search

indianakernick / The-Fat-Controller

A library for simulating mouse and keyboard events
Apache License 2.0
39 stars 17 forks source link

Bad security of `/dev/uinput` #1

Closed maxbla closed 3 years ago

maxbla commented 3 years ago

this line of the readme sudo sh -c 'echo -e "KERNEL==\"uinput\", MODE=\"0666\"" >> /etc/udev/rules.d/50-uinput.rules' Lets any userspace program simulate user input persistent across reboots, which is not enabled by default for Linux for a reason - it is a security issue. This should be clarified in the readme (in addition to how to remove this for Linux newbies).

The proper way to deal with this for production software is to create a separate group (see weylus' readme)

The proper way to deal with it for one off local development is probably chmod, as it is not persistent across reboots

indianakernick commented 3 years ago

Thanks for pointing this out. The README has been updated. Let me know what you think and I'll publish a new release to update it on crates.io.

maxbla commented 3 years ago

Looks good to me! after changing the .rules file, you don't have to reboot, you can also udevadm control --reload-rules

indianakernick commented 3 years ago

I published a new version for this to update the crates.io README.