Actions
Forum Thread Details
  • State Verified Answer
  • Replies 14 replies
  • Answers 2 answers
  • Subscribers 145 subscribers
  • Views 2076 views
  • Users 0 members are here
Related

Anyone know how to access RasPi GPIO without sudo?

johnbeetem

I've finally gotten around to playing with RasPi GPIOs, using Gert van Loo and Dom's C code at the RasPi Wiki.  It works fine, except that you have to run the executable as root or use sudo to access /dev/mem.

 

Does anyone here know how to access /dev/mem as a normal user?

Parents
  • 0

    Either you have to run your application as root, or use a device driver than trying to use /dev/mem

  • 0 in reply to Arjan

    Unix has a "security model". As a normal users you can do stuff, but you should not be able to access other people's files on the same computer. And as a user you should not be able to cause the computer to stop working.

     

    This means that as a rule, you should not be able to directly access hardware, like the physical memory of the computer. So that's why /dev/mem is protected so that normal users cannot access it.

     

    Now "/dev/mem" allows you much, much more "mischief" than just changing a GPIO. So that's why /dev/mem must be protected against normal users.

     

    If "allowable" things need to happen, the normal way to achieve this is to make a setuid program. The program GETS the priviledges needed once it is executed, the program then checks permissions (if neccessary) and then allows you to do the little thing you wanted.

     

    As an example, the system cannot and should not allow you to insert a random packet onto the network. However the operating system does not provide a way to send "ICMP ECHO REQUEST" packets. There is a program that does that: "ping"! So the ping program gets privileges, uses that to send a carefully prepared ICMP ECHO REQUEST packet, and display the results. Although it uses the system mechanism for "sending arbitrary packets", it should restrict you to only send the innocent ICMP ECHO REQUEST packets. The ping program doesn't have any further permission checking (that I know of).

     

    Now back to your problem...
    If you make a little program that allows you to manipulate just the GPIO outputs, that won't allow you to cause all the other mischief you'd be able to make with "/dev/mem" access, then you can install that program with superuser permissions (setuid) and then you can use that program as a normal user.

     

    I have written such a program. IIRC, it is contained in this package:

    http://www.bitwizard.nl/software/gpio_spi_i2c_20120419.tgz

     

    The program can be made setuid by doing:

      sudo chown root <program name>

      sudo chmod 4755 <program name>

     

    The program I wrote has NOT been checked for security in this scenario.

     

    The responsibility of "keeping the system safe" is moved from the kernel to the program with the elevated permissions. So if the "ping" program contained a bug that, say, would allow hackers to specify arbitrary network packets, then the protection of the system that normal users cannot send arbitrary network packets breaks down.

Reply
  • 0 in reply to Arjan

    Unix has a "security model". As a normal users you can do stuff, but you should not be able to access other people's files on the same computer. And as a user you should not be able to cause the computer to stop working.

     

    This means that as a rule, you should not be able to directly access hardware, like the physical memory of the computer. So that's why /dev/mem is protected so that normal users cannot access it.

     

    Now "/dev/mem" allows you much, much more "mischief" than just changing a GPIO. So that's why /dev/mem must be protected against normal users.

     

    If "allowable" things need to happen, the normal way to achieve this is to make a setuid program. The program GETS the priviledges needed once it is executed, the program then checks permissions (if neccessary) and then allows you to do the little thing you wanted.

     

    As an example, the system cannot and should not allow you to insert a random packet onto the network. However the operating system does not provide a way to send "ICMP ECHO REQUEST" packets. There is a program that does that: "ping"! So the ping program gets privileges, uses that to send a carefully prepared ICMP ECHO REQUEST packet, and display the results. Although it uses the system mechanism for "sending arbitrary packets", it should restrict you to only send the innocent ICMP ECHO REQUEST packets. The ping program doesn't have any further permission checking (that I know of).

     

    Now back to your problem...
    If you make a little program that allows you to manipulate just the GPIO outputs, that won't allow you to cause all the other mischief you'd be able to make with "/dev/mem" access, then you can install that program with superuser permissions (setuid) and then you can use that program as a normal user.

     

    I have written such a program. IIRC, it is contained in this package:

    http://www.bitwizard.nl/software/gpio_spi_i2c_20120419.tgz

     

    The program can be made setuid by doing:

      sudo chown root <program name>

      sudo chmod 4755 <program name>

     

    The program I wrote has NOT been checked for security in this scenario.

     

    The responsibility of "keeping the system safe" is moved from the kernel to the program with the elevated permissions. So if the "ping" program contained a bug that, say, would allow hackers to specify arbitrary network packets, then the protection of the system that normal users cannot send arbitrary network packets breaks down.

Children
No Data