SteamVR setup fails when trying to set capabilities on the steamvr-launcher binary

[PureTryOut]

Flatpak info
Flatpak 1.12.7

Problem description
When setting up SteamVR, the process tries to set capabilities on the steamvr-launcher binary but fails to do so because it requires sudo/root for that. This can be worked around from the host system:

sudo setcap CAP_SYS_NICE+ep ~/.var/app/com.valvesoftware.Steam/data/Steam/steamapps/common/SteamVR/bin/linux64/vrcompositor-launcher

However it would of course be great to be able to have this working out-of-the-box.

After the workaround SteamVR seems to work great (as far as can work "great" on Linux that is, no audio and annoying bugs like ValveSoftware/SteamVR-for-Linux#334 that make the experience anything but perfect, but these are SteamVR on Linux problems, not Flatpak related) and I can launch and play at least Beat Saber through Proton.

This issue is split off #636.

Does this issue reproduce with native Steam
No, as SteamVR can just use sudo there.

[nanonyme]

Most likely flatpak sandbox prevents this.

[HadetTheUndying]

Most likely flatpak sandbox prevents this.

I think this is probably going to require some collaboration between Valve and several upstream projects like Wayland, Gnome and KDE for the XDG permissions etc. I don't foresee it getting solved quickly since it already feels like Valve has abandoned SteamVR for linux given the long standing issues we already have.

[Atemu]

We're facing the same issue in our packaging in Nix: NixOS/nixpkgs#42117

If you find a solution, let us know.

You might be able to hack something up using flatpak's HostCommand though: https://github.com/flatpak/flatpak/blob/a0505f52d993837ce7ce96801f54eb37d55dadfb/data/org.freedesktop.Flatpak.xml#L109

[Scrumplex]

Related issue NixOS/nixpkgs#217119

Even if you set the capability on the binary manually, SteamVR can not utilize it, as it's running inside an unprivileged namespace created by bwrap, where these capabilities are dropped.

Not sure if it's possible to fix this while still using bwrap 🤔.

[nanonyme]

Using nice from inside flatpak requires portal like with gamemode. I wonder if it would be enough in this case though renice operation to fail silently rather than error out.

[Scrumplex]

In this case, it is not about using nice, but rather about having the capability CAP_SYS_NICE. SteamVR needs the capability to acquire a high priority queue for asynchronous reprojection.

Check kernel source code here:
https://github.com/torvalds/linux/blob/925cf0457d7e62ce08878ffb789189ac08ca8677/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c#L94-L111 (notably the check capable(CAP_SYS_NICE))