Redefining udev permissions on a given device (/dev/isdninfo)

[Felix Schwarz]

Hi,

I'm using Fedora Core 6. My ISDN card (Fritz!Card PCI v2) was detected by Fedora 
and works flawlessly.

Now, udev sets the permissions on /dev/isdninfo in a very secure way so that I 
can't access as a ordinary user.
>  [fs@ws2 ~]$ ls -la /dev/isdninfo
>  crw------- 1 root root 45, 255 28. Apr 13:23 /dev/isdninfo 
I like to have the permissions that way:
>  [fs@ws2 ~]$ ls -la /dev/isdninfo
>  crw-rw---- 1 root dialout 45, 255 28. Apr 13:23 /dev/isdninfo 
How can I configure udev so that the permissions will be set appropriately?

I think the basic permissions are set in /etc/udev/rules.d/50-udev.rules
>  [root@ws2 udev]# grep -R isdn /etc/udev/
>  /etc/udev/rules.d/50-udev.rules:KERNEL=="isdn*",        NAME="%k",
> MODE="0660"
>  /etc/udev/rules.d/50-udev.rules:KERNEL=="isdnctrl*",    NAME="%k",
> MODE="0660"
>  /etc/udev/rules.d/50-udev.rules:KERNEL=="isdnctrl0",   
> SYMLINK+="isdnctrl" 
What I do understand is that /dev/isdninfo has the
mode 0600 after booting (not 
0660 as in the mode setting above).

Changing /etc/udev/rules.d/50-udev.rules (even though this is discouraged) to
>  KERNEL=="isdn*",                NAME="%k",
> MODE="0660", GROUP="dialout" 
showed no effect.

Same goes with creating /etc/udev/rules.d/99-isdninfo.rules:
>  KERNEL="isdninfo", MODE="0660",
> GROUP="dialout" 
[1] ("Customizing Udev on Fedora" / "Permissions") suggests that one
should 
create a .permissions file in /etc/udev/permissions.d/. According to [2] this is 
obsolete since udev 053 but I tried nevertheless:
>  [root@ws2 udev]# cat /etc/udev/permissions.d/99-isdninfo.permissions
>  isdninfo:root:dialout:0644 
No effect either.

So basically I am stuck and don't know how to redefine the permissions on 
/dev/isdninfo.

Any help is appreciated!

fs

[1] http://docs.fedoraproject.org/udev/
[2] http://www.jetico.com/linux/bcrypt-help/l_probl.htm

[Mikkel]

Felix Schwarz wrote:
>  Hi,
>  
>  I'm using Fedora Core 6. My ISDN card (Fritz!Card PCI v2) was detected
>  by Fedora and works flawlessly.
>  
>  Now, udev sets the permissions on /dev/isdninfo in a very secure way so
>  that I can't access as a ordinary user.
> > [fs@ws2 ~]$ ls -la /dev/isdninfo
> > crw------- 1 root root 45, 255 28. Apr 13:23 /dev/isdninfo
>  
>  I like to have the permissions that way:
> > [fs@ws2 ~]$ ls -la /dev/isdninfo
> > crw-rw---- 1 root dialout 45, 255 28. Apr 13:23 /dev/isdninfo
>  
>  How can I configure udev so that the permissions will be set appropriately?
>   
Dumb question - are you rebooting after making the changes? Or
running "udevcontrol reload_rules" and then removing/reloading the
module for your ISDN card?

One other thing to check is to see if there is a file in
/etc/security/console.perms.d controlling permissions. I don't run
ISDN so I am not sure if the software adds a file with its rules
like the vdr package does.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Felix Schwarz]

Mikkel L. Ellertson schrieb:
>  Dumb question - are you rebooting after making the changes?  
yes.

>  One other thing to check is to see if there is a file in
>  /etc/security/console.perms.d controlling permissions. I don't run
>  ISDN so I am not sure if the software adds a file with its rules
>  like the vdr package does. 
No references to isdn in console.perms.d either but your suggestion was helpful 
nevertheless: I created 60-isdninfo.perms which has the appropriate definitions.

[root@ws2 fs]# cat /etc/security/console.perms.d/60-isdninfo.perms
<isdn>=/dev/isdninfo

<console>  0660 <isdn>       0660 root.dialout

This solves at least 3/4 of my problem as I can now access /dev/isdninfo as a 
local user.

Unfortunately, there are two problems left:
1. Obviously, this does not work when using a remote (X) login. Therefore a 
general solution with udev is still needed.
2. After logging in, the ownership on /dev/isdninfo is <user>.root instead of 
root.dialout. Why?

Thanks for your help so far :-) I don't think it is anything special for isdn, 
just general udev/permissions.

fs

[Mikkel]

Felix Schwarz wrote:
>  
>  Mikkel L. Ellertson schrieb:
> > Dumb question - are you rebooting after making the changes? 
>  
>  yes.
>  
> > One other thing to check is to see if there is a file in
> > /etc/security/console.perms.d controlling permissions. I don't run
> > ISDN so I am not sure if the software adds a file with its rules
> > like the vdr package does.
>  
>  No references to isdn in console.perms.d either but your suggestion was
>  helpful nevertheless: I created 60-isdninfo.perms which has the
>  appropriate definitions.
>   
Well, one other thing you could try is to create a file
/etc/udev/device.d/15-isdninfo.rules with a line:

KERNEL=="isdninfo", NAME="%k", GROUP="dialout",
MODE="0660",
OPTIONS="last_rule"

With the OPTIONS="last_rule" at the end, nothing should overwrite
the permissions. (Console.prems will once someone logs in at the
console if you still have your added rule.) If it does not work,
then chances are something outside of udev is changing the
permissions. But I have no idea what.

Mikkel
-- 

  Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!

[Felix Schwarz]

Hi Mikkel,

thanks again for your very helpful post!

Mikkel L. Ellertson wrote:
>  Well, one other thing you could try is to create a file
>  /etc/udev/device.d/15-isdninfo.rules with a line: 
I think, you meant '/etc/udev/rules.d/...' because device.d does not exist on my
Fedora Core 6 system.

>  KERNEL=="isdninfo", NAME="%k",
> GROUP="dialout", MODE="0660",
>  OPTIONS="last_rule" 
Anyway, this did not work.

>  If it does not work,
>  then chances are something outside of udev is changing the
>  permissions.  
But that comment encouraged my to search the problem outside of udev so I first
looked into the init scripts for isdn and saw some strange MAKEDEV calls
commented by "workaround for kernel/udev".

Long story short, /sbin/MAKEDEV creates all the devices and udev has nothing to
do anything with it.

The file to change was /etc/makedev.d/01linux-2.6.x
- c $ROOT                 45 255  1   1 isdninfo
+ c 0660 root dialout     45 255  1   1 isdninfo

Thanks for your help, your comments were the key to my success - tried to solve
the problem several months ago but failed until now...


fs