Udev-rules for fastboot and adb

No, it isn’t:

and it’s original purpose is not used any more. In fact, Debian is considering removing it: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=897916. Note that the above UDEV rules are explicitly about allowing non-root users access to these devices and what we really need is Multiple users and groups in snaps so snapd can add the group specified in the interface (eg, ‘snap_adb’), then add udev rules using this group, with MODE=0660, then the admin can add users to snap_adb which will then have access.

All that said, the above udev rules use MODE="0666", GROUP="plugdev" so we could technically just drop the , GROUP="plugdev" since the mode is 0666 and the group is unknown and achieve the same result. On general principle, I don’t care for this since we should be using 0660; why should every user on the system have write access to these devices? However, one could argue it is ok because Android devices correctly have their own defense mechanism that does not rely on the computer-that-is-connecting-to-it for security (ie prompts, host checks, etc).

Considering all of the above, I suggest keeping MODE="0666", dropping GROUP="plugdev" and having a very clear comment in the interface what the interface allows. The interface would ideally also have adb-specific apparmor rules (and if needed, cgroup/udev tagging) for the access rather than relying on the raw-usb interface.

2 Likes