Permalink
Browse files

add toggle for disabling newly added USB devices

Based on the public grsecurity patches.

Note: not for submission upstream and may be removed once CopperheadOS
is migrated to another mechanism for this.

Signed-off-by: Daniel Micay <danielmicay@gmail.com>
  • Loading branch information...
thestinger committed May 16, 2017
1 parent 67d0645 commit 96dc427ab60d28129b36362e1577b6673b0ba5c4
Showing with 23 additions and 0 deletions.
  1. +8 −0 drivers/usb/core/hub.c
  2. +15 −0 kernel/sysctl.c
@@ -38,6 +38,8 @@
#define USB_VENDOR_GENESYS_LOGIC 0x05e3
#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01
extern int deny_new_usb;
/* Protect struct usb_device->state and ->children members
* Note: Both are also protected by ->dev.sem, except that ->state can
* change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */
@@ -4806,6 +4808,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
goto done;
return;
}
if (deny_new_usb) {
dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
goto done;
}
if (hub_is_superspeed(hub->hdev))
unit_load = 150;
else
@@ -99,6 +99,10 @@
#if defined(CONFIG_SYSCTL)
/* External variables not in a header file. */
#if IS_ENABLED(CONFIG_USB)
int deny_new_usb __read_mostly = 0;
EXPORT_SYMBOL(deny_new_usb);
#endif
extern int suid_dumpable;
#ifdef CONFIG_COREDUMP
extern int core_uses_pid;
@@ -890,6 +894,17 @@ static struct ctl_table kern_table[] = {
.extra1 = &zero,
.extra2 = &one,
},
#if IS_ENABLED(CONFIG_USB)
{
.procname = "deny_new_usb",
.data = &deny_new_usb,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec_minmax_sysadmin,
.extra1 = &zero,
.extra2 = &one,
},
#endif
{
.procname = "ngroups_max",
.data = &ngroups_max,

0 comments on commit 96dc427

Please sign in to comment.