Why doesn't plugins/sixaxis.c set devices as Trusted?

Why doesn't plugins/sixaxis.c set devices as Trusted?

[Bastien Nocera]

Hey,

I don't understand the reason why plugins/sixaxis.c doesn't set the
device as trusted when plugged in.

I would expect the Sixaxis plugin to do that, because there's no way to
assert, in the UI, where the device information is coming from to trust
it automatically, and I don't really want to show a "Do you want to
allow device X to connect as a HID device" for devices which weren't
setup in the UI.

For example, I could create a program on another computer with similar
characteristics (same name, class and service UUIDs) which would make
it indistinguishable from the device that was plugged in.

If security was a problem, we probably shouldn't be setting the master
BD address on the pad unless there's a running agent.

So, do we stop setup_device() early if there's no agent running and set
as trusted, or simply always set as trusted?

Cheers

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Alexander Holler]

Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
> Hey,
>
> I don't understand the reason why plugins/sixaxis.c doesn't set the
> device as trusted when plugged in.

It's because of security. If you trust a bluetooth device on Linux, 
you're trusting it for all services. In case of the sixaxis it means 
you're not only trusting it (the BT-MAC) as an input device, but also as 
a network device.

Now if you trust any plugged in device which says it's a sixaxis, I 
would tell my arduino to say it's an sixaxis with a MAC from one of my 
BT-dongles to get a magic device which gives me wireless remote access 
on every linux box with BT when I plug it in once.

That means you want user interaction, besides just plugging in a device.

Alexander Holler

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Bastien Nocera]

On Tue, 2015-07-07 at 06:31 +0200, Alexander Holler wrote:
> Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
> > Hey,
> > 
> > I don't understand the reason why plugins/sixaxis.c doesn't set the
> > device as trusted when plugged in.
> 
> It's because of security. If you trust a bluetooth device on Linux, 
> you're trusting it for all services. In case of the sixaxis it means 
> you're not only trusting it (the BT-MAC) as an input device, but also 
> as 
> a network device.
> 
> Now if you trust any plugged in device which says it's a sixaxis, I 
> would tell my arduino to say it's an sixaxis with a MAC from one of 
> my 
> BT-dongles to get a magic device which gives me wireless remote 
> access 
> on every linux box with BT when I plug it in once.
> 
> That means you want user interaction, besides just plugging in a 
> device.

What should the pairing process look like then? Because the current
workflow is absolutely dreadful.

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Alexander Holler]

Am 07.07.2015 um 07:11 schrieb Bastien Nocera:
> On Tue, 2015-07-07 at 06:31 +0200, Alexander Holler wrote:
>> Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
>>> Hey,
>>>
>>> I don't understand the reason why plugins/sixaxis.c doesn't set the
>>> device as trusted when plugged in.
>>
>> It's because of security. If you trust a bluetooth device on Linux,
>> you're trusting it for all services. In case of the sixaxis it means
>> you're not only trusting it (the BT-MAC) as an input device, but also
>> as
>> a network device.
>>
>> Now if you trust any plugged in device which says it's a sixaxis, I
>> would tell my arduino to say it's an sixaxis with a MAC from one of
>> my
>> BT-dongles to get a magic device which gives me wireless remote
>> access
>> on every linux box with BT when I plug it in once.
>>
>> That means you want user interaction, besides just plugging in a
>> device.
>
> What should the pairing process look like then? Because the current
> workflow is absolutely dreadful.

Pairing is something different than trusting a bluetooth device.

No idea what's your problem. If you remove the necessary user 
interaction to trust a device, you remove the security. Just plugging in 
an (anonymous) usb-device isn't usable as trust.

If Sony decided that's ok for the PS3 (a game console), it's one thing.

But you don't want a wireless remote connected second keyboard or even a 
network device if some just plugged in an anonymous usb-device which 
might even look totally different than as what it presents itself to the 
system.

Alexander Holler

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Alexander Holler]

Am 07.07.2015 um 07:34 schrieb Alexander Holler:
> Am 07.07.2015 um 07:11 schrieb Bastien Nocera:
>> On Tue, 2015-07-07 at 06:31 +0200, Alexander Holler wrote:
>>> Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
>>>> Hey,
>>>>
>>>> I don't understand the reason why plugins/sixaxis.c doesn't set the
>>>> device as trusted when plugged in.
>>>
>>> It's because of security. If you trust a bluetooth device on Linux,
>>> you're trusting it for all services. In case of the sixaxis it means
>>> you're not only trusting it (the BT-MAC) as an input device, but also
>>> as
>>> a network device.
>>>
>>> Now if you trust any plugged in device which says it's a sixaxis, I
>>> would tell my arduino to say it's an sixaxis with a MAC from one of
>>> my
>>> BT-dongles to get a magic device which gives me wireless remote
>>> access
>>> on every linux box with BT when I plug it in once.
>>>
>>> That means you want user interaction, besides just plugging in a
>>> device.
>>
>> What should the pairing process look like then? Because the current
>> workflow is absolutely dreadful.
>
> Pairing is something different than trusting a bluetooth device.
>
> No idea what's your problem. If you remove the necessary user
> interaction to trust a device, you remove the security. Just plugging in
> an (anonymous) usb-device isn't usable as trust.
>
> If Sony decided that's ok for the PS3 (a game console), it's one thing.
>
> But you don't want a wireless remote connected second keyboard or even a
> network device if some just plugged in an anonymous usb-device which
> might even look totally different than as what it presents itself to the
> system.

Just to say it in more clear words. The trust you wanted to give 
automatically does not disappear when the the plugged in device will be 
removed. And furthermore the trust is for a different, wireless 
connected, device, you don't see if you examine the computer.

That's why there is absolutely a need to make the user aware that he is 
going to trust a wireless device.

Alexander Holler

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Bastien Nocera]

On Tue, 2015-07-07 at 07:11 +0200, Bastien Nocera wrote:
> On Tue, 2015-07-07 at 06:31 +0200, Alexander Holler wrote:
> > Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
> > > Hey,
> > > 
> > > I don't understand the reason why plugins/sixaxis.c doesn't set 
> > > the
> > > device as trusted when plugged in.
> > 
> > It's because of security. If you trust a bluetooth device on Linux, 
> > 
> > you're trusting it for all services. In case of the sixaxis it 
> > means 
> > you're not only trusting it (the BT-MAC) as an input device, but 
> > also 
> > as 
> > a network device.
> > 
> > Now if you trust any plugged in device which says it's a sixaxis, I 
> > 
> > would tell my arduino to say it's an sixaxis with a MAC from one of 
> > 
> > my 
> > BT-dongles to get a magic device which gives me wireless remote 
> > access 
> > on every linux box with BT when I plug it in once.
> > 
> > That means you want user interaction, besides just plugging in a 
> > device.
> 
> What should the pairing process look like then? Because the current
> workflow is absolutely dreadful.

To solve that problem, I would:
1) disable the pairing altogether if there's no agent running
2) request auth to connect to the computer when the device is getting
plugged in, not X minutes later when you want to start using the joypad
wirelessly

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Harald Schmitt]

Am 07.07.2015 um 06:31 schrieb Alexander Holler:
> Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
>> Hey,
>>
>> I don't understand the reason why plugins/sixaxis.c doesn't set the
>> device as trusted when plugged in.
>
> It's because of security. If you trust a bluetooth device on Linux,
> you're trusting it for all services.
Just as a side note: This is not a good security rule. Why should I 
trust a game controller on any other service then controlling my game moves?


Best regrads,
Harald

Re: Why doesn't plugins/sixaxis.c set devices as Trusted?

[Alexander Holler]

Am 07.07.2015 um 16:16 schrieb Harald Schmitt:
> Am 07.07.2015 um 06:31 schrieb Alexander Holler:
>> Am 06.07.2015 um 15:17 schrieb Bastien Nocera:
>>> Hey,
>>>
>>> I don't understand the reason why plugins/sixaxis.c doesn't set the
>>> device as trusted when plugged in.
>>
>> It's because of security. If you trust a bluetooth device on Linux,
>> you're trusting it for all services.
> Just as a side note: This is not a good security rule. Why should I
> trust a game controller on any other service then controlling my game
> moves?

Also differentiating a network service from an input service wouldn't be 
that hard (at least at OS level), it won't help much in regard to the 
topic because you can't really differentiate a gamepad from a keyboard 
(both are HID input devices).

And you just don't want to automatically enable (trust) a (wireless) 
remote input (especially a keyboard) if someone managed it to plug in 
some USB device into your Linux box without any user interaction.

Regards,

Alexander Holler