A.1.4.2 Linux USB Permissions

Linux has a special userspace /dev device manager called udev that deals with, amongst other things, plug-and-play USB devices. It is recommended to specify so-called udev rules to define access permissions for these devices instead. These rules typically reside in a file with the name nn-descriptive-name.rules in the directory /etc/udev/rules.d. Here, nn is a two-digit number that determines the lexical order in which the udev rule files are processed. Rules processed later can overwrite earlier rules, but it not recommended to put user-generated rules higher than 60, as some of the actions they require are processed by higher-level system rules.

Here a typical udev rule for allowing an ordinary user access to the plugged-in AVRISP mkII programmer (product ID 0x2104) by Atmel (vendor ID 0x0eb):

SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2104", \
  MODE="0660", TAG+="uaccess"

This furnishes the corresponding device node with 0660 access permissions: this means r/w for the user root and any user belonging to the group of the device, which the device driver might assign to a different group than the default root. The key of the rule is the attached TAG named uaccess, which has the effect that the login daemon applies a dynamic user access control list to the device node making the device usable for the currently logged-in user. When used in anger, udev rules must appear on one line; above example was broken into two lines so it fits into the example box.

AVRDUDE’s developer option -c programmer/u will show above suggested udev rule for the named programmer. Wildcards are allowed:

$ avrdude -c jtag\*/u

1. Examine the suggested udev rules below; to install run:

avrdude -c "jtag*/u" | tail -n +11 | sudo tee /etc/udev/rules.d/55-avrdude-jtagX.rules
sudo chmod 0644 /etc/udev/rules.d/55-avrdude-jtagX.rules

2. Unplug any AVRDUDE USB programmers and plug them in again
3. Enjoy user access to the USB programmer(s)

Note: To install all udev rules known to AVRDUDE follow: avrdude -c "*/u" | more

# Generated from avrdude -c "jtag*/u"

ACTION!="add|change", GOTO="avrdude_end"

# jtag2dw, jtag2fast, jtag2, jtag2isp, jtag2pdi, jtag2slow, jtagmkII, jtag2avr32
SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2103", \
  MODE="0660", TAG+="uaccess"

# jtag3, jtag3dw, jtag3isp, jtag3pdi, jtag3updi
SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2110", \
  MODE="0660", TAG+="uaccess"
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", \
  ATTRS{idProduct}=="2110", MODE="0660", TAG+="uaccess"
SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2140", \
  MODE="0660", TAG+="uaccess"
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", \
  ATTRS{idProduct}=="2140", MODE="0660", TAG+="uaccess"

# jtagkey
SUBSYSTEM=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="cff8", \
  MODE="0660", TAG+="uaccess"

Again, each rule must be written as one line: breaking up rules into two lines was only done to fit AVRDUDE’s output to the boxed display. USB devices in HID mode require a second rule dealing with the hidraw subsystem as seen above.

This document was generated by Stefan Rueger on August 24, 2024 using texi2html 1.82.