From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A40CAC433E2 for ; Wed, 1 Jul 2020 08:47:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8951B20747 for ; Wed, 1 Jul 2020 08:47:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728845AbgGAIry (ORCPT ); Wed, 1 Jul 2020 04:47:54 -0400 Received: from jabberwock.ucw.cz ([46.255.230.98]:56330 "EHLO jabberwock.ucw.cz" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726302AbgGAIrx (ORCPT ); Wed, 1 Jul 2020 04:47:53 -0400 Received: by jabberwock.ucw.cz (Postfix, from userid 1017) id CD6F41C0C0F; Wed, 1 Jul 2020 10:47:50 +0200 (CEST) Date: Wed, 1 Jul 2020 10:47:50 +0200 From: Pavel Machek To: Greg Kroah-Hartman Cc: Jesse Barnes , Rajat Jain , Rajat Jain , Bjorn Helgaas , "Raj, Ashok" , "Krishnakumar, Lalithambika" , Bjorn Helgaas , linux-pci , Mika Westerberg , Jean-Philippe Brucker , Prashant Malani , Benson Leung , Todd Broch , Alex Levin , Mattias Nissler , Zubin Mithra , Bernie Keany , Aaron Durbin , Diego Rivas , Duncan Laurie , Furquan Shaikh , Christian Kellner , Alex Williamson , Joerg Roedel , Linux Kernel Mailing List Subject: Re: [RFC] Restrict the untrusted devices, to bind to only a set of "whitelisted" drivers Message-ID: <20200701084750.GA7144@amd> References: <20200603060751.GA465970@kroah.com> <20200603121613.GA1488883@kroah.com> <20200605080229.GC2209311@kroah.com> <20200607113632.GA49147@kroah.com> <20200630214559.GA7113@duo.ucw.cz> <20200701065426.GC2044019@kroah.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="KsGdsel6WgEHnImy" Content-Disposition: inline In-Reply-To: <20200701065426.GC2044019@kroah.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-pci-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pci@vger.kernel.org --KsGdsel6WgEHnImy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Hi! > > We normally trust the hardware NOT to be malicious. (Because if hacker > > has physical access to hardware and lot of resources, you lost). >=20 > That is what we originally thought, however the world has changed and we > need to be better about this, now that it is trivial to create a "bad" > device. I'm not disagreeing. > > This is still true today, but maybe trusting USB devices is bad idea, > > so drivers are being cleaned up. PCI drivers will be WORSE in this > > regard. And you can't really protect against malicious CPU, and it is > > very very hard to protect against malicous RAM (probably not practical > > without explicit CPU support). > >=20 > > Linux was designed with "don't let hackers near your hardware" threat > > model in mind. >=20 > Yes, it originally was designed that way, but again, the world has > changed so we have to change with it. That is why USB has for a long > time now, allowed you to not bind drivers to devices that you do not > "trust", and that trust can be determined by userspace. That all came > about thanks to the work done by the wireless USB spec people and kernel > authors, which showed that maybe you just don't want to trust any device > that comes within range of your system :) Again, not disagreeing; but note the scale here. It is mandatory to defend against malicious wireless USB devices. We probably should work on robustness against malicious USB devices. Malicious PCI-express devices are lot less of concern. Defending against malicious CPU/RAM does not make much sense. Notice that it is quite easy to generate -100V on the USB and kill your motherboard. Also notice that malicious parts of the hardware don't need to be electrically connected to the rest of system, and that they don't even have to contain any electronics. You just have to be careful. https://en.wikipedia.org/wiki/The_Thing_(listening_device) Pavel --=20 (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blo= g.html --KsGdsel6WgEHnImy Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iEYEARECAAYFAl78TbYACgkQMOfwapXb+vIPVQCfaLKmBpCjrjpOL7yk4eKC2WOg zAIAoLekMQziYoPoMQ53aRvdTzLzgVqb =qNCF -----END PGP SIGNATURE----- --KsGdsel6WgEHnImy--