Remove 51-mariux udev rules file

[donald]

The rules in this file want to make sound, video and cdrom devices
available to the locally logged in user by setting the device files to
mode 0666, which in fact makes these available to all users. This is a
privacy problem when applied to sound, input and video devices.

However, this is unnecessary, as the access for the locally logged in
user is already managed by udev and logind.

The whole processes is more or less undocumented [1]

Relevant rules files are

/lib/udev/rules.d/70-uaccess.rules
/lib/udev/rules.d/71-seat.rules
/lib/udev/rules.d/83-seat-late.rules

In the end, either the udev uaccess build [2] or logind [3] set a acl to
the relevant device files so that the local user can access it.

Remove the local rule file.

[1] https://github.com/systemd/systemd/issues/4288
[2] https://github.com/systemd/systemd/blob/4d484e14bb9864cef1d124885e625f33bf31e91c/src/udev/udev-builtin-uaccess.c#L51
[3] https://github.com/systemd/systemd/blob/4d484e14bb9864cef1d124885e625f33bf31e91c/src/login/logind-seat.c#L216

[donald]

Could someone check, whether this works out of the box? Remove rules file, reboot(!), login in, check audio, video and sound input. If possible, both variants: plug in device first, then log in, or log in first, then plug in webcam etc. Also log out, log (check acls are gone) , log someone else in.

buczek@theinternet:/dev$ ls -l|grep \+
crw-rw----+ 1 root cdrom    21,   0 Feb 12 12:33 sg0
crw-rw----+ 1 root cdrom    21,   1 Feb 12 12:33 sg1
brw-rw-rw-+ 1 root cdrom    11,   0 Feb 12 12:33 sr0
brw-rw-rw-+ 1 root cdrom    11,   1 Feb 12 12:33 sr1
crw-rw-rw-+ 1 root video    81,   0 Feb 19 14:19 video0
crw-rw-rw-+ 1 root video    81,   1 Feb 19 14:19 video1
buczek@theinternet:/dev$ getfacl video0
# file: video0
# owner: root
# group: video
user::rw-
user:molgen:rw-
group::rw-
mask::rw-
other::rw-

[pmenzel]

I can do that on theinternet. But first let’s take a moment and thank Lennart and all his great colleagues, that it should work out of the box.

[pmenzel]

Successfully tested on theinternet.

[donald]

Ah. I love it, when complicated things are fixed by more "-" than "+"

 install.sh                                  | 1 -
 misc_etc_files/udev/rules.d/51-mariux.rules | 3 ---

and, yes, thank you, Poettering!