From 7f56928d25fb87f4643685dce3536fdacce201eb Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Tue, 16 May 2017 17:51:48 -0400 Subject: [PATCH] add toggle for disabling newly added USB devices Based on the public grsecurity patches. Change-Id: I2cbea91b351cda7d098f4e1aa73dff1acbd23cce Signed-off-by: Daniel Micay --- drivers/usb/core/hub.c | 8 ++++++++ kernel/sysctl.c | 14 ++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index ed408f40017f..6e294d839e81 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -44,6 +44,8 @@ #define USB_TP_TRANSMISSION_DELAY 40 /* ns */ #define USB_TP_TRANSMISSION_DELAY_MAX 65535 /* ns */ +int deny_new_usb __read_mostly = 0; + /* Protect struct usb_device->state and ->children members * Note: Both are also protected by ->dev.sem, except that ->state can * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */ @@ -4980,6 +4982,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, goto done; return; } + + if (deny_new_usb) { + dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1); + goto done; + } + if (hub_is_superspeed(hub->hdev)) unit_load = 150; else diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 9557c2175aca..50015d24c5c5 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -100,6 +100,9 @@ #if defined(CONFIG_SYSCTL) /* External variables not in a header file. */ +#ifdef CONFIG_USB +extern int deny_new_usb; +#endif extern int suid_dumpable; #ifdef CONFIG_COREDUMP extern int core_uses_pid; @@ -1189,6 +1192,17 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &two, }, +#endif +#ifdef CONFIG_USB + { + .procname = "deny_new_usb", + .data = &deny_new_usb, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &one, + }, #endif { .procname = "ngroups_max",