MatMoul / g810-led

Linux led controller for Logitech G213, G410, G413, G512, G513, G610, G810, g815, G910 and GPRO Keyboards
GNU General Public License v3.0
1.39k stars 184 forks source link

mode 666 in /dev/input/event* is a severe security issue #293

Closed mfvianna closed 1 year ago

mfvianna commented 2 years ago

The provided udev rules set the read/write permissions of the Logitech keyboards allowed for everyone.

Although it enables any user to use g810-leds, it also allows any user to sniff the event device, potentially enabling anyone to capture passwords or anything else that is typed in the keyboard. The default r/w permission for others should ALWAYS be zero on keyboards, i.e., default permissions should be 660 and not 666.