cmake: Device node permissions should be configurable

[wfrisch]

The IIO USB device nodes are set to mode 666 in libiio.rules.cmakein:

SUBSYSTEM=="usb", PROGRAM=="/bin/sh -c '@CMAKE_INSTALL_FULL_BINDIR@/iio_info -S usb=%s{idVendor}:%s{idProduct} | grep %s{idVendor}:%s{idProduct}'", RESULT!="", MODE="666"

While this is easy to manage as it allows all users of a system to access IIO devices, it undermines the system's privilege separation. A more secure configuration, in my humble opinion, would be to add a system group iio with mode 660.

[wfrisch]

Ideally, this should be configurable via cmake so that packagers can easily set the desired group/mode for their distribution.

[StefanBruens]

Preferably:

1. Change MODE="666" to e.g. ENV{libiio_matched}="1"
2. Add a rules file which actually grants the permissions:
   • ENV{libiio_matched}=="1" TAG+="uaccess" or
   • ENV{libiio_matched}=="1" GROUP="iiod" MODE="660"

The latter can be easily changed/disabled with a local dropin in /etc/udev/rules.d/.

[StefanBruens]

Btw, the udev match rules itself has still several issues, see my earlier #586 (comment) .