[kernel-hardening] Re: [PATCH] Allow userspace control of runtime disabling/enabling of driver probing

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Jan 04, 2017 at 12:31:45PM -0600, Matthew Garrett wrote:
> On Wed, Jan 4, 2017 at 12:10 PM, Matthew Garrett <mjg59@coreos.com> wrote:
> >
> > The USB authentication feature was intended for handling wireless USB
> > devices - it can be reused for this, but the code isn't generic enough
> > to apply to other bus types. The two interact in exactly the way you'd
> > expect, ie they don't. If you use both, then you need to handle both.
> 
> And as an example of why the USB authorisation feature isn't
> sufficient - the interface configuration isn't picked until after
> you've authorised the device, which means you can't necessarily tell
> the difference between a keyboard and an ethernet adapter until after
> you've authorised it.

You know the device type and vendor/product id before you authorize it,
you should be able to do this type of detection otherwise it seems
pretty pointless :)

> That defeats the object, but it can't be changed without breaking the
> wireless USB case.

No one has wireless USB devices, this all works the same for any USB
device :)

thanks,

greg k-h