How to run an application with certain group permissions

devicespermissions

I have a 3D printer, with which my PC can communicate through /dev/ttyACM0:

crw-rw---- 1 root uucp 166,  0 16 nov 14:58 ttyACM0

The 3D printing application repetierHost requires read/write access to this device in order to function. If I 'naively' start the application without any preparation, the application doesn't work.

If I run the application as root, it works.

If I run the application as a normal user with (supplementary) group uucp, it still doesn't work.

If I give /dev/ttyACM0 the permission flags rw-rw-rw-, and run it with my normal user, it works.

(Why) does my permission through the uucp group not pass on to the application?

I would not be opposed to just giving the file rw-rw-rw- permissions, but these are reset when the device is disconnected and reconnected. If I can't make this work through theuucp group, how can I instead make the change to the permission flags persistent?

Best Answer

I would set the group of the repetierHost application to uucp and then set the SGID bit (as long as it is a real binary and not script):

chgrp uucp repetierHost
chmod g+s repetierHost

If the repetierHost is a script you could consider moving that to repetierHost.sh and write a small C programming wrapper repetierHost that calls repetierHost.sh

E.g.:

#include <stdlib.h>

int 
main(int argc, char *argv[])
{
    system("/path/to/repetierHost.sh");
}

The recipe

Set up permissions for /dev/tty and /dev/fb0 files as described in UDude’s answer. I discovered that /dev/console permission changes are not necessary in Raspbian Jessie.

Add these lines to the [Service] section of your daemon’s .service file:

User=pi #Your limited user name goes here
StandardInput=tty
StandardOutput=tty
TTYPath=/dev/tty2   # I also tried /dev/tty1 and that didn't work for me

In case anyone interested, here is the complete pyscopefb.service file I used:

[Unit]
Description=Pyscopefb test service 
Wants=network-online.target
After=rsyslog.service
After=network-online.target

[Service]
Restart=no
ExecStart=/home/pi/Soft/Test/pygame/pyscopefb
ExecStop=/bin/kill -INT $MAINPID
OOMScoreAdjust=-100
TimeoutStopSec=10s
User=pi
WorkingDirectory=/home/pi/Soft/Test/pygame
StandardInput=tty
StandardOutput=tty
TTYPath=/dev/tty2

[Install]
WantedBy=multi-user.target

Issue these commands in the command prompt (I assume pyscopefb.service file is already placed to the correct location where systemd can find it):
```
sudo systemctl daemon-reload
sudo systemctl start pyscopefb
```

This is working for me. Please note I didn’t test whether pygame application is able to receive keyboard and mouse events or not.

Bonus

I also had to solve another 2 problems which may be of interest as well

There was blinking text cursor at the bottom of the screen with framebuffer graphics. To resolve that, I added to my application the following Python code which runs in my app before Pygame/SDL initialization:

def _disable_text_cursor_blinking(self):
    command_to_run = ["/usr/bin/sudo", "sh", "-c", "echo 0 > /sys/class/graphics/fbcon/cursor_blink"]
    try:
        output = subprocess32.check_output(command_to_run, universal_newlines = True)
        self._log.info("_disable_text_cursor_blinking succeeded! Output was:\n{output}", output = output)
    except subprocess32.CalledProcessError:
        self._log.failure("_disable_text_cursor_blinking failed!")
        raise

After about 10 minutes screen connected to Raspberry Pi’s HDMI output turned black (but not powered off) and my graphics didn’t display, though Pygame reported no errors. This turned out to be a power saving feature. To disable that, I added the following Python code which also runs before Pygame/SDL initialization:

def _disable_screen_blanking(self):
    command_to_run = ["/usr/bin/setterm", "--blank", "0"]
    try:
        output = subprocess32.check_output(command_to_run, universal_newlines = True)
        self._log.info("_disable_screen_blanking succeeded! Output was:\n{output}", output = output)
    except subprocess32.CalledProcessError:
        self._log.failure("_disable_screen_blanking failed!")
        raise

Give group permissions to specific device

You'll probably want to write a rule for udev. Assuming no changes to udev.conf, your rules file should be placed into /etc/udev/rules.d/; it may help you to crib from packages' rules which may be found in /lib/udev/rules.d/.

Writing good rules is a bit of an acquired art, but you could start with something simple if you have no other ttyACM* devices:

# Give web server read/write access to camera
KERNEL=="ttyACM?", ACTION=="add", \
   MODE:="0660", \
   GROUP:=www-data

You'll want to put the above into a file such as /etc/udev/rules.d/10-camera.rules - it must end in .rules; the two-digit numeric prefix helps get rules in the right sequence, and you might need to adjust it. The bit in between is, of course, just to help you recognise why you created it. :-)

Best Answer

Related Solutions

Linux – How to let an SDL app (not running as root) use the console

The recipe

Bonus

Give group permissions to specific device

Related Question