4

I'm currently on a systemd based Linux distribution and while reading documentation, I noticed that hid devicecs such as keyboards and mice are not tagged with "uaccess" in 70-uaccess.rules. Is there a reason not to do this? It makes sense to me that remote users should not be able to access these local devices.

My current understanding (from reading sparse documentation) is that any devices with the uaccess tag lets systemd (or pam?) know to give acl permissions for that device to locally logged in users. Is this correct? I couldn't find any documentation on what is actually responsible for setting the acl permissions, once the tag is set.

6

Input (hid) and display devices (dri device nodes) are handled differently.

Access is granted and revoked to open file descriptors, instead of the device node.

This allows switching back and forth between multiple GUI sessions, e.g. without letting the inactive one steal passwords entered in the active session.

https://dvdhrm.wordpress.com/2013/08/25/sane-session-switching/

Device node ACLs are not used for block devices either. Unprivileged users are only allowed to mount filesystems via udisks.

In both of these cases, you shouldn't be allowed to open the device node yourself. So I think that explains why uaccess is not used here.

I couldn't find any documentation on what is actually responsible for setting the acl permissions, once the tag is set.

That will be systemd-logind. pam_systemd hooks into the PAM stack, so it can send a dbus message to logind at login/logout time.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.