2

I want to access special USB device (not a simple flash drive) from inside container. I bind /dev/bus/usb inside container, lsusb lists USBs effortlessly:

$ lsusb
...
Bus 002 Device 002: ID 0a89:0009 
...

but my program can't interact with this device.

7

systemd-nspawn handles permissions for devices through cgroups. By default any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to any device passed directly to --bind argument like --bind=/dev/vcs. This won't work with USB because /dev/bus/usb is a directory.

To grant permission for currently running container named my_container (supposedly you started it with systemd-nspawn directly from command line) execute as root:

$ echo 'c 189:* rwm' > \
 /sys/fs/cgroup/devices/machine.slice/machine-my_container/devices.allow

c 189:* rwm means read write modify permissions for any character device with type (identificator) 189 and any subtype. You can find type and subtype of device with file:

$ file /dev/bus/usb/002/002

This permission will only last while container is running.

If you are using systemd-nspawn@.service or want to persist permissions with it, create

/etc/systemd/system/systemd-nspawn@.service.d/override.conf

or

/etc/systemd/system/systemd-nspawn@my_container.service.d/override.conf

(depending whether you want access to USB from any systemd-nspawn container or only from my_container correspondingly) with the following content:

[Service]
DeviceAllow=char-usb_device rwm 

usb_device is an alias. You can find other in /proc/devices.

  • Just to add, you still need to add the file/directory to the systemd-nspawn command in a --bind argument. – saiarcot895 Dec 26 '17 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.