How can I connect a single USB device to my LXC container?

Question

TL;DR

• I have two software radio devices attached to my Linux server.
• I have an LXC container running on the Linux server.
• Both software radios have the same productid and vendorid.
• How do I attach only one of the software radios to the LXC container?

Why?

Because I want to!

More serious answer: I give less-trusted users access to LXC container, and not to the LXD host. I want these users to only see one of the software radios.

Debugging

Sanity check

• I am running a third-party utility which flashes the radios via USB
• I first connect/allow USB to both radios
  • command: lxc config device add my-container usrpUSB usb productid=6010 vendorid=0403
• I run the flashing utility, and it works
• I disconnect USB
  • command: lxc config device remove my-container usrpUSB
• I run the flashing utility, and it fails
• Conclusion: lxc USB connector works as expected

Finding what changed

• Idea: if I can find what files that lxc config changed on the container, maybe I can do it manually, so:
• Connect USB (see command above)
• List container files
  • find / -ls > /tmp/find_with_usb.txt
• Disconnect USB (see command above)
• List container files
  • find / -ls > /tmp/find_without_usb.txt
• Compare the two
  • There are over a hundred new files
  • None of them are /dev/ttyUSB* devices
  • The files are mostly in /var/lib/lxcfs and /sys/fs/cgroup directories
  • I am not sure what the source is for these on the LXD system
• Conclusion: manual path/character-device mapping will not work.

So?

• Is there some other way to do this?
• I don't see any options for further constraining USB devices (source)

Answer 1

Since lxc autodev isn't automatically configuring the device you want, you're left having to configure the node. Try using a control group to differentiate between the devices and/or using a hook to create the device node prior to the container's start (although, check for TOCTTOU via a misconfiguration). Or hook scripts to handle the node device creation at an opportune time, be it 'pre-mount' of its filesystem, or 'pre-start' to run scripts in the host's namespace prior to the container's start.

Ref: https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html • /DEV DIRECTORY • CONTROL GROUPS ("CGROUPS")