Setting up permissions for USB ports

As USB allows hotplugging of devices, there is a mechanism that dynamically creates the device files for the devices currently connected and switched on.

The operating system has to determine which users may access a device dynamically. As the operating system cannot determine this by itself, there have to be some helper applications.

The configuration of these helper applications is explained in the following section.

USB ports on Linux

As gphoto2 provides a user space driver, in order to have gphoto2 access your camera, you have to disable all kernel drivers which want to handle the camera themselves (e.g. the Linux dc2xx or stv680 drivers). You can check whether these modules are loaded by executing lsmod.

On Linux systems, you have basically two options to allow user access to USB devices:

  1. allow a certain user/group or the world access to all USB devices by mounting /proc/bus/usb with adequate user and/or group permissions (default is world-readable and root-only-writable, which is good)
  2. use hotplug (http://linux-hotplug.sourceforge.net/) and allow access only to the USB devices you want to be accessible (you need /proc/bus/usb mounted here as well, but not mounted writable by anybody else than root)

Solution 2 has a huge advantage over 1: It doesn't allow the user/group to interfere with or eavesdrop on any other USB devices which might be attached, such as USB keyboards, fingerprint reader or similar. The following paragraphs thus describe setting up 2.

On Linux systems, from the 2.4 kernel series on, the kernel supports hotplugging. You may have to compile a kernel with hotplug support if you're not already running one. You may have to install the hotplug package (http://linux-hotplug.sourceforge.net/) if you don't have it installed already.

You can find out if your kernel has hotplug support by looking for the file /proc/sys/kernel/hotplug. If it exists, you have a hotplug enabled kernel. If

            cat
            /proc/sys/kernel/hotplug
          
prints the path to your hotplug binary (usually /sbin/hotplug) and this binary exists, you are ready to rock.

Also note that the following solution does not provide absolute security and that you know the security implications of the respective usbcam script you are going to use.

  1. You must have the files devices and drivers in your /proc/bus/usb directory. If not, check the following paragraph for hints.

    Load your USB driver and mount the USB device filesystem, i.e. e.g.

                    # modprobe usb-uhci
                    # modprobe usb-ohci
                    # mount 
                    -t usbdevfs
                    /proc/bus/usb
                  
    Modern distributions like Redhat 7.2 handle this automatically if you have your USB hardware enabled. Check your BIOS settings if lspci doesn't list any USB hardware.

  2. Add the output of

                    # gphoto2 --print-usb-usermap 
                  
    to /etc/hotplug/usb.usermap after removing all lines beginning with "usbcam".

    This makes hotplug recognise all USB cameras which your version of gphoto2(3) supports and makes hotplug run the usbcam script you choose in step 3whenever one of these cameras is attached.

  3. Choose the right /etc/hotplug/usb/usbcam script for you. Example scripts are found in packages/linux-hotplug in the source tree and in linux-hotplug/ after installation and in the doc dir of the binary package. Choose one, adapt it for your needs, and copy it to /etc/hotplug/usb/usbcam. The directory /etc/hotplug should already exists, whereas it may be that you have to create the directory /etc/hotplug/usb.

    All three scripts shipped with gPhoto2 also have extensive commentary explaining their usage in more detail.

    usbcam.console
    The most simple solution is using usbcam.console. This changes the permissions so that the user owning the console according to the pam_console access the camera. This works only if you're logging in with pam_console, i.e. e.g. using gdm on Redhat Linux.
    usbcam.user
    If you want only one user to have access to the camera, use usbcam.user and change it accordingly. There is a specially marked line in the script you have to change.
    usbcam.group
    If you want multiple users to have access to the camera, add all of these users to one group - either a special group camera or a generic group users will do - and use that group in usbcam.group. There is a specially marked line in the script you have to change.
  4. Make your script file /etc/hotplug/usb/usbcam executable.

  5. Plug in the camera and switch it on. If you already did so, please unplug and/or switch off first. The kernel will now notice that your camera has been connected and, hopefully finding no kernel driver for the device, will ask hotplug to do something about it.

    Hotplug will then look into /etc/hotplug/usb.usermap and find that the usbcam script is to be called for the newly attached device. Thus /etc/hotplug/usb/usbcam is executed, hopefully setting the device permissions correctly.

    Your /var/log/messages syslog file will contain some messages to that effect.

  6. Run gphoto2(1) or any other gphoto2(3) frontend and enjoy:

                  [user@home ~]$ gphoto2 --list-ports
                  [user@home ~]$ gphoto2 --auto-detect
                  [user@home ~]$ gphoto2 --summary
                  [user@home ~]$ gphoto2 --list-files
                  [user@home ~]$ gphoto2 --get-all-images