Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I just finished the first version of a Linux kernel module I've written in C. The module creates a device file (/dev/wn0) that controls a USB device with three LED lights. For example, running as root, I can do this:

echo "#ff0000" >/dev/wn0

...and the device will glow bright red.

My problem is that I want unprivileged users to be able to access the device (by writing data to /dev/wn0). Is there a standard way to do this? Is it as simple as changing the permissions on the /dev/wn0 file? Does that create security concerns?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Ok, I see some possibilities:

  • The quickest way, the whole point of POSIX permissions and ownership: you want someone to be able to read and/or write, you set the permissions accordingly. Just put these people in a group and change the device ownership to that group, giving the group write permissions. You may have to put this in udev rules, if your /dev is managed by udev. This is what some tools do, for example bluez does it to enable users to use bluetooth, or at least that's the method used in my distro unless I try to use "ConsoleKit".

  • If the device is simple and there's no problem in having it used to everyone, just allow everyone to write on it.

  • Write a daemon that starts as some user that can write on the device, grabs the device and drops its privileges by changing its UID and then processes requests from any user through, for example, TCP.

  • Write a small binary to write for the device, that is setuid some user that can write on the device and have users use it to write to the device. That's what mount does, it is setuid root, so that regular users can mount filesystems if /etc/fstab allows them to do so.

It does not create any additional security concerns, as far as you're ok with these users being able to use that device. Of course that anyone with access to the device may exploit any vulnerability in the module, but that would be possible no matter how you give people access to it. If you write a daemon, that can be exploited. Maybe it is better keep things simple and make sure your code is not vulnerable.

I'd say there is no single standard way to do this — there are some ways parts of UNIX systems do this, and each part does it in the most convenient way for the kind of problem being solved.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.