linux-kernel - Re: [PATCH 04/11] S.A.R.A. USB Filtering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJHCu1KujgnTsyRBRCk2LXFFdRZKWVRHmdV3nPPiUanXsLq=sg@mail.gmail.com>
Date:   Tue, 20 Jun 2017 09:53:37 +0200
From:   Salvatore Mesoraca <s.mesoraca16@...il.com>
To:     Pavel Machek <pavel@....cz>
Cc:     kernel list <linux-kernel@...r.kernel.org>,
        linux-security-module@...r.kernel.org,
        Kernel Hardening <kernel-hardening@...ts.openwall.com>,
        Brad Spengler <spender@...ecurity.net>,
        PaX Team <pageexec@...email.hu>,
        Casey Schaufler <casey@...aufler-ca.com>,
        Kees Cook <keescook@...omium.org>,
        James Morris <james.l.morris@...cle.com>,
        "Serge E. Hallyn" <serge@...lyn.com>
Subject: Re: [PATCH 04/11] S.A.R.A. USB Filtering

2017-06-20 9:07 GMT+02:00 Pavel Machek <pavel@....cz>:
> Hmm. Given that USB device provides vendor id/product id, this does
> not really stop anyone, right?
>
> AFAICT you can still get USB stick with vid/pid of logitech keyboard,
> and kernel will recognize it as a usb stick.

There are a number of ways by which a device can be assigned to a driver.
vid/pid is the most common for the most esoteric devices: i.e. less used/most
dangerous.
However you are right, a final version of this feature should have included
"interface matching" too and even something much more specific like serial
matching.
Anyway, because of lack of interest in having this feature included in kernel
space (something similar can already be done in user-space) it has been
abandoned.
You are answering to an old version of S.A.R.A. that can now be considered
obsolete.
Thank you anyway for your comment.

Salvatore