Should unprivileged LXCs be able to see all USB ports?

[triple07]

So I'm currently on a mission to add a NUT server to my proxmox homelab but I don't like installing packages directly on the host. So I looked into USB passthrough to an unprivileged LXC only to find that my LXC can already see all the USB devices attached via the command lsusb.

Is this normal behavior for VE? I would have figured that an unpriviledged LXC would not be able to access USB devices unless specifically allowed. Is this an issue with my configuration?

For reference here is what I get when I run lsusb on the host:

root@homelab0:~# lsusb
Bus 009 Device 003: ID 0764:0601 Cyber Power System, Inc. PR1500LCDRT2U UPS
Bus 009 Device 004: ID 1d6b:0104 Linux Foundation Multifunction Composite Gadget
Bus 009 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub
Bus 009 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 010 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 008 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 007 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 006 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 004: ID 13d3:3586 IMC Networks Bluetooth Radio
Bus 003 Device 003: ID 048d:5702 Integrated Technology Express, Inc. RGB LED Controller
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

And here is what I get when running it in an unprivileged Ubuntu LXC:

root@test:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 003 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 003 Device 003: ID 048d:5702 Integrated Technology Express, Inc. RGB LED Controller
Bus 003 Device 004: ID 13d3:3586 IMC Networks Bluetooth Radio
Bus 004 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 005 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 006 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 007 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 008 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 009 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 009 Device 002: ID 05e3:0608 Genesys Logic, Inc. Hub
Bus 009 Device 003: ID 0764:0601 Cyber Power System, Inc. PR1500LCDRT2U UPS
Bus 009 Device 004: ID 1d6b:0104 Linux Foundation Multifunction Composite Gadget
Bus 010 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub

 

[fschauer]

This is expected. lsusb reads the USB device list out of the sysfs which is mounted into the container. But you cannot actually access the USB device without explicitly allowing it and adding a device node via device passthrough.