linux-kernel - Re: [PATCH] usb: core: Make default authorization mode configurable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2024010413-portable-lingo-3c11@gregkh>
Date: Thu, 4 Jan 2024 17:41:55 +0100
From: Greg KH <gregkh@...uxfoundation.org>
To: niko.mauno@...sala.com
Cc: linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: core: Make default authorization mode configurable

On Thu, Jan 04, 2024 at 06:32:03PM +0200, niko.mauno@...sala.com wrote:
> From: Niko Mauno <niko.mauno@...sala.com>
> 
> Make the default USB device authorization mode configurable at build
> time. This is useful for systems that require a mode that is stricter
> than the standard setting, as it avoids relying on the kernel command
> line being properly set.
> 
> Signed-off-by: Niko Mauno <niko.mauno@...sala.com>
> ---
>  drivers/usb/core/Kconfig | 15 +++++++++++++++
>  drivers/usb/core/hcd.c   |  2 +-
>  2 files changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
> index 351ede4b5de2..10ad320cc2f3 100644
> --- a/drivers/usb/core/Kconfig
> +++ b/drivers/usb/core/Kconfig
> @@ -116,3 +116,18 @@ config USB_AUTOSUSPEND_DELAY
>  	  The default value Linux has always had is 2 seconds.  Change
>  	  this value if you want a different delay and cannot modify
>  	  the command line or module parameter.
> +
> +config USB_DEFAULT_AUTHORIZATION_MODE
> +	int "Default authorization mode for USB devices"
> +	range -1 2
> +	default -1
> +	depends on USB
> +	help
> +	  Select the default USB device authorization mode. Can be overridden
> +	  with usbcore.authorized_default command line or module parameter.
> +
> +	  The available values have the following meanings:
> +		-1 is authorized for all devices (leftover from wireless USB)
> +		0 is unauthorized for all devices
> +		1 is authorized for all devices

What's the difference now between -1 and 1?  We don't have wireless USB
anymore as that never turned into an actual product, so we shouldn't
reference it anymore, right?

We should get rid of the -1 option entirely, but keep the module option
and properly map it to '1'.


> +		2 is authorized for internal devices

Needs a "if you don't know what to select, please choose X" text here.

thanks,

greg k-h