Unrestricted access to /dev/ttyUSB* vulnerability

[dimich-dmb]

drivers/auxiliary/99-indi_auxiliary.rules sets mode 0666 for many popular USB-to-serial adapters. It allows any user to access any /dev/ttyUSB* unrestrictedly in most cases, regardless of uucp group membership and device purpose. This is security vulnerability.

Possible solution is to change MODE="0666" to TAG+="uaccess". Probably also need to change 99 prefix in 99-indi_auxiliary.rules to move it before 73-seat-late.rules.

[knro]

Would this work across distro? Many users are already suffering from being unable to access their USB devices due to all the restrictions and we don't want to make the users suffer unnecessarily.

[dimich-dmb]

Would this work across distro?

I don't know. I guess it should work on any distro with standard systemd configuration but can't test it. I have libindi installed as a dependency for another package.

Anyway, letting to know about security issue is better than staying silent.

Many users are already suffering from being unable to access their USB devices due to all the restrictions and we don't want to make the users suffer unnecessarily.

On another hand, allowing all users to access USB devices is a rude solution, i think. Let users manage access to devices on their systems.

[github-actions]

This issue has been inactive for 60 days and is being marked as stale.

[github-actions]

This issue has been closed due to inactivity.