From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Mon, 12 Jun 2017 21:38:26 +0200 From: Greg Kroah-Hartman Message-ID: <20170612193826.GA4235@kroah.com> References: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> Subject: [kernel-hardening] Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook To: Salvatore Mesoraca Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" , linux-usb@vger.kernel.org List-ID: On Mon, Jun 12, 2017 at 06:56:52PM +0200, Salvatore Mesoraca wrote: > Creation of a new LSM hook that can be used to authorize or deauthorize > new USB devices via the usb authorization interface. > The same hook can also prevent the authorization of a USB device via > "/sys/bus/usb/devices/DEVICE/authorized". > Using this hook an LSM could provide an higher level of granularity > than the current authorization interface. > > Signed-off-by: Salvatore Mesoraca > Cc: linux-usb@vger.kernel.org > Cc: Greg Kroah-Hartman No, like Krzysztof said, you can already do this today, just fine, from userspace. I think that support has been there for over a decade now, why are you not taking advantage of this already? No need to add extra stuff to the kernel at all to do this, sorry you implemented all of this for no reason :( greg k-h From mboxrd@z Thu Jan 1 00:00:00 1970 From: gregkh@linuxfoundation.org (Greg Kroah-Hartman) Date: Mon, 12 Jun 2017 21:38:26 +0200 Subject: [PATCH 03/11] Creation of "usb_device_auth" LSM hook In-Reply-To: <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> References: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> Message-ID: <20170612193826.GA4235@kroah.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Mon, Jun 12, 2017 at 06:56:52PM +0200, Salvatore Mesoraca wrote: > Creation of a new LSM hook that can be used to authorize or deauthorize > new USB devices via the usb authorization interface. > The same hook can also prevent the authorization of a USB device via > "/sys/bus/usb/devices/DEVICE/authorized". > Using this hook an LSM could provide an higher level of granularity > than the current authorization interface. > > Signed-off-by: Salvatore Mesoraca > Cc: linux-usb at vger.kernel.org > Cc: Greg Kroah-Hartman No, like Krzysztof said, you can already do this today, just fine, from userspace. I think that support has been there for over a decade now, why are you not taking advantage of this already? No need to add extra stuff to the kernel at all to do this, sorry you implemented all of this for no reason :( greg k-h -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752626AbdFLTii (ORCPT ); Mon, 12 Jun 2017 15:38:38 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:55596 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752207AbdFLTif (ORCPT ); Mon, 12 Jun 2017 15:38:35 -0400 Date: Mon, 12 Jun 2017 21:38:26 +0200 From: Greg Kroah-Hartman To: Salvatore Mesoraca Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" , linux-usb@vger.kernel.org Subject: Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Message-ID: <20170612193826.GA4235@kroah.com> References: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1497286620-15027-4-git-send-email-s.mesoraca16@gmail.com> User-Agent: Mutt/1.8.3 (2017-05-23) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jun 12, 2017 at 06:56:52PM +0200, Salvatore Mesoraca wrote: > Creation of a new LSM hook that can be used to authorize or deauthorize > new USB devices via the usb authorization interface. > The same hook can also prevent the authorization of a USB device via > "/sys/bus/usb/devices/DEVICE/authorized". > Using this hook an LSM could provide an higher level of granularity > than the current authorization interface. > > Signed-off-by: Salvatore Mesoraca > Cc: linux-usb@vger.kernel.org > Cc: Greg Kroah-Hartman No, like Krzysztof said, you can already do this today, just fine, from userspace. I think that support has been there for over a decade now, why are you not taking advantage of this already? No need to add extra stuff to the kernel at all to do this, sorry you implemented all of this for no reason :( greg k-h