udev rule security issues

[gibs2193]

So I installed the app which came with a udev rule that invalidates the security and in my opinion the purpose of this project. On Linux.
I checked your docs just to make sure and indeed you are recommending the same one, which is baffling.

From https://get.vial.today/manual/linux-udev.html

# Keychron Q2
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", ATTRS{idVendor}=="3434", ATTRS{idProduct}=="0110", MODE="0660", GROUP="users", TAG+="uaccess", TAG+="udev-acl"

With this rule user level processes have complete and full access to every single keyboard output. This single line of code completely invalidates the purpose of this project, on the system it is active on. It is akin to locking the doors of your top down convertible. For security. Am I missing something, or am I doing something wrong? Isn't the whole point of this project to cut access to data about keystrokes that is accessible on VIA HID interface? How does that work if in exchange you give full unrestricted access to any user level process to the main HID interface, the one that sends the actual keycodes to the OS? To me this makes no sense. But again, maybe I did something wrong.

Here's a proper example of how you achieve security with a udev rule, adapted for my vendor/product IDs:

# Block user level access to keyboard output (interface 0)
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="00", MODE="0000"

# Allow access to QMK debug console interface (0xFF31), interface 2
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="02", MODE="0660", GROUP="users", TAG+="uaccess"

# Allow secure Raw HID interface (0xFF60), interface 1
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="01", MODE="0660", GROUP="users", TAG+="uaccess"

This rule properly blocks user level access to main keyboard interface, user level processes have no business accessing that, especially when "keylogger" is mentioned in your documentation.
Second block allows access to 0xFF31 which is a read only HID interface for QMK debug data, this is useful and user is in control on what shows up on that interface.
Last block allows read/write access to 0xFF60 which is the VIA HID interface, used by Vial app, which Vial secures with its QMK patches.

VIA app pulls a similar nasty trick where it actually forces you to install that security nightmare rule on your system or it plain refuses to start otherwise. You either give access to full output of your keyboard either you're not using the app.

Please fix this on Linux.

[gibs2193]

For the curious install hid-tools and run hid-recorder /dev/hidrawX where X is the number of your different interfaces. Run it as user, you will capture all of your keyboard's outputs. As a regular user process.

[xyzz]

it seems the proposed rule cannot filter by the usage page 0xff60 and you'd need to find the target interface id for every keyboard, is that right? in any case i'd propose opening a PR to https://github.com/vial-kb/vial-kb.github.io to add a new section to the linux udev doc and describe how to find the interface id as well as the benefits/downsides of each method (such as the current one being less secure)

[gibs2193]

I didn't test but target interfaces should be the same each time, main one is 0, the one that users shouldn't have access to, 01 should be for 0xFF60 and 02 for QMK debug console. But VIA/debug HID can be treated the same since 0xFF31 is one way only anway.

This could be a 3rd more secure option for the users. You already have two tiers, full access to all hidraw interfaces, full access to keyboard based on vendor/product ID, and this could be a 3rd one for secure setup also based on vendor/product ID.
Not sure if your app can automatically detect the vendor/product ID, you could initially offer the first option so all interfaces are accessible to the app and from the app itself have an option to install a secure version for the udev rule, replacing the fully permissive one?

[gibs2193]

Posting a small python script that I initially posted here: qmk/qmk_firmware#25847

It uses hid in Python:

#!/usr/bin/env python3
import hid
from collections import defaultdict

def print_device(dev):
    """Pretty-print a single device dictionary with all fields."""
    print(f"Path: {dev['path']}")
    print(f"  Vendor ID: 0x{dev['vendor_id']:04X}")
    print(f"  Product ID: 0x{dev['product_id']:04X}")
    print(f"  Manufacturer: {dev.get('manufacturer_string', 'Unknown')}")
    print(f"  Product: {dev.get('product_string', 'Unknown')}")
    print(f"  Serial Number: {dev.get('serial_number', 'Unknown')}")
    print(f"  Usage Page: 0x{dev['usage_page']:04X}")
    print(f"  Usage: 0x{dev['usage']:04X}")
    print(f"  Interface Number: {dev['interface_number']}")
    print(f"  Release Number: {dev['release_number']}")
    print("-" * 60)

def main():
    # Enumerate ALL HID devices on the system
    devices = hid.enumerate()
    
    print(f"\nSearching {len(devices)} HID devices for usage page 0xFF60...\n")
    
    # First pass: find any device with usage page 0xFF60
    target_vendor_id = None
    target_product_id = None
    found_ff60 = False
    
    for device in devices:
        if device['usage_page'] == 0xFF60:
            target_vendor_id = device['vendor_id']
            target_product_id = device['product_id']
            found_ff60 = True
            print(f"*** FOUND USAGE PAGE 0xFF60 ***")
            print(f"*** Target Vendor ID: 0x{target_vendor_id:04X} ***")
            print(f"*** Target Product ID: 0x{target_product_id:04X} ***")
            print()
            break
    
    if not found_ff60:
        print("No device with usage page 0xFF60 found.")
        return
    
    print("="*60)
    print(f"Vendor:0x{target_vendor_id:04X} Product:0x{target_product_id:04X}")
    print("="*60)
    
    # Second pass: show ONLY devices with matching vendor/product ID
    matching_devices = []
    for device in devices:
        if (device['vendor_id'] == target_vendor_id and 
            device['product_id'] == target_product_id):
            matching_devices.append(device)
            print(f"Interface {device['interface_number']}:")
            print(f"  Usage Page: 0x{device['usage_page']:04X}")
            print(f"  Usage: 0x{device['usage']:04X}")
            print(f"  Path: {device['path']}")
            print()
    
    print(f"Total interfaces for 0xFF60 device: {len(matching_devices)}")
    print("="*60)

if __name__ == "__main__":
    main()

This searches all interfaces for usage page 0xFF60 and lists all interfaces for that device. This collects all the necessary info to build a proper udev rule. Only 0xFF60 needs read/write access, and 0xFF31 (QMK Debug) needs read access (if used).

Example output for my setup:

Searching 14 HID devices for usage page 0xFF60...

*** FOUND USAGE PAGE 0xFF60 ***
*** Target Vendor ID: 0x362D ***
*** Target Product ID: 0x0611 ***

============================================================
Vendor:0x362D Product:0x0611
============================================================
Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0002
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0004
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0080
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x000C
  Usage: 0x0001
  Path: b'/dev/hidraw3'

Interface 0:
  Usage Page: 0x0001
  Usage: 0x0006
  Path: b'/dev/hidraw3'

Interface 1:
  Usage Page: 0xFF60
  Usage: 0x0061
  Path: b'/dev/hidraw4'

Total interfaces for 0xFF60 device: 7
============================================================

Main output of keyboard, which the curent Vial udev rule wrongly exposes access to, does not need a udev rule, user access to it is blocked by default.
There is 1 or at most 2 interfaces that need access granted via udev rule, the one using page 0xFF60 for app HID comms, and 0xFF31 for QMK debug (where the case).
So a minimal rule that allows Vial app access would look like this:

# Allow secure Raw HID interface (0xFF60), interface 1
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  ENV{ID_VENDOR_ID}=="362d", ENV{ID_MODEL_ID}=="0611", \
  ENV{ID_USB_INTERFACE_NUM}=="01", MODE="0660", GROUP="users", TAG+="uaccess"

Where VID/PID and interface number are extracted using a similar script as the one above, since it looks for 0xFF60 usage page, and it also finds VID/PID of device with 0xFF60.

[gibs2193]

in any case i'd propose opening a PR to https://github.com/vial-kb/vial-kb.github.io to add a new section to the linux udev doc and describe how to find the interface id as well as the benefits/downsides of each method (such as the current one being less secure)

Can anyone first test this?
pip install hid

#!/usr/bin/env python3
import hid
from collections import defaultdict

USAGE_RULES = {
    0xFF60: {
        "comment": "Allow Raw HID interface (0xFF60)",
        "mode": "0660",
    },
    0xFF31: {
        "comment": "Allow QMK console interface (0xFF31)",
        "mode": "0660",
    },
}

def main():
    devices = hid.enumerate()

    # Collect interfaces by (vendor, product, usage_page)
    matches = defaultdict(list)

    for dev in devices:
        usage_page = dev.get("usage_page")
        if usage_page in USAGE_RULES:
            key = (dev["vendor_id"], dev["product_id"], usage_page)
            matches[key].append(dev)

    if not matches:
        print("# No matching HID interfaces found.")
        return

    for (vendor_id, product_id, usage_page), interfaces in sorted(matches.items()):
        rule = USAGE_RULES[usage_page]

        for dev in sorted(interfaces, key=lambda d: d["interface_number"]):
            iface_num = f"{dev['interface_number']:02d}"

            print(f"# {rule['comment']}, interface {iface_num}")
            print(
                'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \\'
            )
            print(
                f'  ENV{{ID_VENDOR_ID}}=="{vendor_id:04x}", '
                f'ENV{{ID_MODEL_ID}}=="{product_id:04x}", \\'
            )
            print(
                f'  ENV{{ID_USB_INTERFACE_NUM}}=="{iface_num}", '
                f'MODE="{rule["mode"]}", GROUP="users", TAG+="uaccess"\n'
            )

if __name__ == "__main__":
    main()

Spits the udev rule directly, worked for me with just VIA, just QMK debug and both.