[Suggestion] Avoid adding the user to input group on Linux

[kodemeister]

Sunshine docs currently suggest to add the user to input group in order to gain access to Sunshine's virtual input devices. This is generally insecure and not recommended. Rather than adding the user to input group, it would be better to grant access only to specific Sunshine devices based on their vendor/product ID.

Valve already does this in their steam-devices repo. They basically provide udev rules to automatically grant access to certain known devices using uaccess tag. For example, an udev rule for PS5 DualSense looks like this:

# PS5 DualSense controller over USB hidraw
KERNEL=="hidraw*", ATTRS{idVendor}=="054c", ATTRS{idProduct}=="0ce6", MODE="0660", TAG+="uaccess"

I'm thinking about doing something similar for Sunshine virtual devices. Looking at input.cpp, each device has its own product/vendor ID. What about the following udev rules?

# Sunshine Keyboard
KERNEL=="uinput", ATTRS{idVendor}=="BEEF", ATTRS{idProduct}=="DEAD", MODE="0660", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Sunshine Mouse
KERNEL=="uinput", ATTRS{idVendor}=="046D", ATTRS{idProduct}=="4038", MODE="0660", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Sunshine Touch
KERNEL=="uinput", ATTRS{idVendor}=="BEEF", ATTRS{idProduct}=="DEAD", MODE="0660", OPTIONS+="static_node=uinput", TAG+="uaccess"

# Sunshine Gamepad
KERNEL=="uinput", ATTRS{idVendor}=="045E", ATTRS{idProduct}=="028E", MODE="0660", OPTIONS+="static_node=uinput", TAG+="uaccess"

(Of course, 0xDEADBEEF should be replaced to something less dummy 😄 )

This would also simplify Linux setup a bit. The users will only need to install udev rules instead of installing udev rules AND adding themselves to input group. The fewer steps, the better.

[ReenigneArcher]

Thanks for opening this suggestion. Since you have a pretty good grasp on this, I would suggest that you submit a PR with your suggestions.

[kodemeister]

Done! Please check #1127. After playing a bit with udev rules, I actually realized that usage of ATTRS{idVendor} and ATTRS{idProduct} is not necessary. It is enough to set up permissions for single device /dev/uinput. Unlike physical USB devices, uinput doesn't need per-device configuration.