1

I removed my user from the gpio group, logged out and back in. I can still run e.g. gpio write 25 1.

I see from this answer how the memory mapping and permissions changed between Jessie and Stretch, but the instructions for leaving the gpio group did not seem to work. I asked on IRC, and someone told me that WiringPi now uses "set uid" for the permission structure, and I see that mentioned on the WiringPi website here:

The gpio command is designed to be installed as a setuid program and called by a normal user without using the sudo command or logging in as root.

Am I going to have to compile WiringPi from source in order to change this behaviour?

$ lsb_release -a
Distributor ID: Raspbian
Description:    Raspbian GNU/Linux 10 (buster)
Release:    10
Codename:   buster

$ gpio -v
gpio version: 2.50
Copyright (c) 2012-2018 Gordon Henderson
This is free software with ABSOLUTELY NO WARRANTY.
For details type: gpio -warranty

Raspberry Pi Details:
  Type: Pi 3, Revision: 02, Memory: 1024MB, Maker: Unknown05 
  * Device tree is enabled.
  *--> Raspberry Pi 3 Model B Rev 1.2
  * This Raspberry Pi supports user-level GPIO access.
  • Possible duplicate of Wiring Pi - Root not required? – Dougie Jul 31 at 20:40
  • @Dougie my question is not a duplicate of that question. The answer to that question doesn't even apply to my situation, because the gpio group doesn't work. – Yankee Jul 31 at 22:23
2

Installing WiringPi from the official Raspbian repositories (on Stretch or later, I believe) will create an executable file at /usr/bin/gpio.

  • By default, the owner of the file is root, i.e. 0, and the group is root, i.e. 0.
  • By default, the permissions on the file is 4755. The interesting part of this is the 4, which is the setuid bit. It enables executables to be run with the same privileges as the file's owner, in this case 0, or root.

I fixed the problem simply by removing the setuid bit with chmod 0755 $(which gpio). GPIO can now only be controlled by the root user, even if a user is a member of the gpio group. Considering that there are other groups like i2c and spi, I'm not sure if this completely mitigates security problems.

I wish the gpio group could enable/disable GPIO control for users.

  • Your question may be misleading as you mean the wiringPi gpio utility. None of this affects other commands written using the wiringPi library. – joan Jul 30 at 21:27
  • @joan Sorry, I'm not sure what you're talking about. Can you explain more about why my question is misleading? I stated WiringPi in my question. Are you referring to the WiringPi C library, as opposed to the command line version? – Yankee Jul 30 at 21:31
  • Not sure how. Your solution is for a utility called gpio which uses the wiringPi library. – joan Jul 30 at 22:27
  • @joan The WiringPi package installs, among other things, the gpio utility. I have no idea what you're talking about, sorry. I'm just going to leave it at that. – Yankee Jul 30 at 22:51
  • "I wish the gpio group could enable/disable GPIO control for users" -> Set the executable 0770 and chgrp gpio $(which gpio). – goldilocks Aug 5 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.