Include all DMA-vulnerable controllers (FireWire, Thunderbolt, etc.) in sys-usb (or a separate domain)

[andrewdavidwong]

Since FireWire, Thunderbolt, PC Card, ExpressCard, PCI, PCI-X, etc. are all potentially vulnerable to DMA attacks, we should consider isolating those controllers in the default sys-usb, or a separate domain, by default (if the user chooses this option during installation).

---

Related issues:

#1743

[marmarek]

For all the devices which appears as new PCI (at least PC Card and ExpressCard), we have disabled hotplug support by default: #1673
It doesn't fully solve the problem, but largely limit its scope. Some malicious device still could be plugged in before user power on the machine. Require device being small enough to be unnoticed, but this isn't hard to achieve.

[marmarek]

For all the devices which appears as new PCI (at least PC Card and ExpressCard), we have disabled hotplug support by default: #1673
It doesn't fully solve the problem, but largely limit its scope. Some malicious device still could be plugged in before user power on the machine. Require device being small enough to be unnoticed, but this isn't hard to achieve.

[euidzero]

Can't thunderbolt security levels be used to allow hotpluging of trusted devices ?
https://christian.kellner.me/2017/12/14/introducing-bolt-thunderbolt-3-security-levels-for-gnulinux/

[euidzero]

Can't thunderbolt security levels be used to allow hotpluging of trusted devices ?
https://christian.kellner.me/2017/12/14/introducing-bolt-thunderbolt-3-security-levels-for-gnulinux/