0

I set up Home Assistant in a Kubernetes container. It needs write access to the /dev/ttyACM0 device on the host computer (i.e. the computer that runs the container). It works if I make the container “privileged” in Docker speak. Kubernetes doesn't give direct access to the Docker engine, but “privileged“ is possible also with Kubernetes.

The problem is that making a container privileged is a measure of last resort. Kubernetes also allows to set Linux capabilities. Now I wonder whether it is possible to grant write access to /dev/ttyACM0 with just (a set of) Linux capabilities?

For what it's worth, SYS_RAWIO + SYS_ADMIN was not enough.

2 Answers 2

0

FOWNER should do it. Unless your software is having issues issuing ioctls to configure the link (in which case you probably need either SYS_ADMIN or TTY_CONFIG), the issue is solely one of file permissions.

That said, FOWNER is a VERY dangerous capability to give out. Anything with that capability can bypass ALL filesystem permissions checks.

As an alternative, consider one of the following if you can get this container running under its own user:

  • Add that user to whatever group owns /dev/ttyACM0. Usually this group will be called something like tty, serial, or console, though it might instead be usb or hotplug. This is the easiest option, but it's only a little safer than using capabilities, because this group usually has ownership of the device nodes for all serial devices and may additionally own all virtual terminal device nodes too.
  • Write a udev rule to match the device in question and add an ACL to it to allow the user the container is running as to access it. This is the most secure method available, because it means that the container can only access that specific device node. If you have more than one USB ACM device, make sure to match on the combination of the various hardware ID's, because USB device enumeration order is not stable and usually varies from one boot to the next.
0

Even adding all available capabilities does not help. A privileged container is still needed. See https://github.com/kubernetes/kubernetes/issues/60748 for a Kubernetes issue that tracks this deficiency.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .