I have device file that appears in /dev when a specific board is plugged in. The read and write operations to it work just fine, but in order to open the device file the program needs to be executed with root priveledges. Is there any way I can all a non-root user to open this one specific device file without having to use sudo?


Yes, you may write an udev rule.

In /etc/udev/rules.d make a file 30-mydevice.rules (number has to be from 0 to 99 and decides only about the script running order; name doesn't really matter, it has just to be descriptive; .rules extension is required, though)

In this example I'm assuming your device is USB based and you know it's vendor and product id (can be checked using lsusb -v), and you're using mydevice group your user has to be in to use the device. This should be file contents in that case:

SUBSYSTEM=="usb", SYSFS{idVendor}=="0123", SYSFS{idProduct}=="4567", ACTION=="add", GROUP="mydevice", MODE="0664"

MODE equal to 0664 allows device to be written to by it's owner (probably root) and the defined group.

  • What is the role of the number in the rules file name? I mean that 30 in the file name? – Saeid Yazdani Sep 25 '16 at 8:10
  • These configuration files are loaded alphabetically. By prefixing the actual file names with numbers, you can define the order in which they are loaded. – paolo Apr 5 '17 at 7:10

One way is to add the user to the corresponding "devivce-group". There are a whole range of groups for various sorts of devices (disk, floppy, tty, video, cdrom, ...) under Linux, so you can add the user to the corresponding group in /etc/group.

Another way is to make a "pseudo-user" (eg. the games-user). You add this user to the device-groups it should have. Finally you change the owner of certain programs (like a program for scanning images) to this user, and set "chmod u+s" . This will cause the program to be run as the pseudo-user - not the real user, thus having access to the devices. You can use the group of the programs to limit which user may execute the program.

Finally, you can set the group of programs needing a specific device to the device-group and set "chmod g+s". This will cause the program to run with the rights of the group (in addition to the right of the normal user running it), thus allowing extended access to the device.


Yes, you can, but you need root permission at first. Since linux 2.2, it has Capabilities, use it split root permissions. With under the list, you can use:

setcap cap_net_raw,cap_net_admin=eip xxxx

xxxx is any executable program, you can call libpcap with yourself.

Capabilities list The following list shows the capabilities implemented on Linux, and the operations or behaviors that each capability permits:

   CAP_AUDIT_CONTROL (since Linux 2.6.11)
          Enable and disable kernel auditing; change auditing filter
          rules; retrieve auditing status and filtering rules.

   CAP_AUDIT_READ (since Linux 3.16)
          Allow reading the audit log via a multicast netlink socket.

   CAP_AUDIT_WRITE (since Linux 2.6.11)
          Write records to kernel auditing log.

   CAP_BLOCK_SUSPEND (since Linux 3.5)
          Employ features that can block system suspend (epoll(7)
          EPOLLWAKEUP, /proc/sys/wake_lock).

          Make arbitrary changes to file UIDs and GIDs (see chown(2)).

          Bypass file read, write, and execute permission checks.  (DAC
          is an abbreviation of "discretionary access control".)

          * Bypass file read permission checks and directory read and
            execute permission checks;
          * invoke open_by_handle_at(2);
          * use the linkat(2) AT_EMPTY_PATH flag to create a link to a
            file referred to by a file descriptor.

          * Bypass permission checks on operations that normally require
            the filesystem UID of the process to match the UID of the
            file (e.g., chmod(2), utime(2)), excluding those operations
            covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH;
          * set inode flags (see ioctl_iflags(2)) on arbitrary files;
          * set Access Control Lists (ACLs) on arbitrary files;
          * ignore directory sticky bit on file deletion;
          * specify O_NOATIME for arbitrary files in open(2) and

          * Don't clear set-user-ID and set-group-ID mode bits when a
            file is modified;
          * set the set-group-ID bit for a file whose GID does not match
            the filesystem or any of the supplementary GIDs of the
            calling process.

          Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).

          Bypass permission checks for operations on System V IPC

          Bypass permission checks for sending signals (see kill(2)).
          This includes use of the ioctl(2) KDSIGACCEPT operation.

   CAP_LEASE (since Linux 2.4)
          Establish leases on arbitrary files (see fcntl(2)).

          Set the FS_APPEND_FL and FS_IMMUTABLE_FL inode flags (see

   CAP_MAC_ADMIN (since Linux 2.6.25)
          Allow MAC configuration or state changes.  Implemented for the
          Smack Linux Security Module (LSM).

   CAP_MAC_OVERRIDE (since Linux 2.6.25)
          Override Mandatory Access Control (MAC).  Implemented for the
          Smack LSM.

   CAP_MKNOD (since Linux 2.4)
          Create special files using mknod(2).

          Perform various network-related operations:
          * interface configuration;
          * administration of IP firewall, masquerading, and accounting;
          * modify routing tables;
          * bind to any address for transparent proxying;
          * set type-of-service (TOS)
          * clear driver statistics;
          * set promiscuous mode;
          * enabling multicasting;
          * use setsockopt(2) to set the following socket options:
            SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the
            range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

          Bind a socket to Internet domain privileged ports (port
          numbers less than 1024).

          (Unused)  Make socket broadcasts, and listen to multicasts.

          * Use RAW and PACKET sockets;
          * bind to any address for transparent proxying.

          * Make arbitrary manipulations of process GIDs and
            supplementary GID list;
          * forge GID when passing socket credentials via UNIX domain
          * write a group ID mapping in a user namespace (see

   CAP_SETFCAP (since Linux 2.6.24)
          Set file capabilities.

          If file capabilities are not supported: grant or remove any
          capability in the caller's permitted capability set to or from
          any other process.  (This property of CAP_SETPCAP is not
          available when the kernel is configured to support file
          capabilities, since CAP_SETPCAP has entirely different
          semantics for such kernels.)

          If file capabilities are supported: add any capability from
          the calling thread's bounding set to its inheritable set; drop
          capabilities from the bounding set (via prctl(2)
          PR_CAPBSET_DROP); make changes to the securebits flags.

          * Make arbitrary manipulations of process UIDs (setuid(2),
            setreuid(2), setresuid(2), setfsuid(2));
          * forge UID when passing socket credentials via UNIX domain
          * write a user ID mapping in a user namespace (see

          Note: this capability is overloaded; see Notes to kernel
          developers, below.

          * Perform a range of system administration operations
            including: quotactl(2), mount(2), umount(2), swapon(2),
          * perform privileged syslog(2) operations (since Linux 2.6.37,
            CAP_SYSLOG should be used to permit such operations);
          * perform VM86_REQUEST_IRQ vm86(2) command;
          * perform IPC_SET and IPC_RMID operations on arbitrary System
            V IPC objects;
          * override RLIMIT_NPROC resource limit;
          * perform operations on trusted and security Extended
            Attributes (see xattr(7));
          * use lookup_dcookie(2);
          * use ioprio_set(2) to assign IOPRIO_CLASS_RT and (before
            Linux 2.6.25) IOPRIO_CLASS_IDLE I/O scheduling classes;
          * forge PID when passing socket credentials via UNIX domain
          * exceed /proc/sys/fs/file-max, the system-wide limit on the
            number of open files, in system calls that open files (e.g.,
            accept(2), execve(2), open(2), pipe(2));
          * employ CLONE_* flags that create new namespaces with
            clone(2) and unshare(2) (but, since Linux 3.8, creating user
            namespaces does not require any capability);
          * call perf_event_open(2);
          * access privileged perf event information;
          * call setns(2) (requires CAP_SYS_ADMIN in the target
          * call fanotify_init(2);
          * call bpf(2);
          * perform privileged KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2)
          * use ptrace(2) PTRACE_SECCOMP_GET_FILTER to dump a tracees
            seccomp filters;
          * perform madvise(2) MADV_HWPOISON operation;
          * employ the TIOCSTI ioctl(2) to insert characters into the
            input queue of a terminal other than the caller's
            controlling terminal;
          * employ the obsolete nfsservctl(2) system call;
          * employ the obsolete bdflush(2) system call;
          * perform various privileged block-device ioctl(2) operations;
          * perform various privileged filesystem ioctl(2) operations;
          * perform privileged ioctl(2) operations on the /dev/random
            device (see random(4));
          * install a seccomp(2) filter without first having to set the
            no_new_privs thread attribute;
          * modify allow/deny rules for device control groups;
          * employ the ptrace(2) PTRACE_SECCOMP_GET_FILTER operation to
            dump tracee's seccomp filters;
          * employ the ptrace(2) PTRACE_SETOPTIONS operation to suspend
            the tracee's seccomp protections (i.e., the
            PTRACE_O_SUSPEND_SECCOMP flag).
          * perform administrative operations on many device drivers.

          Use reboot(2) and kexec_load(2).

          Use chroot(2).

          * Load and unload kernel modules (see init_module(2) and
          * in kernels before 2.6.25: drop capabilities from the system-
            wide capability bounding set.

          * Raise process nice value (nice(2), setpriority(2)) and
            change the nice value for arbitrary processes;
          * set real-time scheduling policies for calling process, and
            set scheduling policies and priorities for arbitrary
            processes (sched_setscheduler(2), sched_setparam(2),
          * set CPU affinity for arbitrary processes
          * set I/O scheduling class and priority for arbitrary
            processes (ioprio_set(2));
          * apply migrate_pages(2) to arbitrary processes and allow
            processes to be migrated to arbitrary nodes;
          * apply move_pages(2) to arbitrary processes;
          * use the MPOL_MF_MOVE_ALL flag with mbind(2) and

          Use acct(2).

          * Trace arbitrary processes using ptrace(2);
          * apply get_robust_list(2) to arbitrary processes;
          * transfer data to or from the memory of arbitrary processes
            using process_vm_writev(2);
          * inspect processes using kcmp(2).

          * Perform I/O port operations (iopl(2) and ioperm(2));
          * access /proc/kcore;
          * employ the FIBMAP ioctl(2) operation;
          * open devices for accessing x86 model-specific registers
            (MSRs, see msr(4));
          * update /proc/sys/vm/mmap_min_addr;
          * create memory mappings at addresses below the value
            specified by /proc/sys/vm/mmap_min_addr;
          * map files in /proc/bus/pci;
          * open /dev/mem and /dev/kmem;
          * perform various SCSI device commands;
          * perform certain operations on hpsa(4) and cciss(4) devices;
          * perform a range of device-specific operations on other

          * Use reserved space on ext2 filesystems;
          * make ioctl(2) calls controlling ext3 journaling;
          * override disk quota limits;
          * increase resource limits (see setrlimit(2));
          * override RLIMIT_NPROC resource limit;
          * override maximum number of consoles on console allocation;
          * override maximum number of keymaps;
          * allow more than 64hz interrupts from the real-time clock;
          * raise msg_qbytes limit for a System V message queue above
            the limit in /proc/sys/kernel/msgmnb (see msgop(2) and
          * allow the RLIMIT_NOFILE resource limit on the number of "in-
            flight" file descriptors to be bypassed when passing file
            descriptors to another process via a UNIX domain socket (see
          * override the /proc/sys/fs/pipe-size-max limit when setting
            the capacity of a pipe using the F_SETPIPE_SZ fcntl(2)
          * use F_SETPIPE_SZ to increase the capacity of a pipe above
            the limit specified by /proc/sys/fs/pipe-max-size;
          * override /proc/sys/fs/mqueue/queues_max limit when creating
            POSIX message queues (see mq_overview(7));
          * employ the prctl(2) PR_SET_MM operation;
          * set /proc/[pid]/oom_score_adj to a value lower than the
            value last set by a process with CAP_SYS_RESOURCE.

          Set system clock (settimeofday(2), stime(2), adjtimex(2)); set
          real-time (hardware) clock.

          Use vhangup(2); employ various privileged ioctl(2) operations
          on virtual terminals.

   CAP_SYSLOG (since Linux 2.6.37)
          * Perform privileged syslog(2) operations.  See syslog(2) for
            information on which operations require privilege.
          * View kernel addresses exposed via /proc and other interfaces
            when /proc/sys/kernel/kptr_restrict has the value 1.  (See
            the discussion of the kptr_restrict in proc(5).)

   CAP_WAKE_ALARM (since Linux 3.0)
          Trigger something that will wake up the system (set

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.