
/*TEXT Daemon Access Control

The rpgpio daemon operates in two modes - with or without access control.

The default setting is without access control and the permissions
system does not apply (so the rest of this section may be ignored).

If the rgpiod daemon is started with the -x option it implements
an access control permissions system to its functions.

There are three parts to the permissions system.

[ol]
An .lg_secret file in the users home directory.
An .lg_secret file in the daemon's configuration directory.
A permits file in the daemon's configuration directory.
[ol]

The daemon client "logs in" to the daemon by choosing a user name.  If the client and daemon copies of the password for the user match the user is "logged in".

The client program is then authorised to carry out any functions permitted to the user as specified in the permits file.

TEXT*/

/*TEXT User secret file

The user .lg_secret file contains a list of user names with an associated password.

These passwords have no relationship to the passwords used by Linux and should not be the same.  The format is user=password.

An example .lg_secret file.

. .
# user secrets file
# user=password
pete=t4pf4kvPOXjLfDnKBrMu
. .

The file should be readable/writable by the owner only.

chmod 600 .lg_secret
TEXT*/

/*TEXT Daemon secret file

The daemon .lg_secret file contains a list of user names with an associated password.

These passwords have no relationship to the passwords used by Linux and should not be the same.  The format is user=password.

An example daemon .lg_secret file.

. .
# rgpiod secrets file
# user=password
joan=kr6g89XmFQvLDWh6UcJH
sally=fARrxSKqdHaPHBu6Vtet
pete=t4pf4kvPOXjLfDnKBrMu
fred=tugXUuRdPqGux6t7jhhv
. .

The file should be readable/writable by the owner only.

chmod 600 .lg_secret
TEXT*/

/*TEXT Daemon permits file

The permits file can contain the following sections.  If a section is
absent it means that access to those features is forbidden.

. .
[debug]
[files]
[gpio]
[i2c]
[notify]
[scripts]
[serial]
[shell]
[spi]
. .
TEXT*/

/*TEXT [debug]
Each entry in this section takes one of the following forms: [#user=y#] or [#user=n#].

If the form [#user=y#] is used that user is allowed to use the debug commands.

If the form [#user=n#] is used, or there is no entry for the user, that user is
not allowed to use the debug command.

If the [debug] section is not present no user is allowed to use the
debug commands.

The debug commands are set and get sbc internals and reload configuration.
TEXT*/

/*TEXT [files]
Each entry in this section takes the form [#user=path x#] where
[#path#] indicates a file path and [#x#] refers to a permission. E.g.
[#/home/peter/data.txt r#] refers to Linux file[#/home/peter/data.txt#]
and read permission.

There may be more than one [#path#] entry per user, each must be separated by a [#:#] character.

[#path#] may contain the wild card characters [#*#] (matches any
characters) or [#?#] (matches a single character).

If the path entry starts with / it is relative to root (/) otherwise
it is relative to the daemons's working directory.

The permission may be R for read, W for write, U for read/write,
and N for no access.  If a directory allows read/write access then
files may be created in that directory.

Where more than one entry matches a file the most specific rule
applies.  If no entry matches a file then access is denied.

...
joan=/tmp/* u:* n:TEST/* r:TEST/TEST/* u
...

User joan may create, read, and write files in the /tmp directory ([#/tmp/* u#]).

User joan has no access to files in the working directory ([#* n#]).

Overridden by user joan has read permission for files in the TEST directory
of the working directory ([#TEST/* r#]).

Overridden by user joan may create, read, and write files in the
TEST/TEST directory of the working directory ([#TEST/TEST* u#]).
TEXT*/

/*TEXT [gpio]
Each entry in this section takes the form [#user=x.y#] where [#x#] indicates
a gpiochip device and [#y#] indicates a GPIO. E.g. [#1.2#] refers to Linux device [#/dev/gpiochip1#] GPIO 2.

There may be more than one [#x.y#] entry per user, each must be separated by a [#:#] character.

Both x and y may have the following forms.

[#*#] all gpiochips or all GPIO. 
[#n#] a single gpiochip or GPIO. 
[#n,n#] a list of gpiochips or GPIO. 
[#n-n#] a range of gpiochips or GPIO. 

...
fred=0.2-27      # user fred can access gpiochip 0 GPIO 2-27.
peter=*.1,2      # user peter can access all gpiochips GPIO 1 and 2.
jill=1,2.*       # user jill can access all GPIO of gpiochips 1 and 2.
boss=*.*         # user boss can access all gpiochips and GPIO.
sally=0.2-27:3.* # user sally can access gpiochip 0 GPIO 2-27 and
                 # all GPIO of gpiochip 3.
...

TEXT*/

/*TEXT [i2c]
Each entry in this section takes the form [#user=x.y#] where [#x#] indicates
an I2C bus and [#y#] indicates a device on the bus. E.g. [#1.27#] refers to Linux device [#/dev/i2c-1#] device 27. 

There may be more than one [#x.y#] entry per user, each must be separated by a [#:#] character.

Both x and y may have the following forms.

[#*#] all I2C buses or all devices. 
[#n#] a single I2C bus or device. 
[#n,n#] a list of I2C buses or devices. 
[#n-n#] a range of I2C buses or devices. 

...
fred=0.3-127      # user fred can access I2C bus 0 devices 3-127.
peter=*.83,89     # user peter can access all I2C buses devices 83 and 89.
jill=1,2.*        # user jill can access all devices on I2C buses 1 and 2.
boss=*.*          # user boss can access all I2C buses and devices.
sally=0.80-99:3.* # user sally can access I2C bus 0 devices 80-99 and
                  # all devices of I2C bus 3.
...

TEXT*/

/*TEXT [notify]
Each entry in this section takes one of the following forms: [#user=y#] or [#user=n#].

If the form [#user=y#] is used that user is allowed to use the
notify commands.

If the form [#user=n#] is used, or there is no entry for the user,
that user is not allowed to use the notifiy commands.

If the [notify] section is not present no user is allowed to use the
notify commands.
TEXT*/

/*TEXT [scripts]
Each entry in this section takes one of the following forms: [#user=y#] or [#user=n#].

If the form [#user=y#] is used that user is allowed to use the script commands.

If the form [#user=n#] is used, or there is no entry for the user, that user is
not allowed to use the script command.

If the [debug] section is not present no user is allowed to use the
script commands.
TEXT*/

/*TEXT [serial]
Each entry in this section takes the form [#user=device#] where
[#device#] indicates a serial device. E.g. [#/dev/serial0#] refers to
Linux device [#/dev/serial0#]

There may be more than one [#device#] entry per user, each must be separated by a [#:#] character.

[#device#] may contain the wild card characters [#*#] (matches any
characters) or [#?#] (matches a single character).

...
fred=/dev/serial0              # user fred can access /dev/serial0.
peter=/dev/tty*                # user peter can access /dev/tty*.
boss=/dev/*                    # user boss can access /dev/*.
sally=/dev/serial?:/dev/ttyS*  # user sally can access /dev/serial?
                               # and /dev/ttyS*.
...

TEXT*/

/*TEXT [shell]
Each entry in this section takes one of the following forms: [#user=y#] or [#user=n#].

If the form [#user=y#] is used that user is allowed to use the shell commands.

If the form [#user=n#] is used, or there is no entry for the user, that user is
not allowed to use the shell commands.

If the [shell] section is not present no user is allowed to use the
shell commands.
TEXT*/

/*TEXT [spi]
Each entry in this section takes the form [#user=x.y#] where [#x#]
indicates a SPI bus and [#y#] indicates a slave select. E.g. [#1.2#]
refers to Linux device [#/dev/spidev1.2#]

There may be more than one [#x.y#] entry per user, each must be separated by a [#:#] character.

Both [#x#] and [#y#] may have the following forms.

[#*#] all SPI buses or all slaves. 
[#n#] a single SPI bus or slave. 
[#n,n#] a list of SPI buses or slaves. 
[#n-n#] a range of SPI buses or slaves. 

...
fred=0.0-2       # user fred can access SPI bus 0 slaves 0-2.
peter=*.0        # user peter can access all SPI buses slave 0.
jill=1,2.*       # user jill can access all slaves on SPI buses 1 and 2.
boss=*.*         # user boss can access all SPI buses and slaves.
sally=0.0-2:1.*  # user sally can access SPI bus 0 slaves 0-2 and
                 # all slaves of SPI bus 1.
...

TEXT*/

/*TEXT Example permits file

. .
# rgpiod test file for user access
# user=permission

[files]
default=:
test1=/tmp/* u:* n:TEST/* r:TEST/TEST/* u:

[gpio]
test1=*.2-27
test2=0.2-27
test3=0.5-10

[i2c]
test1=1-999.*
test2=1-2.*
test3=2.5-20

[notify]
test1=n
test2=y
test3=y

[scripts]
test1=y
test2=n
test3=y

[serial]
test1=/dev/serial*:/dev/ttyUSB*:/dev/ttyS*
test2=/dev/ttyUSB1:/dev/tty0:/dev/ttyS0
test3=/dev/null

[spi]
test1=0.0:0.1:1.0:1.1:1.2:2.0:2.1
test2=0.*
test3=*.0

[debug]
admin=y

[shell]
test1=n
test2=n
test3=y
. .
TEXT*/

