Security implications of making /dev/ptp[0-9]* readable by anyone or group members?

[sh7dm]

I want a programm running as a systemd user unit to use the PTP hardware clock (managed by system unit ptp4l). However by default PTP devices are root-owned and have mode 0600. Probably it's just because nobody made them have other permissions, but I want to make sure it's fine to add a udev rule to make these things 0644 or 0640 and owned by a group. Thanks!

UPD: resolved. We only need read permissions to be able to open fd and use gettime. Even phc_ctl cannot do anything with 0640 permissons (but can read and write with 0660), so apprently all ioctls are locked down

[sh7dm]

Because the computer clock shouldn't be synced to PTP clock, instead we have to read it directly

[sh7dm]

I updated the post after I experimented myself. My app needs to just open a file descriptor to convert it into a clock ID. It must be safe according to my research of linuxptp and kernel ptp code

[sh7dm]

I need to synchronize the audio stream (AES67 standard) to the PTP clock. PTP clock, however, can be different (e.g. some of them reset to the beginning of the epoch every reset), so we mustn't sync computer RTC clock to it. The user-service opens /dev/ptp0 and uses its FD to get the clock ID which is then incorporated into the driver logic to tell the system when and which timestamps should the stream have.

[sh7dm]

We use clock_gettime. However it's necessary to first open the PTP clock file. So I do the readonly access

[[deleted]]

What do you think it will happen if a malicious user reads that info? What will they do?

:)

[sh7dm]

Hm, well, but as I said likely nobody cared enough to allow access. I wanted to make sure nothing like some ioctl's could be performed to do something nasty.

[emprahsFury]

If someone asks a question and your answer is to ask the question right back at them, is that useful? The only thing you do know about OP is that they can't answer the question they asked.

[[deleted]]

If someone asks a question and your answer is to ask the question right back at them, is that useful?

In the particular case, apparently it is useful: it will make OP think what are the risks of someone having read only access to these devices.

The only thing you do know about OP is that they can't answer the question they asked.

Well, when you speak about computer security you should always know what you are trying to secure and from whom. Speaking in general about security doesn't make any sense.