Symptom

Users following the kiosk tutorial reported X11 failing to start with: xf86OpenConsole: Cannot open virtual console 7 (Permission denied)

The kiosk service would not start, and journalctl -u kiosk showed the Xorg error immediately after chvt 7.

Root cause

On Raspberry Pi OS Lite, /dev/tty7 has permissions crw--w---- root:tty. The tty group receives write-only access. Xorg calls open("/dev/tty7", O_RDWR) and fails for the kiosk user even though that user is a member of the tty group.

The kiosk launcher runs as root before su - kiosk, so it can chown kiosk /dev/tty7 before switching virtual terminals. Without this step Xorg cannot open the device for read.

Fix

• server/package/usr/local/bin/krill_kiosk_install.sh (create_launcher() heredoc): added chown "$KIOSK_USER" /dev/tty7 immediately before chvt 7.
• docs/_posts/2026-04-14-raspberry-pi-kiosk-tutorial.md (Step 6 heredoc): same chown line added before chvt 7.
• Tutorial troubleshooting table: added a row documenting the symptom, cause, and fix.

The ownership is transient — systemd’s TTYReset=yes / TTYVHangup=yes / TTYVTDisallocate=yes on the service unit restores the device on exit.

Prevention

• When generating a launcher that calls chvt N, always verify that the target user has O_RDWR access to /dev/ttyN — group membership with write-only permissions is not enough.
• Scripts that call su - <user> as root for X11 startup should chown <user> /dev/ttyN before chvt N.
• Troubleshooting tables in kiosk/X11 tutorials should cover the xf86OpenConsole: Permission denied symptom explicitly.