Package: fpga-icestorm
Version: 0~20160218gitf2b2549-2
Tags: patch
Severity: important
When installing Debian, the initial user was traditionally made a member
of the plugdev group, and this granted access to local hardware dongles
when this user is logged in. This approach causes problems for users
originating from directory services like LDAP and Active Directory, as
such plugdev membership can not be granted globally. The plugdev
membership can be assigned during login (using pam_group), but still
this approach is problematic because left behind processes keep the
group membership even when the user is no longer logged in on the
machine, allowing background processes to get access to other peoples
hardware.
There is an alternative to group membership for device access, using
ACL, and with systemd this is the recommended default. To enable it for
a given device, the 'access' tag can be set.
Please do so for the fpga-icestorm udev rule, to allow the device to
work for any console user, not only the one created during installation.
Here is a patch:
diff -ur fpga-icestorm/debian/40-fpga-icestorm.rules
fpga-icestorm-0~20160218gitf2b2549/debian/40-fpga-icestorm.rules
--- fpga-icestorm/debian/40-fpga-icestorm.rules 2016-10-11 04:59:54.702535444
+0000
+++ fpga-icestorm-0~20160218gitf2b2549/debian/40-fpga-icestorm.rules
2016-10-11 04:58:39.921570952 +0000
@@ -1 +1 @@
-ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6010", MODE="0660", GROUP="plugdev"
+ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6010", MODE="0660",
GROUP="plugdev", TAG+="uaccess"
I suspect the plugdev/mode part can be removed, but did not suggest to
do so at this time because I am unsure how it affect non-systemd users.
--
Happy hacking
Petter Reinholdtsen
