[SOLVED] usb device access from lxc container

TWfromSWD · 06-05-2016, 04:05 PM

Hi

I want to access a usb device on my host from inside an lxc container. I found a lot of information on the internet but I'm still not quite sure how to do this.

This is the device I need to access from inside the container:

Code:

Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#=  5 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=03(HID  ) Sub=00 Prot=ff MxPS=64 #Cfgs=  1
P:  Vendor=6666 ProdID=5555 Rev=01.00
S:  Manufacturer=LA CROSSE TECHNOLOGY
S:  Product=Weather Direct Light Wireless Device
S:  SerialNumber=0123456
C:  #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=30mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=00 Prot=00 Driver=usbhid

This is a diff of the /dev directory content when unplugged

Code:

2,4d1
< ./hidraw0
< ./usb
< ./usb/hiddev0
85,87d81
< ./char/247:0
< ./char/180:96
< ./char/189:7
262d255
< ./bus/usb/001/008

And this is what I use to mount the device

Code:

lxc.mount.entry = /dev/bus/usb/001 dev/bus/usb/001  none bind,optional,create=dir
lxc.mount.entry = /dev/char dev/char  none bind,optional,create=dir
lxc.mount.entry = /dev/usb dev/usb none bind,optional,create=dir
lxc.mount.entry = /dev/hidraw0 dev/hidraw0  none bind,optional

lxc.cgroup.devices.allow = c 21:39 rwm
lxc.cgroup.devices.allow = c 189:* rwm

But still I can't access the device. Did I miss something?

dijetlo · 06-08-2016, 08:31 AM

Generally speaking unprivileged containers can't mount "real" devices, like USB. The UID of the process calling the device inside the container is going to be roughly equivelent to "nobody" when it's translated out of the namespace.
So the fix I normally shoot for is to have a process running on the host to catch a signal from the unpriveledged calling process in the container and mount/provide USB access as a service. In the container it's just another mounted directory, on the host it's a USB stick.
Hope that helps

TWfromSWD · 06-08-2016, 12:34 PM

The container I'm running is a privileged container, so accessing devices shouldn't be a problem. At least for someone who understands lxc device handling and not for someone like me

dijetlo · 06-08-2016, 01:09 PM

Privileged containers?!?!?!?!?
Am I dealing with an individual so possessed of a singular valor that creating privileged containers is a non-issue for you or do you just not know what a huge security hole you're about create? You can use the container to develop in, but you wont deploy in a secure production facility like that. I always try to make my Dev environment as close to the Prod environment as possible (as there so here) but you, my friend, are apparently made of finer stuff than I.

That said, I'd check dmesg on both nodes and see if my Uber-container and my host can help us out a little. We need to see if it is trying to mount the thing and failing or just doesn't know how to try. If it's failing, udev is going to pitch a fit all over dmesg and syslog. If it doesn't know how to ask for it, it's going to fail quietly (no error in dmesg or syslog).
What are you running in this beast anyway?

dijetlo · 06-08-2016, 01:24 PM

I checked, people on the internet actually do this stuff (don't let it swell your head, they do a lot of crazy stuff on the internet).
The process is pretty simple, match the udev references, bind the mount point on the guest, add permissions in lxc.conf to allow the device passthrough and it should work.
Take a look at this and this and let me know if you have any questions.

TWfromSWD · 06-09-2016, 12:17 AM

Quote:

Originally Posted by dijetlo

What are you running in this beast anyway?

It's a compatibility thing. I'm using the wfrog weather station software with a special plugin to write the data my weather station collects into a mysql database. I'm currently redesigning my setup and so I decided to migrate the wfrog installation, along with some other stuff, to debian jessie. My problem is now, that the wfrog plugin doesn't work on jessie. And since I'm already using lxc on my new installation I decided to move the whole old wfrog wheezy installation into a container till I find a way to make it work on jessie (or till forever, who knows

). This wfrog container has no access to the outside world, except for a temporary internet connection for installing updates. It should only have access to the mysql database on the host to write it's data. So I don't think its a big security issue running it as privileged container.

And now I'm trying to learn how to use lxc property and how to let the wfrog plugin access the usb transceiver to connect with the weather station.

TWfromSWD · 06-09-2016, 11:12 AM

Fun story: I actually did too much

I reduced my config entries to the following:

Code:

lxc.mount.entry = /dev/bus/usb/001 dev/bus/usb/001  none bind,optional,create=dir

# USB Dongle for weather station
lxc.cgroup.devices.allow = c 189:* rwm

and finally it works

Thanks for the help!
It may be possible to reduce the rights even further...

Now I just have to solve my internet access problem from the other thread