5

I want to access special USB device (not a simple flash drive) from inside container. I bind /dev/bus/usb inside container, lsusb lists USBs effortlessly:

$ lsusb
...
Bus 002 Device 002: ID 0a89:0009 
...

but my program can't interact with this device.

MadRunner
  • 501
  • 4
  • 12

1 Answers1

14

systemd-nspawn handles permissions for devices through [cgroups][1]. By default, any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to any device passed directly to --bind argument like --bind=/dev/vcs. This won't work with USB because /dev/bus/usb is a directory.

To grant permission for currently running container named my_container (supposedly you started it with systemd-nspawn directly from command line) execute as root:

$ echo 'c 189:* rwm' > \
 /sys/fs/cgroup/devices/machine.slice/machine-my_container/devices.allow

c 189:* rwm means read write mknod permissions for any character device with type (identificator) 189 and any subtype. See also: https://kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html You can find type and subtype of device with file:

$ file /dev/bus/usb/002/002

This permission will only last while container is running.

If you are using [email protected] or want to persist permissions with it, create

/etc/systemd/system/[email protected]/override.conf

or

/etc/systemd/system/systemd-nspawn@my_container.service.d/override.conf

(depending on whether you want access to USB from any systemd-nspawn container or only from my_container correspondingly) with the following content:

[Service]
DeviceAllow=char-usb_device rwm

usb_device is an alias. You can find other in /proc/devices. [1]: https://wiki.archlinux.org/index.php/cgroups

Benibr
  • 257
  • 2
  • 6
MadRunner
  • 501
  • 4
  • 12
  • 1
    Just to add, you still need to add the file/directory to the `systemd-nspawn` command in a `--bind` argument. – saiarcot895 Dec 26 '17 at 23:15
  • 1
    The `m` flag is for `mknod`, not **m**odify. See: https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.html – Brian Cully Mar 12 '21 at 22:25