1

The project I am working on right now requires a webserver and some server side code to access the gpio pins. I know that the pins require root access and I need to secure them before I open it up to the internet, but I'm not sure of the route to take to do so.

I have see some people use gpio-admin to do this, however, I also saw in another post that the pins can be secured by adding a group and changing a few rights.

Does gpio-admin do basically the same thing or is there more too it? Would it be easier and just as secure to change the access to the pins?

0

A complication here is how you are using the pins. If you use a library that uses mmap(), neither method here will work for you. I do not know which libraries do not do this -- most of them do. However, you only need to use such a library if you want the web server to be able to set the pull up/down resistors or one of the pi-specific modes. If all you need to do is check/set the state (high/low) or direction (in/out) you can use the /sys/class/gpio interface directly (i.e., no library), and both these methods will work.

Does gpio-admin do basically the same thing or is there more too it?

It does something pretty similar only on a pin by pin basis; you'll notice it also requires you create a gpio group and add users to it.

One thing it does which is not possible the other way is allow non-privileged users to manipulate the pull up/down resistors (but you must use gpio-admin to do so); this is done by setting the the setuid bit on the executable. There is a potential security risk in that it means the program actually runs as root, regardless of who executes it. There is a necessity for such binaries on the system (e.g., passwd), but you must take care to ensure that the executable itself is not writable by anyone except root, otherwise they can replace/alter it and use it to do whatever they want. The make install should do that (which you should run as root or via sudo).

I'm not sure of the route to take

Probably the safest/most paranoid way to allow for this is to export the individual pins and make them owned by the server user, e.g.:

export 26 > /sys/class/gpio/export
chown -R httpd /sys/devices/virtual/gpio/gpio26

You need to use the devices/virtual path in the second command instead of class/gpio because chmod (fortunately) will not follow symlinks. The httpd username is just an example.

That needs to be done root; /etc/rc.local, if your system has one, is a good place to do this (it will be done at boot by init).

Again, this will only work for manipulating the GPIOs via that interface (which doesn't include stuff like setting the pull up/down resistors). If you need to do something requiring one of the pi-specialized libraries, you will have to use a setuid binary in the manner of gpio-admin.

  • Looking over the gpio-admin source file it seems that, like you said, it simply access the /sys/class/gpio, changes the ownership and then exports or unexports the pin. I'm hoping to create a website so I can check the status of my garage door - and various other things around the house. I simply want to make it as secure as possible for a n00 guy and try to understand what I'm installing instead of blindly running something. Thanks for the help! – mECH May 26 '15 at 13:15
  • You might have a look at joan's daemon. That is a good idea. Presumably it can be configured to restrict access in various ways. – goldilocks May 26 '15 at 13:26
0

There are all sorts of solutions.

I will tout my own which uses my pigpio library as the back end.

See pigpio CGI at http://abyz.me.uk/rpi/pigpio/examples.html#Python_code

The pigpio daemon runs as root and controls the gpios.

The web server software runs at an ordinary privilege.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.