nixos/jellyfin: better defaults for hardware acceleration #175439

Mic92 · 2022-05-30T07:12:06Z

Description of changes

I have not tested any of that. I just changed this based on recent additions to the wiki: https://nixos.wiki/wiki/index.php?oldid=7605&rc_id=7898

cc @makefu for testing

Things done

Mic92 · 2022-05-30T07:12:59Z

nixos/modules/services/misc/jellyfin.nix

+        DeviceAllow = [
+          "/dev/dri/*"
+        ];
+        SupplementaryGroups = [ "video" ];


The wiki also suggests render. However I don't think nixos has such a group.

On my system, /dev/dri/render* devices belongs to the render group (and /dev/dri/card* to the video group), so I think it is needed.

Same

$ ls /dev/dri/render* -l crw-rw-rw- 1 root render 226, 128 May 28 22:38 /dev/dri/renderD128

Mic92 · 2022-05-30T07:15:25Z

nixos/modules/services/misc/jellyfin.nix

@@ -64,14 +64,16 @@ in
        AmbientCapabilities = "";
        CapabilityBoundingSet = "";

-        # ProtectClock= adds DeviceAllow=char-rtc r


Not so sure what to do with this one? Do I still need to pass an empty DeviceAllow before I make additions?

I guess its not relevant anymore because we are already dropped ProtectClock before that.

I would personally replace this line with ProtectClock = true, now. I think I remember putting that comment here because there was a conflict between ProtectClock = true and DeviceAllow = "" / PrivateDevices = true, but it shouldn't bother us anymore. In any case, I don't see a usecase for jellyfin to modify the hardware / system clock.

It cannot do this anyway because the system call filter below blocks such system calls. I don't think an unprivileged user could do this anyway and setuid is not allowed either.

Artturin · 2022-05-30T08:07:17Z

@peperunas

makefu · 2022-05-30T22:16:44Z

The "render" group came from the jellyfin documentation, just added it ( https://jellyfin.org/docs/general/administration/hardware-acceleration.html )

I thought about adding a flag for enabling access to /dev/dri, however i am unsure if it would really provide some security benefits in contrast to the complexity of users trying to find out why hardware transcode does not work.

minijackson · 2022-05-31T06:51:12Z

nixos/modules/services/misc/jellyfin.nix

+          "/dev/dri/*"
+        ];
+        SupplementaryGroups = [ "video" ];
+        PrivateDevices = false;


Is there a reason to explicitly set it to false here? I'm not aware of an option set here that sets PrivateDevices = true.

The main reason was that when keeping it set to true still does not work for me ... i have not investigated further

as a note we should probably keep the comment original

Disabled to allow Jellyfin to access hw accel devices endpoints

I think my wording was a bit ambiguous: I don't mind having PrivateDevices set to false, but since it should be the default behavior, why not remove this line entirely?

minijackson · 2022-05-31T07:04:49Z

I haven't tested this yet, but in principle I'm all for it. One thing to note is from the systemd.resource-control(5) man page, under the DeviceAllow= section:

The device group is matched according to filename globbing rules, you may hence use the "*" and "?" wildcards. (Note that such globbing wildcards are not available for device node path specifications!)

From what I understand, this would mean that DeviceAllow = [ "/dev/dri/*" ]; isn't understood by systemd? We might need to put DeviceAllow = [ "char-drm rw" ]; instead.

makefu · 2022-05-31T12:25:19Z

@minijackson i will test your proposal

06kellyjac · 2022-05-31T12:42:04Z

see also:

#108224 (comment)

makefu · 2022-05-31T14:27:30Z

I checked the different parameters, however i have not managed to get jellyfin to transcode without setting privateDevices=false

Upstream also essentially gave up: jellyfin/jellyfin@dd8b9e9#diff-3d806a09406ac27e205da315a5f9ad987eec663f657b3dda296b4712c8a73d73R27

according to #163491 (comment) adding nvidia-specific whitelisting works, however i cannot get it running for vaapi with my intel card.

Error:

[AVHWDeviceContext @ 0x1d119c0] No VA display found for device /dev/dri/renderD128.
Device creation failed: -22.
Failed to set value '/dev/dri/renderD128' for option 'vaapi_device': Invalid argument
Error parsing global options: Invalid argument

adding "render" supplementaryGroup is mandatory for transcoding to work

Artturin · 2022-05-31T15:22:51Z

we should use upstream settings unless we need to do something nixos specific
https://github.com/jellyfin/jellyfin/blob/master/debian/jellyfin.service

Mic92 · 2022-06-18T15:09:50Z

we should use upstream settings unless we need to do something nixos specific https://github.com/jellyfin/jellyfin/blob/master/debian/jellyfin.service

I synced this up now with upstream.

Mic92 · 2022-06-18T15:10:55Z

nixos/modules/services/misc/jellyfin.nix

        StateDirectory = "jellyfin";
        StateDirectoryMode = "0700";
        CacheDirectory = "jellyfin";
        CacheDirectoryMode = "0700";
        UMask = "0077";


Those are the only settings we add. Everything else should be pretty much the same as upstream.

minijackson · 2022-07-03T17:38:30Z

nixos/modules/services/misc/jellyfin.nix

@@ -49,56 +49,61 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

+      # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/debian/jellyfin.service


Did you mean https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service (fedora instead of debian)? I got confused because following the link I saw no hardening

Looks like they dropped stuff again from debian.

minijackson · 2022-07-03T17:39:47Z

@ofborg test jellyfin

nixos/modules/services/misc/jellyfin.nix

minijackson

Thanks a lot!

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels May 30, 2022

Mic92 commented May 30, 2022

View reviewed changes

ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 1-10 labels May 30, 2022

Artturin requested a review from minijackson May 30, 2022 08:04

minijackson reviewed May 31, 2022

View reviewed changes

Mic92 force-pushed the jellyfin branch from 63c91bb to 69875ec Compare June 18, 2022 15:07

nixos/jellyfin: sync up with hardening provided in upstream

4258952

Mic92 force-pushed the jellyfin branch from 69875ec to 4258952 Compare June 18, 2022 15:09

Mic92 commented Jun 18, 2022

View reviewed changes

Artturin requested review from 06kellyjac, minijackson and makefu July 1, 2022 18:43

minijackson reviewed Jul 3, 2022

View reviewed changes

Mic92 commented Jul 4, 2022

View reviewed changes

nixos/modules/services/misc/jellyfin.nix Outdated Show resolved Hide resolved

Update nixos/modules/services/misc/jellyfin.nix

d09303b

minijackson approved these changes Jul 4, 2022

View reviewed changes

bobby285271 added the 12.approvals: 1 This PR was reviewed and approved by one reputable person label Jul 4, 2022

Mic92 merged commit 9a020f3 into NixOS:master Jul 18, 2022

Mic92 deleted the jellyfin branch July 18, 2022 11:52

minijackson mentioned this pull request Jul 23, 2022

nixos/jellyfin: fix hardware acceleration #108224

Closed

10 tasks

nialov mentioned this pull request Dec 4, 2024

jellyfin: NVENC ffmpeg fails when called by jellyfin but works as user #141298

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nixos/jellyfin: better defaults for hardware acceleration #175439

nixos/jellyfin: better defaults for hardware acceleration #175439

Mic92 commented May 30, 2022

Mic92 May 30, 2022

minijackson May 31, 2022

06kellyjac May 31, 2022

Mic92 May 30, 2022

Mic92 May 30, 2022

minijackson May 31, 2022

Mic92 Jun 18, 2022 •

edited

Loading

Artturin commented May 30, 2022

makefu commented May 30, 2022

minijackson May 31, 2022

makefu May 31, 2022

06kellyjac May 31, 2022

minijackson May 31, 2022

minijackson commented May 31, 2022

makefu commented May 31, 2022

06kellyjac commented May 31, 2022

makefu commented May 31, 2022

Artturin commented May 31, 2022

Mic92 commented Jun 18, 2022 •

edited

Loading

Mic92 Jun 18, 2022

minijackson Jul 3, 2022

Mic92 Jul 4, 2022

minijackson commented Jul 3, 2022

minijackson left a comment

nixos/jellyfin: better defaults for hardware acceleration #175439

nixos/jellyfin: better defaults for hardware acceleration #175439

Conversation

Mic92 commented May 30, 2022

Description of changes

Things done

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mic92 Jun 18, 2022 • edited Loading

Choose a reason for hiding this comment

Artturin commented May 30, 2022

makefu commented May 30, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

minijackson commented May 31, 2022

makefu commented May 31, 2022

06kellyjac commented May 31, 2022

makefu commented May 31, 2022

Artturin commented May 31, 2022

Mic92 commented Jun 18, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

minijackson commented Jul 3, 2022

minijackson left a comment

Choose a reason for hiding this comment

Mic92 Jun 18, 2022 •

edited

Loading

Mic92 commented Jun 18, 2022 •

edited

Loading