fix wire remap tables for LED styles 1-12,
+#          PA120 GPU digit shift, LC2 date/colon, LF11 disk metrics,
+#          LC1 MHz 4-digit. MEDIUM: zone carousel, LED test mode, DDR
+#          multiplier, disk selector, per-zone on/off, split mode (Dynamic
+#          Island), preview drag, slideshow carousel. LOW: video fit-mode
+#          during playback (width/height letterbox), expanded DRAM info
+#          (15 dmidecode fields), disk SMART health, SPI byte order fix.
+#          VideoDecoder fit-mode via ffprobe + proportional scaling.
+#          2315 tests.
+# 5.0.1  - Fix SELinux detection without root: semodule -l requires root
+#          and always reported [!!] in setup-gui for non-root users.
+#          Fall back to sesearch --allow which queries the loaded kernel
+#          policy without elevated privileges. 2316 tests.

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/src/trcc/adapters/device/led_segment.py

@@ -189,6 +189,30 @@ class SegmentDisplay(ABC):
                 if seg_name in segs:
                     mask[leds[wire_idx]] = True
 
+    def _encode_5digit(
+        self,
+        value: int,
+        digit_leds: Tuple[Tuple[int, ...], ...],
+        mask: List[bool],
+    ) -> None:
+        """Encode 0-99999 into 5 seven-segment digits with leading-zero suppression."""
+        v = max(0, min(99999, value))
+        digits = [(v // 10000), (v % 10000) // 1000, (v % 1000) // 100,
+                  (v % 100) // 10, v % 10]
+        chars = [str(d) for d in digits]
+        # Suppress leading zeros
+        for i in range(4):  # don't suppress ones digit
+            if digits[i] == 0:
+                chars[i] = ' '
+            else:
+                break
+        for digit_idx, ch in enumerate(chars):
+            segs = self.CHAR_7SEG.get(ch, set())
+            leds = digit_leds[digit_idx]
+            for wire_idx, seg_name in enumerate(self.WIRE_7SEG):
+                if seg_name in segs:
+                    mask[leds[wire_idx]] = True
+
     def _encode_2digit_partial(
         self,
         value: int,
@@ -376,18 +400,18 @@ class PA120Display(SegmentDisplay):
         (31, 32, 33, 34, 35, 36, 37),
         (38, 39, 40, 41, 42, 43, 44),
     )
-    CPU_USE_PARTIAL = (46, 47)
+    CPU_USE_PARTIAL = (80, 81)   # B11/C11 overflow for "1xx"
 
     GPU_TEMP_DIGITS: Tuple[Tuple[int, ...], ...] = (
-        (52, 53, 54, 55, 56, 57, 58),
-        (59, 60, 61, 62, 63, 64, 65),
-        (66, 67, 68, 69, 70, 71, 72),
+        (45, 46, 47, 48, 49, 50, 51),  # LED6 = gpuTemp hundreds
+        (52, 53, 54, 55, 56, 57, 58),  # LED7 = gpuTemp tens
+        (59, 60, 61, 62, 63, 64, 65),  # LED8 = gpuTemp ones
     )
-    GPU_USE_TENS: Tuple[Tuple[int, ...], ...] = (
-        (73, 74, 75, 76, 77, 78, 79),
+    GPU_USE_DIGITS: Tuple[Tuple[int, ...], ...] = (
+        (66, 67, 68, 69, 70, 71, 72),  # LED9 = gpuUse tens
+        (73, 74, 75, 76, 77, 78, 79),  # LED10 = gpuUse ones
     )
-    GPU_USE_ONES_BC = (80, 81)
-    GPU_USE_PARTIAL = (82, 83)
+    GPU_USE_PARTIAL = (82, 83)   # B12/C12 overflow for "1xx"
 
     # ── Interface ──────────────────────────────────────────────────
 
@@ -430,24 +454,11 @@ class PA120Display(SegmentDisplay):
             self.GPU_TEMP_DIGITS, mask,
         )
 
-        # GPU usage: tens (full) + ones (B,C only) + hundreds (partial)
-        gu = max(0, min(199, int(getattr(metrics, 'gpu_usage', 0))))
-        if gu >= 100:
-            mask[self.GPU_USE_PARTIAL[0]] = True
-            mask[self.GPU_USE_PARTIAL[1]] = True
-            gu -= 100
-        d_t, d_o = gu // 10, gu % 10
-        # Tens → full 7-seg digit
-        segs_t = self.CHAR_7SEG.get(str(d_t) if d_t > 0 else ' ', set())
-        for wire_idx, seg_name in enumerate(self.WIRE_7SEG):
-            if seg_name in segs_t:
-                mask[self.GPU_USE_TENS[0][wire_idx]] = True
-        # Ones → partial (B, C segments only)
-        segs_o = self.CHAR_7SEG.get(str(d_o), set())
-        if 'b' in segs_o:
-            mask[self.GPU_USE_ONES_BC[0]] = True
-        if 'c' in segs_o:
-            mask[self.GPU_USE_ONES_BC[1]] = True
+        # GPU usage: 2 full digits + partial overflow (same pattern as CPU usage)
+        self._encode_2digit_partial(
+            int(getattr(metrics, 'gpu_usage', 0)),
+            self.GPU_USE_DIGITS, self.GPU_USE_PARTIAL, mask,
+        )
 
         return mask
 
@@ -528,6 +539,8 @@ class LC1Display(SegmentDisplay):
     """Style 4 — LC1: 38-LED mask, mode-based 3-phase (temp/MHz/GB).
 
     NVMe memory device — displays different metrics with unit symbol.
+    Sub-style 0 = memory mode (temp/MHz*DDR/GB).
+    Sub-style 1 = hard disk mode (temp/RPM/MHz).
     Remapped style.
     """
 
@@ -543,11 +556,18 @@ class LC1Display(SegmentDisplay):
     )
     UNIT_DIGIT = (24, 25, 26, 27, 28, 29, 30)
 
-    PHASES = (
+    # Sub-style 0: memory mode phases
+    PHASES_MEM = (
         ('mem_temp', 0, SSD),     # temperature
-        ('mem_clock', 1, MTNO),   # MHz
+        ('mem_clock', 1, MTNO),   # MHz (* memoryRatio)
         ('mem_used', 2, GNO),     # GB
     )
+    # Sub-style 1: hard disk mode phases
+    PHASES_DISK = (
+        ('disk_temp', 0, SSD),    # temperature
+        ('disk_read', 1, MTNO),   # RPM/MHz
+        ('disk_activity', 2, GNO),  # activity
+    )
 
     # ── Interface ──────────────────────────────────────────────────
 
@@ -559,22 +579,39 @@ class LC1Display(SegmentDisplay):
     def phase_count(self) -> int:
         return 3
 
+    # All 4 digit positions for 4-digit modes (MHz/GB)
+    ALL_DIGITS: Tuple[Tuple[int, ...], ...] = (
+        (3, 4, 5, 6, 7, 8, 9),
+        (10, 11, 12, 13, 14, 15, 16),
+        (17, 18, 19, 20, 21, 22, 23),
+        (24, 25, 26, 27, 28, 29, 30),
+    )
+
     def compute_mask(self, metrics: HardwareMetrics, phase: int = 0,
                      temp_unit: str = "C", **kw: Any) -> List[bool]:
         mask = [False] * 38
 
-        metric_key, mode, indicator_idx = self.PHASES[phase % 3]
-        actual_mode = mode
-        if mode == 0 and temp_unit == "F":
-            actual_mode = -1
+        sub_style = kw.get('sub_style', 0)
+        memory_ratio = kw.get('memory_ratio', 2)
+        phases = self.PHASES_DISK if sub_style == 1 else self.PHASES_MEM
 
+        metric_key, mode, indicator_idx = phases[phase % 3]
         mask[indicator_idx] = True
-
         value = int(getattr(metrics, metric_key, 0))
-        if actual_mode == -1:
-            value = self._to_display_temp(value, "F")
-        self._encode_3digit(value, self.DIGITS, mask)
-        self._encode_unit(actual_mode, self.UNIT_DIGIT, mask)
+
+        if mode == 0:
+            # Temperature: 3 digits + C/F unit symbol on digit 4
+            if temp_unit == "F":
+                value = self._to_display_temp(value, "F")
+            self._encode_3digit(value, self.DIGITS, mask)
+            unit_mode = -1 if temp_unit == "F" else 0
+            self._encode_unit(unit_mode, self.UNIT_DIGIT, mask)
+        else:
+            # MHz/GB/RPM: 4-digit number using all 4 positions
+            if sub_style == 0 and mode == 1:
+                value *= memory_ratio  # DDR multiplier for memory clock
+            self._encode_4digit(value, self.ALL_DIGITS, mask)
+
         return mask
 
 
@@ -830,17 +867,20 @@ class LC2Display(SegmentDisplay):
     """
 
     # ── Layout data ────────────────────────────────────────────────
+    # Indices 0-2: time colon dots (0, 1) + date separator (2) — always on
+    COLON_AND_SEP = (0, 1, 2)
+
     DIGITS: Tuple[Tuple[int, ...], ...] = (
         (3, 4, 5, 6, 7, 8, 9),        # Hour tens
         (10, 11, 12, 13, 14, 15, 16),  # Hour ones
         (17, 18, 19, 20, 21, 22, 23),  # Minute tens
         (24, 25, 26, 27, 28, 29, 30),  # Minute ones
-        (31, 32, 33, 34, 35, 36, 37),  # Month tens
-        (38, 39, 40, 41, 42, 43, 44),  # Month ones
-        (45, 46, 47, 48, 49, 50, 51),  # Day tens
+        (31, 32, 33, 34, 35, 36, 37),  # Month ones (full digit)
+        (38, 39, 40, 41, 42, 43, 44),  # Day tens (full digit)
+        (45, 46, 47, 48, 49, 50, 51),  # Day ones (full digit)
     )
-    DAY_ONES_BC = (52, 53)
-    DECORATION = tuple(range(54, 61))
+    MONTH_TENS_BC = (52, 53)  # B8/C8 — partial for month tens (0 or 1)
+    DECORATION = tuple(range(54, 61))  # 7 weekday bar indicators
 
     # ── Interface ──────────────────────────────────────────────────
 
@@ -857,8 +897,13 @@ class LC2Display(SegmentDisplay):
         mask = [False] * 61
 
         is_24h = kw.get('is_24h', True)
+        week_sunday = kw.get('week_sunday', False)
         now = datetime.now()
 
+        # Time colons + date separator — always on
+        for idx in self.COLON_AND_SEP:
+            mask[idx] = True
+
         hour = now.hour
         if not is_24h:
             hour = hour % 12
@@ -872,21 +917,33 @@ class LC2Display(SegmentDisplay):
         self._encode_clock_digit(now.minute // 10, self.DIGITS[2], mask)
         self._encode_clock_digit(now.minute % 10, self.DIGITS[3], mask)
 
-        # Month
-        self._encode_clock_digit(now.month // 10, self.DIGITS[4], mask)
-        self._encode_clock_digit(now.month % 10, self.DIGITS[5], mask)
-
-        # Day: tens (full) + ones (partial B,C)
-        self._encode_clock_digit(now.day // 10, self.DIGITS[6], mask)
-        d_ones = now.day % 10
-        segs = self.CHAR_7SEG.get(str(d_ones), set())
-        if 'b' in segs:
-            mask[self.DAY_ONES_BC[0]] = True
-        if 'c' in segs:
-            mask[self.DAY_ONES_BC[1]] = True
+        # Month tens: partial B/C only (can only show "1" or blank)
+        m_tens = now.month // 10
+        if m_tens == 1:
+            mask[self.MONTH_TENS_BC[0]] = True  # B segment
+            mask[self.MONTH_TENS_BC[1]] = True  # C segment
+
+        # Month ones: full digit at DIGITS[4]
+        self._encode_clock_digit(now.month % 10, self.DIGITS[4], mask)
+
+        # Day: tens (full) + ones (full)
+        self._encode_clock_digit(now.day // 10, self.DIGITS[5], mask,
+                                 suppress_zero=True)
+        self._encode_clock_digit(now.day % 10, self.DIGITS[6], mask)
+
+        # Weekday progressive fill (C#: isOn[ZhuangShi1]=true always,
+        # isOn[ZhuangShi2]=(w>0), isOn[ZhuangShi3]=(w>1), ... isOn[ZhuangShi7]=(w>5))
+        # Python weekday: 0=Mon..6=Sun; C# DayOfWeek: 0=Sun..6=Sat
+        py_wd = now.weekday()  # 0=Mon..6=Sun
+        if week_sunday:
+            # Sunday-start: Sun=0, Mon=1, ..., Sat=6
+            w = (py_wd + 1) % 7
+        else:
+            # Monday-start: Mon=0, ..., Sun=6
+            w = py_wd
+        for i, idx in enumerate(self.DECORATION):
+            mask[idx] = (i == 0) or (w > i - 1)
 
-        for idx in self.DECORATION:
-            mask[idx] = True
         return mask
 
 
@@ -895,15 +952,16 @@ class LC2Display(SegmentDisplay):
 # ═══════════════════════════════════════════════════════════════════════
 
 class LF11Display(SegmentDisplay):
-    """Style 10 — LF11: 38-LED, 4-phase sensor rotation with unit symbol.
+    """Style 10 — LF11: 38-LED, hard-disk sensor rotation.
 
-    Similar to AX120 rotation but with 5 digit positions and unit display.
+    C# SetMyNumeralHardDisk: mode 0 = SSD temp (3-digit + C/F),
+    mode 1 = BFB/fan (5-digit), mode 2 = MHz (5-digit).
     """
 
     # ── Layout data ────────────────────────────────────────────────
-    SSD = 0       # °C/°F
-    BFB = 1       # %
-    MHZ_IND = 2   # MHz
+    SSD = 0       # °C/°F indicator
+    BFB = 1       # % / fan indicator (shared with MTNo)
+    MHZ_IND = 2   # MHz indicator (shared with GNo)
 
     DIGITS: Tuple[Tuple[int, ...], ...] = (
         (3, 4, 5, 6, 7, 8, 9),
@@ -913,11 +971,11 @@ class LF11Display(SegmentDisplay):
         (31, 32, 33, 34, 35, 36, 37),
     )
 
+    # (metric_key, mode): mode 0=temp, 1=BFB/5-digit, 2=MHz/5-digit
     PHASES = (
-        ('cpu_temp', True),
-        ('cpu_percent', False),
-        ('gpu_temp', True),
-        ('gpu_usage', False),
+        ('disk_temp', 0),
+        ('disk_activity', 1),
+        ('disk_read', 2),
     )
 
     # ── Interface ──────────────────────────────────────────────────
@@ -928,27 +986,30 @@ class LF11Display(SegmentDisplay):
 
     @property
     def phase_count(self) -> int:
-        return 4
+        return 3
 
     def compute_mask(self, metrics: HardwareMetrics, phase: int = 0,
                      temp_unit: str = "C", **kw: Any) -> List[bool]:
         mask = [False] * 38
 
-        metric_key, is_temp = self.PHASES[phase % 4]
+        metric_key, mode = self.PHASES[phase % 3]
+        value = int(getattr(metrics, metric_key, 0))
 
-        if is_temp:
+        if mode == 0:
+            # Temperature: SSD indicator, 3-digit + C/F unit on digits 4-5
             mask[self.SSD] = True
-        else:
-            mask[self.BFB] = True
-
-        value = int(getattr(metrics, metric_key, 0))
-        if is_temp:
             value = self._to_display_temp(value, temp_unit)
-        self._encode_3digit(value, self.DIGITS[0:3], mask)
-
-        if is_temp:
-            mode = -1 if temp_unit == "F" else 0
-            self._encode_unit(mode, self.DIGITS[3], mask)
+            self._encode_3digit(value, self.DIGITS[0:3], mask)
+            unit_mode = -1 if temp_unit == "F" else 0
+            self._encode_unit(unit_mode, self.DIGITS[3], mask)
+        elif mode == 1:
+            # BFB/fan: 5-digit value across all positions
+            mask[self.BFB] = True
+            self._encode_5digit(value, self.DIGITS, mask)
+        else:
+            # MHz: 5-digit value across all positions
+            mask[self.MHZ_IND] = True
+            self._encode_5digit(value, self.DIGITS, mask)
 
         return mask
 

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/src/trcc/adapters/device/scsi.py

@@ -15,6 +15,7 @@ import struct
 import subprocess
 import tempfile
 import time
+import zlib
 from typing import Dict, List, Set
 
 from trcc.adapters.infra.data_repository import SysUtils
@@ -33,6 +34,19 @@ _POST_INIT_DELAY = 0.1
 _FRAME_CMD_BASE = 0x101F5
 _CHUNK_SIZE = 0x10000  # 64 KiB per chunk (except possibly the last)
 
+# Boot animation SCSI commands (from USBLCD.exe reverse engineering)
+_ANIM_FIRST_FRAME = 0x000201F5   # Compressed first frame (CDB[8]=frame_count)
+_ANIM_CAROUSEL = 0x000301F5      # Compressed carousel frame (CDB[3]=delay, CDB[8]=frame_index)
+_ANIM_COMPRESS_LEVEL = 3         # zlib compression level (fast, matches USBLCD.exe)
+_ANIM_FIRST_DELAY_S = 0.5       # 500ms sleep after first frame
+_ANIM_FRAME_DELAY_S = 0.01      # 10ms sleep between carousel frames
+_ANIM_MAX_FRAMES = 249           # C# rejects >= 250
+
+# Boot animation supported resolutions (C# returns immediately for others)
+_BOOT_ANIM_RESOLUTIONS = {
+    (240, 240), (240, 320), (320, 240), (320, 320),
+}
+
 
 # =========================================================================
 # SCSI device class
@@ -162,6 +176,75 @@ class ScsiDevice:
             ScsiDevice._scsi_write(dev, header, rgb565_data[offset:offset + size])
             offset += size
 
+    @staticmethod
+    def _build_anim_header(cmd: int, word2: int, compressed_size: int) -> bytes:
+        """Build 20-byte CDB for compressed animation commands (no CRC).
+
+        Layout: [cmd:4][0:4][word2:4][compressed_size:4][0:4]
+        Used for 0x201F5 (first frame) and 0x301F5 (carousel frames).
+        """
+        return struct.pack('<IIIII', cmd, 0, word2, compressed_size, 0)
+
+    @staticmethod
+    def _send_boot_animation(
+        dev: str,
+        frames: list[bytes],
+        delays: list[int],
+        width: int,
+        height: int,
+    ) -> bool:
+        """Send multi-frame boot animation to device flash via SCSI.
+
+        Matches USBLCD.exe compressed animation upload protocol:
+        1. Compress first frame with zlib, send with 0x201F5 (frame_count in CDB[8])
+        2. For each subsequent frame, compress and send with 0x301F5
+           (delay in CDB[3], frame_index in CDB[8])
+
+        Args:
+            dev: SCSI device path (/dev/sgX).
+            frames: List of RGB565 byte arrays (one per animation frame).
+            delays: Per-frame delays in centiseconds (from GIF metadata).
+            width: Frame width in pixels.
+            height: Frame height in pixels.
+
+        Returns:
+            True if all frames sent successfully.
+        """
+        if (width, height) not in _BOOT_ANIM_RESOLUTIONS:
+            log.warning("Boot animation not supported for %dx%d", width, height)
+            return False
+
+        n = len(frames)
+        if n == 0 or n >= _ANIM_MAX_FRAMES:
+            log.warning("Boot animation frame count %d out of range (1-%d)", n, _ANIM_MAX_FRAMES - 1)
+            return False
+
+        # Phase 1: Compress and send first frame
+        compressed = zlib.compress(frames[0], _ANIM_COMPRESS_LEVEL)
+        header = ScsiDevice._build_anim_header(_ANIM_FIRST_FRAME, n, len(compressed))
+        if not ScsiDevice._scsi_write(dev, header, compressed):
+            log.error("Boot animation: failed to send first frame")
+            return False
+        log.info("Boot animation: sent first frame (%d bytes compressed, %d frames total)",
+                 len(compressed), n)
+        time.sleep(_ANIM_FIRST_DELAY_S)
+
+        # Phase 2: Send each carousel frame
+        for i in range(n):
+            compressed = zlib.compress(frames[i], _ANIM_COMPRESS_LEVEL)
+            # Delay: centiseconds * 10 → milliseconds, capped at 250
+            delay_raw = delays[i] if i < len(delays) else 10
+            delay_byte = min(delay_raw * 10, 250) & 0xFF
+            cmd = _ANIM_CAROUSEL | (delay_byte << 24)
+            header = ScsiDevice._build_anim_header(cmd, i, len(compressed))
+            if not ScsiDevice._scsi_write(dev, header, compressed):
+                log.error("Boot animation: failed to send frame %d", i)
+                return False
+            time.sleep(_ANIM_FRAME_DELAY_S)
+
+        log.info("Boot animation: all %d frames sent successfully", n)
+        return True
+
     # --- Instance methods ---
 
     def handshake(self) -> HandshakeResult:
@@ -183,6 +266,21 @@ class ScsiDevice:
         ScsiDevice._send_frame(self.device_path, rgb565_data, self.width, self.height)
         return True
 
+    def send_boot_animation(
+        self, frames: list[bytes], delays: list[int],
+    ) -> bool:
+        """Send boot animation to device flash.
+
+        Args:
+            frames: List of RGB565 byte arrays (one per frame).
+            delays: Per-frame delays in centiseconds (from GIF metadata).
+        """
+        if not self._initialized:
+            self.handshake()
+        return ScsiDevice._send_boot_animation(
+            self.device_path, frames, delays, self.width, self.height,
+        )
+
     def close(self) -> None:
         """Mark as uninitialized (no persistent resources to release)."""
         self._initialized = False

{trcc_linux-4.2.8 → trcc_linux-5.0.1}/src/trcc/adapters/infra/doctor.py

@@ -561,10 +561,15 @@ class SelinuxResult:
 
 
 def check_selinux() -> SelinuxResult:
-    """Check if SELinux is enforcing and if trcc_usb policy module is loaded.
+    """Check if SELinux is enforcing and if USB device access is allowed.
 
     Returns ok=True when no action is needed: SELinux absent, permissive,
-    disabled, or enforcing with the trcc_usb module already loaded.
+    disabled, or enforcing with USB access already permitted (via trcc_usb
+    module or base policy).
+
+    Detection order:
+    1. ``semodule -l`` — checks module list (requires root)
+    2. ``sesearch`` — queries loaded kernel policy (works without root)
     """
     import subprocess
 
@@ -583,25 +588,61 @@ def check_selinux() -> SelinuxResult:
         return SelinuxResult(ok=True, message=f'SELinux {status} (no policy needed)')
 
     # SELinux is enforcing — check if trcc_usb module is loaded
+    # semodule -l requires root; try it first, fall back to sesearch
     try:
         r = subprocess.run(
             ['semodule', '-l'], capture_output=True, text=True, timeout=10,
         )
-        loaded = 'trcc_usb' in r.stdout
+        if r.returncode == 0 and 'trcc_usb' in r.stdout:
+            return SelinuxResult(
+                ok=True, message='SELinux enforcing — trcc_usb module loaded',
+                enforcing=True, module_loaded=True,
+            )
     except (FileNotFoundError, Exception):
-        loaded = False
+        pass
 
-    if loaded:
+    # semodule failed (non-root) or module not listed — check if the
+    # needed USB permissions exist in the loaded policy via sesearch
+    if _selinux_usb_access_allowed():
         return SelinuxResult(
-            ok=True, message='SELinux enforcing — trcc_usb module loaded',
+            ok=True,
+            message='SELinux enforcing — USB access permitted by policy',
             enforcing=True, module_loaded=True,
         )
+
     return SelinuxResult(
         ok=False, message='SELinux enforcing — USB policy not installed',
         enforcing=True, module_loaded=False,
     )
 
 
+def _selinux_usb_access_allowed() -> bool:
+    """Check if the loaded SELinux policy allows USB device access.
+
+    Uses ``sesearch`` to query the kernel policy — works without root.
+    Our trcc_usb module grants:
+        allow unconfined_t usb_device_t:chr_file { ioctl open read write }
+    The base policy may already cover this via attribute rules.
+    """
+    import subprocess
+
+    try:
+        r = subprocess.run(
+            ['sesearch', '--allow', '-s', 'unconfined_t',
+             '-t', 'usb_device_t', '-c', 'chr_file'],
+            capture_output=True, text=True, timeout=10,
+        )
+        if r.returncode != 0:
+            return False
+        # Check that all required permissions are present
+        for perm in ('ioctl', 'open', 'read', 'write'):
+            if perm not in r.stdout:
+                return False
+        return True
+    except (FileNotFoundError, Exception):
+        return False
+
+
 def check_desktop_entry() -> bool:
     """Check if .desktop file is installed."""
     from pathlib import Path