kernel-hardening - Re: [PATCH] Allow userspace control of runtime disabling/enabling of driver probing

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPeXnHsd_W4zKBDrn5jpLSi_VjzW+2O6znqs4zGeJhOt5USRYQ@mail.gmail.com>
Date: Wed, 4 Jan 2017 15:53:19 -0600
From: Matthew Garrett <mjg59@...eos.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Kees Cook <keescook@...omium.org>, 
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, "Rafael J. Wysocki" <rjw@...ysocki.net>, 
	Len Brown <len.brown@...el.com>, Pavel Machek <pavel@....cz>, Ulf Hansson <ulf.hansson@...aro.org>, 
	Mauro Carvalho Chehab <mchehab@...nel.org>, Tomeu Vizoso <tomeu.vizoso@...labora.com>, 
	Lukas Wunner <lukas@...ner.de>, Madalin Bucur <madalin.bucur@....com>, 
	Sudip Mukherjee <sudipm.mukherjee@...il.com>, Rasmus Villemoes <linux@...musvillemoes.dk>, 
	Arnd Bergmann <arnd@...db.de>, Andrew Morton <akpm@...ux-foundation.org>, 
	Russell King <rmk+kernel@....linux.org.uk>, Petr Tesarik <ptesarik@...e.com>, 
	linux-pm@...r.kernel.org, kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH] Allow userspace control of runtime disabling/enabling of
 driver probing

Ugh let's try that again in plain text (How does the Android gmail
client still not get this right‽)

On Wed, Jan 4, 2017 at 2:47 PM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> On Wed, Jan 04, 2017 at 02:01:00PM -0600, Matthew Garrett wrote:
>> On Wed, Jan 4, 2017 at 1:47 PM, Greg Kroah-Hartman
>> <gregkh@...uxfoundation.org> wrote:
>> > You know the device type and vendor/product id before you authorize it,
>> > you should be able to do this type of detection otherwise it seems
>> > pretty pointless :)
>>
>> You know the vendor and product ID, which doesn't tell you whether one
>> of the endpoints is a network device or a keyboard. You need to know
>> that.
>
> Are you sure you don't have the configuration information as well?  That
> should tell you...

usb_choose_configuration() hasn't been called at this point, so no -
we don't create any device entries, so there's no way for userspace to
know anything (there isn't even a uevent on device plug). And even if
you could scrape the info, you still have no way of knowing what
configuration the kernel will choose if the device has multiple.

> And for network devices, they are almost all just vendor/product ids,
> not many use the class protocol.

Plenty of stuff uses CDC.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.