I would like to control permissions to use sound card. There are devices "/dev/snd/*", the owner is "root", group is "audio", permissions "660". So, I would expect only users in "audio" group could use sound card, however it doesn't work. I have a user "u1" which is not in group "audio", however he has access! I've found out that the access is controlled with ACL, so getfacl shows the following:

# file: timer
# owner: root
# group: audio
# flags: --t

The line "user:u1:rw-" magically appears again even if I remove it with setfacl.

For me it looks like that there is a root-owned process which automatically adds permissions to any user ignoring "audio" group membership.

Why is the access granted? How to revoke access to sound card for a user?

  • Does the same happens with 13.10 or 14.04? – Braiam Apr 14 '14 at 2:17
  • @Braiam I have 13.04 (why have you deleted the tag??), I don't have other versions around, but maybe I'll try to update to 13.10 and check if it helps, but it would take some time to upgrade. – kan Apr 14 '14 at 12:30
  • 1
    Because 13.04 is EOL and is not longer supported. This issue may very well be fixed in later releases without intervention of your part. – Braiam Apr 14 '14 at 16:07
  • You may be able to get around this by having a different user take ownership, but I see a problem as the system is going to be in control of this, as it is a device. You may have to remove access, versus denying access. I am not sure how helpful this is... – No Time Apr 18 '14 at 5:59
  • 1
    I suggest you check /lib/udev/rules.d/60-persistant-alsa-rules, 78-soundcard.rules and so on. – xiaodongjie Apr 18 '14 at 10:27

Check System

To enable ACL, the filesystem must be mounted with the acl option.
It is very likely that the ACL option is already active as default mount option of your filesystem.
Check typing (replace sdXY with correct partition):

sudo tune2fs -l /dev/sdXY | grep "Default mount options"

the output should be something like:

Default mount options:    user_xattr acl

also check that the default mount option is not overridden, in such case you will see noacl in /proc/mounts in the relevant line. Type:

sudo cat /proc/mounts | grep noacl

If you need, you can set the default mount options of a filesystem using the tune2fs -o option partition command, for example:

 tune2fs -o acl /dev/sdXY

Using ACL:

to modify ACL use setfacl:

setfacl -m "u:username:permissions


setfacl -m "u:uid:permissions

for example, to revoke access to sound card for a user, type:

setfacl -m "u:u1:---" /dev/snd/controlC0 

You can easily try if it works, putting playing an audio track and then executing the command: if the sound is interrupted, the command has been executed

You can also check if the permissions have been changed with:

getfacl /dev/snd/controlC0 ( Control Interface /dev/snd/controlCX )

Refer to manual man acl and man setfacl for more options.

  • Yes, I've tried setfacl, it works, permissions are revoked, but suddenly after some time (cannot figure out exact moment when) permissions user:u1:rw- are changed somehow magically back and sound card works for user the again. – kan Apr 11 '14 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.