fix(ethercat): restrict master device access

script/ethercat/start_ethercat.sh

@@ -20,6 +20,7 @@ Environment:
   IGH_ROOT=...                 Override bundled IgH install path.
   ETHERCAT_CONF=...            Override ethercatctl config path.
   ETHERCAT_DEV=/dev/EtherCAT0  Override EtherCAT character device node.
+  ETHERCAT_GROUP=plugdev       Group allowed to access the character device.
   START_WAIT_SEC=5             Seconds to wait for link/slave discovery.
 USAGE
 }
@@ -36,6 +37,7 @@ fi
 
 IFACE="${IFACE:-eno1}"
 ETHERCAT_DEV="${ETHERCAT_DEV:-/dev/EtherCAT0}"
+ETHERCAT_GROUP="${ETHERCAT_GROUP:-plugdev}"
 START_WAIT_SEC="${START_WAIT_SEC:-5}"
 
 NON_NUMERIC_ARG_COUNT=0
@@ -117,7 +119,8 @@ ip link set "${IFACE}" up
 "${ETHERCATCTL}" -c "${ETHERCAT_CONF}" start
 
 if [[ -e "${ETHERCAT_DEV}" ]]; then
-  chmod 666 "${ETHERCAT_DEV}"
+  chgrp "${ETHERCAT_GROUP}" "${ETHERCAT_DEV}"
+  chmod 660 "${ETHERCAT_DEV}"
 else
   echo "warning: ${ETHERCAT_DEV} not found; skip chmod. Check with: ls -l /dev/EtherCAT*" >&2
 fi