Como conceder acesso de usuário não raiz aos arquivos do dispositivo

Eu tenho um arquivo de dispositivo que aparece /devquando uma placa específica é conectada. As operações de leitura e gravação nele funcionam muito bem, mas para abrir o arquivo de dispositivo, o programa precisa ser executado com privilégios de root. Existe alguma maneira de todos os usuários não raiz abrirem um arquivo de dispositivo específico sem precisar usar o sudo?

Sim, você pode escrever uma regra do udev.

Em /etc/udev/rules.dcriar um arquivo 30-mydevice.rules(o número deve ser de 0 a 99 e decide apenas sobre a ordem de execução do script; o nome realmente não importa, apenas o descritivo; a .rulesextensão é necessária)

Neste exemplo, estou assumindo que seu dispositivo é baseado em USB e você sabe que é fornecedor e ID do produto (pode ser verificado usando lsusb -v), e você está usando o mydevicegrupo em que o usuário precisa estar para usar o dispositivo. Esse deve ser o conteúdo do arquivo nesse caso:

SUBSYSTEM=="usb", SYSFS{idVendor}=="0123", SYSFS{idProduct}=="4567", ACTION=="add", GROUP="mydevice", MODE="0664"

MODE igual a 0664 permite que o dispositivo seja gravado por seu proprietário (provavelmente raiz) e pelo grupo definido.

Uma maneira é adicionar o usuário ao "grupo de desvio" correspondente. Há toda uma gama de grupos para vários tipos de dispositivos (disco, disquete, tty, vídeo, cdrom, ...) no Linux, para que você possa adicionar o usuário ao grupo correspondente em / etc / group.

Outra maneira é criar um "pseudo-usuário" (por exemplo, o usuário dos jogos). Você adiciona esse usuário aos grupos de dispositivos que deveria ter. Finalmente, você altera o proprietário de certos programas (como um programa para digitalizar imagens) para esse usuário e define "chmod u + s". Isso fará com que o programa seja executado como pseudo-usuário - não como usuário real, tendo acesso aos dispositivos. Você pode usar o grupo de programas para limitar qual usuário pode executar o programa.

Por fim, você pode definir o grupo de programas que precisam de um dispositivo específico para o grupo de dispositivos e definir "chmod g + s". Isso fará com que o programa seja executado com os direitos do grupo (além do direito do usuário normal), permitindo assim o acesso estendido ao dispositivo.

Sim, você pode, mas primeiro precisa de permissão de root. Desde o linux 2.2, ele possui recursos, use permissões de root divididas. Com sob a lista, você pode usar:

setcap cap_net_raw,cap_net_admin=eip xxxx

xxxx é qualquer programa executável, você pode chamar a libpcap consigo mesmo.

Lista de recursos A lista a seguir mostra os recursos implementados no Linux e as operações ou comportamentos que cada recurso permite:

   CAP_AUDIT_CONTROL (since Linux 2.6.11)
          Enable and disable kernel auditing; change auditing filter
          rules; retrieve auditing status and filtering rules.

   CAP_AUDIT_READ (since Linux 3.16)
          Allow reading the audit log via a multicast netlink socket.

   CAP_AUDIT_WRITE (since Linux 2.6.11)
          Write records to kernel auditing log.

   CAP_BLOCK_SUSPEND (since Linux 3.5)
          Employ features that can block system suspend (epoll(7)
          EPOLLWAKEUP, /proc/sys/wake_lock).

   CAP_CHOWN
          Make arbitrary changes to file UIDs and GIDs (see chown(2)).

   CAP_DAC_OVERRIDE
          Bypass file read, write, and execute permission checks.  (DAC
          is an abbreviation of "discretionary access control".)

   CAP_DAC_READ_SEARCH
          * Bypass file read permission checks and directory read and
            execute permission checks;
          * invoke open_by_handle_at(2);
          * use the linkat(2) AT_EMPTY_PATH flag to create a link to a
            file referred to by a file descriptor.

   CAP_FOWNER
          * Bypass permission checks on operations that normally require
            the filesystem UID of the process to match the UID of the
            file (e.g., chmod(2), utime(2)), excluding those operations
            covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH;
          * set inode flags (see ioctl_iflags(2)) on arbitrary files;
          * set Access Control Lists (ACLs) on arbitrary files;
          * ignore directory sticky bit on file deletion;
          * specify O_NOATIME for arbitrary files in open(2) and
            fcntl(2).

   CAP_FSETID
          * Don't clear set-user-ID and set-group-ID mode bits when a
            file is modified;
          * set the set-group-ID bit for a file whose GID does not match
            the filesystem or any of the supplementary GIDs of the
            calling process.

   CAP_IPC_LOCK
          Lock memory (mlock(2), mlockall(2), mmap(2), shmctl(2)).

   CAP_IPC_OWNER
          Bypass permission checks for operations on System V IPC
          objects.

   CAP_KILL
          Bypass permission checks for sending signals (see kill(2)).
          This includes use of the ioctl(2) KDSIGACCEPT operation.

   CAP_LEASE (since Linux 2.4)
          Establish leases on arbitrary files (see fcntl(2)).

   CAP_LINUX_IMMUTABLE
          Set the FS_APPEND_FL and FS_IMMUTABLE_FL inode flags (see
          ioctl_iflags(2)).

   CAP_MAC_ADMIN (since Linux 2.6.25)
          Allow MAC configuration or state changes.  Implemented for the
          Smack Linux Security Module (LSM).

   CAP_MAC_OVERRIDE (since Linux 2.6.25)
          Override Mandatory Access Control (MAC).  Implemented for the
          Smack LSM.

   CAP_MKNOD (since Linux 2.4)
          Create special files using mknod(2).

   CAP_NET_ADMIN
          Perform various network-related operations:
          * interface configuration;
          * administration of IP firewall, masquerading, and accounting;
          * modify routing tables;
          * bind to any address for transparent proxying;
          * set type-of-service (TOS)
          * clear driver statistics;
          * set promiscuous mode;
          * enabling multicasting;
          * use setsockopt(2) to set the following socket options:
            SO_DEBUG, SO_MARK, SO_PRIORITY (for a priority outside the
            range 0 to 6), SO_RCVBUFFORCE, and SO_SNDBUFFORCE.

   CAP_NET_BIND_SERVICE
          Bind a socket to Internet domain privileged ports (port
          numbers less than 1024).

   CAP_NET_BROADCAST
          (Unused)  Make socket broadcasts, and listen to multicasts.

   CAP_NET_RAW
          * Use RAW and PACKET sockets;
          * bind to any address for transparent proxying.

   CAP_SETGID
          * Make arbitrary manipulations of process GIDs and
            supplementary GID list;
          * forge GID when passing socket credentials via UNIX domain
            sockets;
          * write a group ID mapping in a user namespace (see
            user_namespaces(7)).

   CAP_SETFCAP (since Linux 2.6.24)
          Set file capabilities.

   CAP_SETPCAP
          If file capabilities are not supported: grant or remove any
          capability in the caller's permitted capability set to or from
          any other process.  (This property of CAP_SETPCAP is not
          available when the kernel is configured to support file
          capabilities, since CAP_SETPCAP has entirely different
          semantics for such kernels.)

          If file capabilities are supported: add any capability from
          the calling thread's bounding set to its inheritable set; drop
          capabilities from the bounding set (via prctl(2)
          PR_CAPBSET_DROP); make changes to the securebits flags.

   CAP_SETUID
          * Make arbitrary manipulations of process UIDs (setuid(2),
            setreuid(2), setresuid(2), setfsuid(2));
          * forge UID when passing socket credentials via UNIX domain
            sockets;
          * write a user ID mapping in a user namespace (see
            user_namespaces(7)).

   CAP_SYS_ADMIN
          Note: this capability is overloaded; see Notes to kernel
          developers, below.

          * Perform a range of system administration operations
            including: quotactl(2), mount(2), umount(2), swapon(2),
            setdomainname(2);
          * perform privileged syslog(2) operations (since Linux 2.6.37,
            CAP_SYSLOG should be used to permit such operations);
          * perform VM86_REQUEST_IRQ vm86(2) command;
          * perform IPC_SET and IPC_RMID operations on arbitrary System
            V IPC objects;
          * override RLIMIT_NPROC resource limit;
          * perform operations on trusted and security Extended
            Attributes (see xattr(7));
          * use lookup_dcookie(2);
          * use ioprio_set(2) to assign IOPRIO_CLASS_RT and (before
            Linux 2.6.25) IOPRIO_CLASS_IDLE I/O scheduling classes;
          * forge PID when passing socket credentials via UNIX domain
            sockets;
          * exceed /proc/sys/fs/file-max, the system-wide limit on the
            number of open files, in system calls that open files (e.g.,
            accept(2), execve(2), open(2), pipe(2));
          * employ CLONE_* flags that create new namespaces with
            clone(2) and unshare(2) (but, since Linux 3.8, creating user
            namespaces does not require any capability);
          * call perf_event_open(2);
          * access privileged perf event information;
          * call setns(2) (requires CAP_SYS_ADMIN in the target
            namespace);
          * call fanotify_init(2);
          * call bpf(2);
          * perform privileged KEYCTL_CHOWN and KEYCTL_SETPERM keyctl(2)
            operations;
          * use ptrace(2) PTRACE_SECCOMP_GET_FILTER to dump a tracees
            seccomp filters;
          * perform madvise(2) MADV_HWPOISON operation;
          * employ the TIOCSTI ioctl(2) to insert characters into the
            input queue of a terminal other than the caller's
            controlling terminal;
          * employ the obsolete nfsservctl(2) system call;
          * employ the obsolete bdflush(2) system call;
          * perform various privileged block-device ioctl(2) operations;
          * perform various privileged filesystem ioctl(2) operations;
          * perform privileged ioctl(2) operations on the /dev/random
            device (see random(4));
          * install a seccomp(2) filter without first having to set the
            no_new_privs thread attribute;
          * modify allow/deny rules for device control groups;
          * employ the ptrace(2) PTRACE_SECCOMP_GET_FILTER operation to
            dump tracee's seccomp filters;
          * employ the ptrace(2) PTRACE_SETOPTIONS operation to suspend
            the tracee's seccomp protections (i.e., the
            PTRACE_O_SUSPEND_SECCOMP flag).
          * perform administrative operations on many device drivers.

   CAP_SYS_BOOT
          Use reboot(2) and kexec_load(2).

   CAP_SYS_CHROOT
          Use chroot(2).

   CAP_SYS_MODULE
          * Load and unload kernel modules (see init_module(2) and
            delete_module(2));
          * in kernels before 2.6.25: drop capabilities from the system-
            wide capability bounding set.

   CAP_SYS_NICE
          * Raise process nice value (nice(2), setpriority(2)) and
            change the nice value for arbitrary processes;
          * set real-time scheduling policies for calling process, and
            set scheduling policies and priorities for arbitrary
            processes (sched_setscheduler(2), sched_setparam(2),
            shed_setattr(2));
          * set CPU affinity for arbitrary processes
            (sched_setaffinity(2));
          * set I/O scheduling class and priority for arbitrary
            processes (ioprio_set(2));
          * apply migrate_pages(2) to arbitrary processes and allow
            processes to be migrated to arbitrary nodes;
          * apply move_pages(2) to arbitrary processes;
          * use the MPOL_MF_MOVE_ALL flag with mbind(2) and
            move_pages(2).

   CAP_SYS_PACCT
          Use acct(2).

   CAP_SYS_PTRACE
          * Trace arbitrary processes using ptrace(2);
          * apply get_robust_list(2) to arbitrary processes;
          * transfer data to or from the memory of arbitrary processes
            using process_vm_writev(2);
          * inspect processes using kcmp(2).

   CAP_SYS_RAWIO
          * Perform I/O port operations (iopl(2) and ioperm(2));
          * access /proc/kcore;
          * employ the FIBMAP ioctl(2) operation;
          * open devices for accessing x86 model-specific registers
            (MSRs, see msr(4));
          * update /proc/sys/vm/mmap_min_addr;
          * create memory mappings at addresses below the value
            specified by /proc/sys/vm/mmap_min_addr;
          * map files in /proc/bus/pci;
          * open /dev/mem and /dev/kmem;
          * perform various SCSI device commands;
          * perform certain operations on hpsa(4) and cciss(4) devices;
          * perform a range of device-specific operations on other
            devices.

   CAP_SYS_RESOURCE
          * Use reserved space on ext2 filesystems;
          * make ioctl(2) calls controlling ext3 journaling;
          * override disk quota limits;
          * increase resource limits (see setrlimit(2));
          * override RLIMIT_NPROC resource limit;
          * override maximum number of consoles on console allocation;
          * override maximum number of keymaps;
          * allow more than 64hz interrupts from the real-time clock;
          * raise msg_qbytes limit for a System V message queue above
            the limit in /proc/sys/kernel/msgmnb (see msgop(2) and
            msgctl(2));
          * allow the RLIMIT_NOFILE resource limit on the number of "in-
            flight" file descriptors to be bypassed when passing file
            descriptors to another process via a UNIX domain socket (see
            unix(7));
          * override the /proc/sys/fs/pipe-size-max limit when setting
            the capacity of a pipe using the F_SETPIPE_SZ fcntl(2)
            command.
          * use F_SETPIPE_SZ to increase the capacity of a pipe above
            the limit specified by /proc/sys/fs/pipe-max-size;
          * override /proc/sys/fs/mqueue/queues_max limit when creating
            POSIX message queues (see mq_overview(7));
          * employ the prctl(2) PR_SET_MM operation;
          * set /proc/[pid]/oom_score_adj to a value lower than the
            value last set by a process with CAP_SYS_RESOURCE.

   CAP_SYS_TIME
          Set system clock (settimeofday(2), stime(2), adjtimex(2)); set
          real-time (hardware) clock.

   CAP_SYS_TTY_CONFIG
          Use vhangup(2); employ various privileged ioctl(2) operations
          on virtual terminals.

   CAP_SYSLOG (since Linux 2.6.37)
          * Perform privileged syslog(2) operations.  See syslog(2) for
            information on which operations require privilege.
          * View kernel addresses exposed via /proc and other interfaces
            when /proc/sys/kernel/kptr_restrict has the value 1.  (See
            the discussion of the kptr_restrict in proc(5).)

   CAP_WAKE_ALARM (since Linux 3.0)
          Trigger something that will wake up the system (set
          CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM timers).