I am using libusb to connect a peripheral, and want to allow non root user access. I am not even sure how this should work, or how it should not to be honest, but apparently I can modify or add a file to /lib/udev/rules.d that allows access groups to be used.

Looking firstly for a quick fix, and secondly for someplace that explains devices and the rules system so I can afterwards come back and educate myself. A few questions that did not completely answer it for me.

1 Answer 1


First, run lsusb, then plug in your USB peripheral and run lsusb again. Compare the two listings: the second listing should have at least one extra line that describes your peripheral.

Once you've identified the correct line, make a note of the ID xxxx:yyyy numbers on that line. These are the vendor ID and product ID for the device.

But first, some principles about udev rule files:

You can add any udev rule files you want to /etc/udev/rules.d: the only name requirement is that the filename should have a .rules suffix.

The files in /lib/udev/rules.d are reserved for the pre-packaged rules of your Linux distribution: any changes you make to any existing files in there will be overwritten when a new patch affecting the udev rules is installed to the system.

If you need to modify the existing rules, you should instead copy the rule file you wish to modify from /lib/udev/rules.d to /etc/udev/rules.d, keeping the original name of the file. Any files in /etc/udev/rules.d will override files with identical names in /lib/udev/rules.d. Once you've made the copy, you can modify the copy in /etc/udev/rules.d as you wish, secure in the knowledge that your changes won't be overwritten at some future point when some security updates are installed.

The rule files in both directories are read (after taking into account the overrides) in a simple alphanumeric order, and if there are conflicting rules, then the last one wins. There is a convention that the rule file name should be something like NN-descriptive-name.rules, where NN identifies the place of this file in the overall ordering of the rules.

Then to the actual task of writing the rule.

If the ID for your device in the lsusb listing was xxxx:yyyy, then the part of the udev rule that specifies the device would be:

SUBSYSTEM=="usb", ATTRS{idVendor}=="xxxx", ATTRS{idProduct}=="yyyy"

Note the doubled equals signs. The convention is similar to C, Java and certain other programming languages: a doubled equals sign means testing for equality, a single equals sign means setting something to a particular value.

In most modern versions of Linux, you can use TAG+="uaccess" at the end of your rule line to specify that a particular device should be accessible by whoever is currently logged in to the system locally.

If you need only some users to be able to access the device, create a group (sudo groupadd mydevice), add the users to the group (usermod -a -G mydevice username) and make the device accessible by that group only with GROUP="mydevice", MODE="0660" at the end of your rule line. Then people added to the group can e.g. use ssh to connect to the system remotely and still use the device; people that are not members of the group won't able to use the device at all.

Note: new group memberships will take effect at your next login, so if you add yourself to the new group, you'll need to logout and log back in before testing the device.

If you want to allow everyone on the system to access the device, you can just specify MODE="0666" at the end of your rule line. (You should think twice before doing this.)

Putting it all together

So, if you don't have a particular need to modify any existing rule file, you can just create your own, e.g. /etc/udev/rules.d/99-mydevice.rules.

sudo <your-favorite-text-editor> /etc/udev/rules.d/99-mydevice.rules

If you want to just allow the locally logged-in user to use the device, the contents of the file should be like this:

SUBSYSTEM=="usb", ATTRS{idVendor}=="xxxx", ATTRS{idProduct}=="yyyy", TAG+="uaccess"

After you've saved the rule file, run this command to make your new rule take effect immediately:

udevadm control --reload-rules

If you instead used the group-based solution, logout and log back in at this point.

  • I am unable to upvote your answer, but this looks like exactly what I was after. I am actually running a VM because the winUSB driver is pants, but on linux it is not flakey, just had this one permissions issue, which you have now answered and has gotten me all working. Yeah I had to login again, I rebooted beacuse I am still learning, and viola setting took effect. Thanks @telcoM
    – Conrad B
    Sep 29, 2018 at 20:48
  • You can mark an answer as an accepted solution, though. It's even a bit better than an upvote.
    – telcoM
    Oct 1, 2018 at 16:06
  • thanks Mark, clearly I have not asked enough questions lately to remember I have to punch the tick mark! Yay.
    – Conrad B
    Oct 3, 2018 at 10:33

Not the answer you're looking for? Browse other questions tagged .