Best way to access /dev/uinput?

There isn’t an interface for /dev/uinput at this time. It could be added, but it would be very privileged. Unfortunately, the steam controller udev rules typically set the permissions as 0666 but this is way too lax for what the device allows (it would allow any process on the system to inject input events, to say, drive the desktop). Due to how the interface works, this is an all or nothing deal with no fine-grained mediation (see https://www.kernel.org/doc/html/v4.12/input/uinput.html for details).

Put more simply, while we could certainly create an interface for accessing uinput, that interface would not create udev rules to allow normal users to access it for security reasons. Unfortunately, this seems to be precisely what a steam controller needs. Snapd could set up the device with an ACL (use case 2 of Multiple users and groups in snaps), but this is not currently supported. The best that could be done at this time would be to create the uinput interface for the security policy to allow use, but not touch udev rules for setting permissions on the device. In this manner, a snap could access the steam controller provided the user setup the permissions of the uinput device.

2 Likes