LXC USB Passthrough

[otter90]

Dear community,
i am new to this forum and to Proxmox. I have started to use Proxmox some weeks ago, comming from a simple Raspberry installation for my home automation and some other apps.
I have setup a VM for my FHEM home automation with two USB devices (CUL and Homematic HM-CFG-USB). Further some LXC for Weatherstation, Cups and so on.
Setting up the LXCs I faced the usual issues with passing through the USB devices:
a) USB devices are changing their IDs when rebooting.
b) /dev/bus/usb/001/00x have "Nobody/Nogroup" owner in the containers.
Because I have only very basic Linux knowledge I tried to find solutions by gooling in very helpful communities and forums like this. Allthough thousends of postings for these kind of issues exist, I did not find a solution that fits for me. After hours of googling, testing and frustration Ifound the following solution for me:
My Solution for a) Instead of mounting only the one device that I need in the respective container I mounted the whole directory, so that all devices are available in all containers. The devices that are additionally passthroud' to my VM are still working:
lxc.cgroup.devices.allow: c 189:* rwm
lxc.mount.entry: /dev/bus/usb/001 dev/bus/usb/001 none bind,optional,create=dir
My Solution for b) I defined an udev rule, that sets the owner/group to 100000:100000 for all USB devices:
SUBSYSTEM=="usb", OWNER="100000", GROUP="100000"
The combination of solution a) and b) seems to be working very well in my case, but I am not sure if this is an appropriate solution that will work long term without any side effects. Can someone please have a look? Maybe this is also an inspiration for others with the same challenge around passing through USB to LXcs.
Thank you very much !
Jens

 

[Stefan_R]

For a): As long as you know which physical ports correspond to bus 001 and you only plug in devices that you actually want to pass through, this is a perfectly valid solution.

For b): It's technically fine and shouldn't break, however, assigning the CT's user to all USB devices might cause security issues or other problems for the host. When you say your USB devices "change IDs when rebooting", are you talking about their /dev/bus/... paths or the vendor/product IDs? The latter should be constant, you can see them when running 'lsusb' (ID xxxx:xxxx in hex numbers, that's vendor:product respectively). Then you could filter those in your UDEV rules (e.g. ATTRS{idVendor}=="abcd", ATTRS{idProduct}=="1234")

 

[otter90]

Thanks for the quick response.
a) Core of my solution is to pass all devices to all containers because i do not know which device number will be assigned to the required device. Obviously it is working, because all devices work where they should (container or VM).
b) You are right. By using vendor- and product ID i could be more specific when assigning group/owner. I will improve that.