1

How can I create a new user group that will grant the group members access to USB devices connected to the system?

a.) to all connected USB devices?
b.) only to USB devices with VID=0x1234?
c.) only to USB devices with VID=0x1234 and PID=0xABCD?

The OS version is: Raspbian GNU/Linux 10 (buster)

I have a C++ program that connects to an USB acceleration sensor. The program uses libusb and can communicate with the sensor when started with sudo ./myprogram. Without sudo the program has permission problems.

mTThomas
  • 13
  • 1
  • 3
  • You do not normally get permission to everything (unless you are root) which "owns" /dev although you can set suid on code. Services get permissions - see https://raspberrypi.stackexchange.com/a/75681/8697 – Milliways May 29 '21 at 01:08

1 Answers1

2

you can use udev rules to set things like file mode bits and user/group for the devices - so for point c) in your question it's fairly simple - maybe point b) as well, but not point a)

e.g. create file /etc/udev/rules.d/mydevices.rules with the content

SUBSYSTEMS=="usb", ATTRS{idVendor}=="1234", ATTRS{idProduct}=="abcd", MODE="0660", GROUP="mygroup"

Create group mygroup (-r makes it a "system" group)

groupadd -r mygroup

Then add mygroup group to any user that would require access to that device

usermod -a -G mygroup someuser

I'm not sure if you omit ATTRS{idProduct}=="abcd" if it would apply to all products from vendor 1234 - but, you probably don't want that anyway

By the way, there's a group called plugdev which is standard in all my pi's and user pi is a member of it - I mention this because when adding SDR support, the install creates a udev rules file with rules such as

SUBSYSTEMS=="usb", ATTRS{idVendor}=="1f4d", ATTRS{idProduct}=="a803", ENV{ID_SOFTWARE_RADIO}="1", MODE="0660", GROUP="plugdev"
Jaromanda X
  • 2,415
  • 1
  • 13
  • 14
  • I am building my own USB devices based on the Atmega32u4 processor that has built in USB capabilities. All of my devices use the same VID but different PID-s. So in my case it makes sense to allow access to all devices with the same VID using one rule. – mTThomas May 29 '21 at 16:37
  • I tried your solution and it works better than you expected. Even version a.) works:

    a.) SUBSYSTEMS=="USB", MODE="0660", GROUP="usb"

     – mTThomas May 29 '21 at 16:37
  • well, yeah, I suspected that would happen @mTThomas - but not sure of the side effects! For example, my pi boots from USB :p not sure what udev rules that mess with mode/group would do :p – Jaromanda X May 29 '21 at 16:41