Access usb device from systemd-nspawn container

Question

I want to access special USB device (not a simple flash drive) from inside container. I bind /dev/bus/usb inside container, lsusb lists USBs effortlessly:

$ lsusb
...
Bus 002 Device 002: ID 0a89:0009 
...

but my program can't interact with this device.

Solution

systemd-nspawn handles permissions for devices through cgroups. By default, any container is granted with permissions only for common devices like /dev/null, /dev/zero, etc, and additionally to any device passed directly to --bind argument like --bind=/dev/vcs. This won't work with USB because /dev/bus/usb is a directory.

To grant permission for currently running container named my_container (supposedly you started it with systemd-nspawn directly from command line) execute as root:

$ echo 'c 189:* rwm' > \
 /sys/fs/cgroup/devices/machine.slice/machine-my_container/devices.allow

c 189:* rwm means read write modify permissions for any character device with type (identificator) 189 and any subtype. You can find type and subtype of device with file:

$ file /dev/bus/usb/002/002

This permission will only last while container is running.

If you are using [email protected] or want to persist permissions with it, create

/etc/systemd/system/[email protected]/override.conf

or

/etc/systemd/system/systemd-nspawn@my_container.service.d/override.conf

(depending on whether you want access to USB from any systemd-nspawn container or only from my_container correspondingly) with the following content:

[Service]
DeviceAllow=char-usb_device rwm 

usb_device is an alias. You can find other in /proc/devices.

Comments

[saiarcot895]

Just to add, you still need to add the file/directory to the systemd-nspawn command in a --bind argument.

[Brian Cully]

The m flag is for mknod, not modify. See: kernel.org/doc/html/latest/admin-guide/cgroup-v1/devices.htm‌​l