Bug#822635: udev rules for USB device access effective at boot, but not on hotplug

[Josh Triplett]

On Fri, Mar 23, 2018 at 05:17:11PM +0100, Michael Biebl wrote:
> On Mon, 22 Jan 2018 18:10:58 +0100 Michael Biebl <email at michaelbiebl.de>
> wrote:
> > Hi Josh!
> > 
> > On Wed, 21 Dec 2016 20:15:12 +0100 Michael Biebl <biebl at debian.org> wrote:
> > > On Fri, 6 May 2016 18:12:27 -0500 Martin Pitt <mpitt at debian.org> wrote:
> > > > Control: tag -1 moreinfo
> > > > 
> > > > Hello Josh,
> > > > 
> > > > Josh Triplett [2016-04-25 13:48 -0700]:
> > > > > ~$ cat /etc/udev/rules.d/99-local-gnubby.rules
> > > > > SUBSYSTEMS=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0200", TAG+="uaccess"
> > > > >
> > > > > If I boot with the device attached, this seems to take effect:
> > > > >
> > > > > However, if I unplug and replug the device, this rule no longer seems to take
> > > > > effect:
> > > > 
> > > > The uaccess tag is evaluated in /lib/udev/rules.d/73-seat-late.rules,
> > > > thus 99-* is too late. Can you please move it to e. g.
> > > > 70-gnubby.rules? I'm fairly sure it will work then, but I'll keep the
> > > > bug open until you confirm, just in case.
> > > > 
> > > 
> > > The dump from Josh shows, that the uaccess udev property is properly
> > > set. So I don't think it's an udev rules ordering issue.
> > > 
> > > I think the problem rather is, that you are already logged in and the
> > > ACLs are only applied on login or when the session becomes active.
> > > 
> > > I assume if you log out and re-login after the hotplug, the ACL is
> > > properly applied?
> > 
> > Any updates on this bug report? Is there still something which needs to
> > be addressed on the systemd side? If so we need to further investigate
> > the issue.
> 
> Josh, any updates on this?

I'm not currently using the device, so I don't know the status of this
issue.

Regarding the mention of when the ACLs are applied, though, is that true
in general? I thought that if you hotplugged a device that the user is
supposed to have access to, they'd immediately get access to it.