1

I am writing a large program, with some use of Maven to manage dependencies, and have come across the issue that running Pi4J causes /dev/mem to be opened, which, of course, cannot be done by a non-root user. I would like to avoid running the application as root for the following reasons:

  • Running as root will make an inevitable security bug much more damaging than a separate user (equipment connected to GPIOs is not dangerous or damaged by invalid data, so my only concern is running arbitrary commands/code)

  • Running as root would, especially during development, cause issues with file permissions.

What steps can I take to allow a non-root user to use Pi4J to read and write GPIOs? I would prefer not to use the /sys/class/gpio API unless there is a ready library for it.

1

At the PI4J project page (the one written by the author of the package) which can be found here:

http://pi4j.com/faq.html

There is a definitive statement that PI4J must be run as root. Since this is found in the frequently asked questions section, I must assume that to be the definitive and final answer. I don't know the internals that cause it to be required. I think we would have to trace back to WiringPI to see if it needs to be run as root as that is the heart of PI4J.

  • Is there any security best practice for this? Privilege separation? Wholly separate processes? – ζ-- Apr 3 '15 at 16:25
  • Unfortunately, a Unix process running as root has zero restrictions and hence there is indeed danger in running programs as root. However, for the PI, my perspective is that even though Unix is multi-user and hence, in theory, so is the PI, the reality is that it runs stand-alone and hence the "fear" of running as root on PI isn't that large. On a multi user machine, that would be scary ... but the PI is a different beast. Even if the PI Linux had zero security I'd still be ok with that. – Kolban Apr 3 '15 at 16:28
  • Root on the pi is a no go because this is a web facing service. Is there a way for Java to drop permissions with something like setuid/setgid? – ζ-- Apr 3 '15 at 16:29
  • I found the following page: wiringpi.com/reference/setup Search on it for the word root. This states that wiringPi needs to run as root for hardware access. – Kolban Apr 3 '15 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.