Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux?

Could I maybe create a user that is the only one with access to the file and set that user to be only allowed to run a specific piece of software? Or is there a way to make the system require sudo password for accepting the use of device file without running the program itself as sudo? Or can this be handled with an external program?


The way to do it is to check the permissions of the device "file" under the /dev folder. Then normally, you would add the user that is running the program to the group.

You can obviously change the permissions on the device file but doing so may well break other things in the OS which may be expecting a certain set of permissions and access.

All access in Unix/Linux is generally done by controlling what users/groups can access which files/folders and what they can do with them (read, write, execute).

So the direct answer to your question is yes. Create a specific user or group to run your app and only give that user/group access to the device file. Just be aware that you might get unexpected side-effects. You should not try to force apps/devices to require elevated rights via SUDO if you don't need to.

  • Ahh, I remember those halcyon, salad-days when you could tell by looking at file whether a user had access - before facls, selinux and dbus. – symcbean Jan 17 '20 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.