authorization.rst 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132
  1. ==============================================================
  2. Authorizing (or not) your USB devices to connect to the system
  3. ==============================================================
  4. Copyright (C) 2007 Inaky Perez-Gonzalez <inaky@linux.intel.com> Intel Corporation
  5. This feature allows you to control if a USB device can be used (or
  6. not) in a system. This feature will allow you to implement a lock-down
  7. of USB devices, fully controlled by user space.
  8. As of now, when a USB device is connected it is configured and
  9. its interfaces are immediately made available to the users. With this
  10. modification, only if root authorizes the device to be configured will
  11. then it be possible to use it.
  12. Usage
  13. =====
  14. Authorize a device to connect::
  15. $ echo 1 > /sys/bus/usb/devices/DEVICE/authorized
  16. De-authorize a device::
  17. $ echo 0 > /sys/bus/usb/devices/DEVICE/authorized
  18. Set new devices connected to hostX to be deauthorized by default (ie:
  19. lock down)::
  20. $ echo 0 > /sys/bus/usb/devices/usbX/authorized_default
  21. Remove the lock down::
  22. $ echo 1 > /sys/bus/usb/devices/usbX/authorized_default
  23. By default, Wired USB devices are authorized by default to
  24. connect. Wireless USB hosts deauthorize by default all new connected
  25. devices (this is so because we need to do an authentication phase
  26. before authorizing). Writing "2" to the authorized_default attribute
  27. causes kernel to only authorize by default devices connected to internal
  28. USB ports.
  29. Example system lockdown (lame)
  30. ------------------------------
  31. Imagine you want to implement a lockdown so only devices of type XYZ
  32. can be connected (for example, it is a kiosk machine with a visible
  33. USB port)::
  34. boot up
  35. rc.local ->
  36. for host in /sys/bus/usb/devices/usb*
  37. do
  38. echo 0 > $host/authorized_default
  39. done
  40. Hookup an script to udev, for new USB devices::
  41. if device_is_my_type $DEV
  42. then
  43. echo 1 > $device_path/authorized
  44. done
  45. Now, device_is_my_type() is where the juice for a lockdown is. Just
  46. checking if the class, type and protocol match something is the worse
  47. security verification you can make (or the best, for someone willing
  48. to break it). If you need something secure, use crypto and Certificate
  49. Authentication or stuff like that. Something simple for an storage key
  50. could be::
  51. function device_is_my_type()
  52. {
  53. echo 1 > authorized # temporarily authorize it
  54. # FIXME: make sure none can mount it
  55. mount DEVICENODE /mntpoint
  56. sum=$(md5sum /mntpoint/.signature)
  57. if [ $sum = $(cat /etc/lockdown/keysum) ]
  58. then
  59. echo "We are good, connected"
  60. umount /mntpoint
  61. # Other stuff so others can use it
  62. else
  63. echo 0 > authorized
  64. fi
  65. }
  66. Of course, this is lame, you'd want to do a real certificate
  67. verification stuff with PKI, so you don't depend on a shared secret,
  68. etc, but you get the idea. Anybody with access to a device gadget kit
  69. can fake descriptors and device info. Don't trust that. You are
  70. welcome.
  71. Interface authorization
  72. -----------------------
  73. There is a similar approach to allow or deny specific USB interfaces.
  74. That allows to block only a subset of an USB device.
  75. Authorize an interface::
  76. $ echo 1 > /sys/bus/usb/devices/INTERFACE/authorized
  77. Deauthorize an interface::
  78. $ echo 0 > /sys/bus/usb/devices/INTERFACE/authorized
  79. The default value for new interfaces
  80. on a particular USB bus can be changed, too.
  81. Allow interfaces per default::
  82. $ echo 1 > /sys/bus/usb/devices/usbX/interface_authorized_default
  83. Deny interfaces per default::
  84. $ echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default
  85. Per default the interface_authorized_default bit is 1.
  86. So all interfaces would authorized per default.
  87. Note:
  88. If a deauthorized interface will be authorized so the driver probing must
  89. be triggered manually by writing INTERFACE to /sys/bus/usb/drivers_probe
  90. For drivers that need multiple interfaces all needed interfaces should be
  91. authorized first. After that the drivers should be probed.
  92. This avoids side effects.