mirror of
https://github.com/games-on-whales/wolf.git
synced 2026-10-15 21:12:08 +00:00
[GH-ISSUE #193] Virtual Devices Created by Wolf breaking Isolation on Host System #127
Labels
No labels
🧠 1 - 🤖 999
AMD
bug
bug
cannot reproduce
documentation
duplicate
easy
enhancement
enhancement
enhancement
fixed?
fixed?
good first issue
hard
help wanted
Intel
invalid
LXC
medium
moonlight-protocol
Multi GPU
nixos
not a bug
nvidia
pull-request
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
games-on-whales/wolf#127
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @FtK259 on GitHub (Apr 7, 2025).
Original GitHub issue: https://github.com/games-on-whales/wolf/issues/193
Hi,
I recently noticed that the virtual devices generated by Wolf were affecting my host Linux system, breaking the expected isolation. Here is the info about the virtual joypad generated:
I did add my user to group input, as the documentation ask for. Here is my /etc/udev/rules.d/85-wolf-virtual-inputs.rules file:
This breaks the input sandboxing and leads to unintended behavior. Is this a known issue? Is there something misconfigured on my setup?
Any guidance would be appreciated.
@ABeltramo commented on GitHub (Apr 8, 2025):
Thanks for opening this, the docs are outdated on this front and I forgot to update them.
There should be no need anymore to add the user to the input group and we could try having a better isolation by changing the default group for those devices from
inputtorootin the udev rules.I'll have a play with a new set of rules on my system when I have a bit of free time and report back, it would be nice if you could test them too!
@korotyshevnikita commented on GitHub (Apr 27, 2025):
Isolation of virtual devices is broken because the system changes the access control lists for controllers that use the same seat. Setting seat9 in udev rules fixes this (tested on Fedora Silverblue).
SUBSYSTEMS=="input", ATTRS{name}=="Wolf X-Box One (virtual) pad", MODE="0660", GROUP="input"
SUBSYSTEMS=="input", ATTRS{name}=="Wolf X-Box One (virtual) pad", MODE="0660", ENV{ID_SEAT}="seat9"
@ABeltramo commented on GitHub (Apr 27, 2025):
I'll have to test this myself, in theory changing the seat wouldn't change anything for non mouse/keyboard devices. So in this case I think you are just not assigning the
inputgroup and which result in justrootbeing able to access it.The problem is that if you have Steam installed on the host, it'll generally bundle up these additional rules: https://github.com/ValveSoftware/steam-devices/blob/master/60-steam-input.rules in order to access normal devices.
With those rules our devices will be user accessible, so we'll have to override that somehow; can we even
-=uaccess? I have to look further into this..@korotyshevnikita commented on GitHub (Apr 27, 2025):
If the seat in the desktop session matches the input device, the system will assign extended permissions to the individual user. Even if the owner and group are root, user will have separate 'rw-' access
@MertsA commented on GitHub (Jun 6, 2025):
That's not how uaccess actually works. Here's the relevant udev builtin that sets the ACL for the currently logged in user.
github.com/systemd/systemd@02927af799/src/udev/udev-builtin-uaccess.c (L108)If you don't change the seat in udev then the device is going to get assigned to seat0. For any device with the uaccess tag udev will look up the uid for the active session on the corresponding seat and grant that user access to the device. You don't need to remove uaccess or change the group to input, just make sure all Wolf created devices get tagged for a non-existent seat and udev will not find a session for them.
@ABeltramo commented on GitHub (Jun 8, 2025):
That makes sense, and thanks for pointing it out I wasn't aware. It should be easy to test then, we could just change the udev rule and everything should work oob, right?
@UlrichFrancomme commented on GitHub (Oct 3, 2025):
Hi, I had a similar issue while streaming games to another device. As soon as I start Steam in Moonlight, my host (Fedora) starts receiving command from the controller, so I could not play on the host at the same time or even some software like Darktable.
Setting the group of the joypad to root fixed the issue.
Thank you @ABeltramo for the solution, and for this tool! 😄
@MertsA commented on GitHub (Oct 16, 2025):
I just went ahead and cheated a bit and set everything under uhid to a different seat by default. Might not be the best approach for wolf but with just the rules matching off the ATTRS{name} it didn't apply to the hidraw device or the leds.
# Move anything under uhid off of seat0 KERNELS=="uhid", SUBSYSTEM=="hid", TAG+="seat", ENV{ID_SEAT}="seat9"For whatever reason the ATTRS{name} wasn't set for the hid device itself. Depending on how the virtual MAC addresses are enumerated there might be a better solution there.
@ABeltramo commented on GitHub (Dec 4, 2025):
I'm updating the documentation and putting together all the things that have been reported here I've ended up with the following:
Can anybody else test this out to make sure it works as intended?
@JoelD333 commented on GitHub (Jan 17, 2026):
Hi guys, I just finished installing everything (fantastic job, thank you very much), but I was running into this issue.
The input from the Docker container was leaking into my host system.
I tried this last set of rules, but it didn’t work:
So I tested what @UlrichFrancomme suggested, and that did the trick.
I’m not sure if it’s the most correct approach, but it works.
@clsty commented on GitHub (Mar 20, 2026):
According to my test the following works:
/etc/udev/rules.d/85-wolf-virtual-inputs.ruleswith following contents:@ABeltramo commented on GitHub (Mar 27, 2026):
Reopening this to remember that I should update the docs again with the latest suggestions 😅