Freitag, 25. Dezember 2009

Changing USB device permissions in Ubuntu Karmic

If you plug an USB device into a Linux box that uses a current distro, udev dynamically creates an entry in the /dev directory. You can list all currently available USB units with the lsusb command:

$ lsusb
Bus 002 Device 003: ID 03eb:6125 Atmel Corp. 
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

The only "real" device here is my XAiOX GPS logger (first entry). The output shows that it has the vendor id (hex) 03eb, the product id (hex) 6125.

The device file created by udev is: /dev/bus/usb/002/003
(Yes, these are the bus and device numbers shown in the lsusb output).

The default permissions are rather restrictive:

$ ls -l /dev/bus/usb/002
insgesamt 0
crw-rw-r-- 1 root root 189, 128 2009-12-23 22:14 001
crw-rw-r-- 1 root root 189, 128 2009-12-23 22:19 003

Only root can read and write to the USB device. Anybody else only has read access.

In order to retrieve the stored GPS info from my GPS logger (e.g. by using itrackutil), I have to instruct the device to send the data. In order to send this command I need the write privileges.

I could start itrackutil as root, but from a security standpoint that is not what I want.

This problem usually arises only, if the USB device is not (yet) managed by the system, because part of that managing process is... changing the permissions.

The solution I'm suggesting here works with Ubuntu Karmic.

The first step is to create a group named usbusers (or any other name), then make yourself member of that group and instruct udev to set the device group id to usbusers and set the permissions accordingly.

On the command line, creating a group and adding the user (e.g. mike) is quite simple:

sudo groupadd usbusers
sudo adduser mike usbusers

If you pefer the Gnome GUI, you find the appropriate program under "System - Administration - User and groups":

After unlocking the panel ("Click to make changes"), click onto "Manage Groups".

"Add Group".

Make enter "usbusers" as group name, make sure that the group id suggested by the system is not zero. It's usually in the 1000+ range, enable the "Group Members" and click "Ok".

As a last step you have to create a new udev rule:

SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", MODE="0664", GROUP="usbusers"

Save it under the following name: /etc/udev/rules.d/45-xaiox.rules

Then reboot.

Two remarks regarding the filename:
  • in order to be executed, the filename must end with .rules (all other files are ignored)
  • the 45 ensures that the file is executed before the corresponding "old" rule found in /lib/udev/rules.d/50-udev-default.rules
If you now plug-in your usb device, the permissions look like this:

$ ls -l /dev/bus/usb/002/total 0crw-rw-r-- 1 root usbusers 189, 128 2009-12-25 20:20 001crw-rw-r-- 1 root usbusers 189, 133 2009-12-25 22:22 006

And being a member of usbusers, you have read and write access.

1 Kommentar:

Tausen hat gesagt…

Thank you for this.

You can use lsusb to find the vendor- and product id of the device, in:
Bus 004 Device 008: ID 16c0:05dc VOTI shared ID for use with libusb
16c0 is the vendor id and 05dc is the product id.
You can then specify a rule that only applies to this device, such as:
ATTR{idVendor}=="16c0", ATTR{idProduct}=="05dc", MODE="0660", GROUP="plugdev"
This would assign the 16c0:05dc device the group plugdev and the permissions 660. Note that this syntax works in ubuntu 12, I think ubuntu 10 (and possibly earlier versions) might have used SYSFS{} instead of ATTR{} (though I'm not quite sure).