1

Is there a way to allow only a specific program to access a device file (e.g. serial interface) in Linux?

Could I maybe create a user that is the only one with access to the file and set that user to be only allowed to run a specific piece of software? Or is there a way to make the system require sudo password for accepting the use of device file without running the program itself as sudo? Or can this be handled with an external program?

Improve this question

2 Answers 2

Reset to default
1

The way to do it is to check the permissions of the device "file" under the /dev folder. Then normally, you would add the user that is running the program to the group.

You can obviously change the permissions on the device file but doing so may well break other things in the OS which may be expecting a certain set of permissions and access.

All access in Unix/Linux is generally done by controlling what users/groups can access which files/folders and what they can do with them (read, write, execute).

So the direct answer to your question is yes. Create a specific user or group to run your app and only give that user/group access to the device file. Just be aware that you might get unexpected side-effects. You should not try to force apps/devices to require elevated rights via SUDO if you don't need to.

Improve this answer
1
  • Ahh, I remember those halcyon, salad-days when you could tell by looking at file whether a user had access - before facls, selinux and dbus.
    – symcbean
    Commented Jan 17, 2020 at 12:47
1

The standard Unix user permissions are enough here. You can create a specific user and change the access permission to the device file to be 0600 and have the device file owned by that specific user.

If the /dev folder is recreated at boot time, you will have to use a startup script to reset that ownership and permission after each and every boot. Make sure that the script only runs after the dev folder is populated (or mounted).

Finaly Unix system have the rather fossil set-user-id thing. It is now seen as unsecure because it is easy to abuse it, but it could help if you want users to use a specific program to access the device: have the device owner own the program file and set the set-user-id bit on that program file. Optionaly if only selected users are allowed to use the program you can build a specific group containing the allowed users and make the program executable only by its owner and that group.

Rather archaic, but easy to set up...

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .