add toggle for disabling newly added USB devices

Based on the public grsecurity patches.

Change-Id: I2cbea91b351cda7d098f4e1aa73dff1acbd23cce
Signed-off-by: Daniel Micay <danielmicay@gmail.com>

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 98ef2aafcbc6a198347799ea0f995711c3b62c4e..1f3aa1b96e3745a43d0a293437530c2cb59c267e 100644 (file)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -38,6 +38,8 @@
 #define USB_VENDOR_GENESYS_LOGIC               0x05e3
 #define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND       0x01
 
+extern int deny_new_usb;
+
 /* Protect struct usb_device->state and ->children members
  * Note: Both are also protected by ->dev.sem, except that ->state can
  * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */
@@ -4835,6 +4837,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                        goto done;
                return;
        }
+
+       if (deny_new_usb) {
+               dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
+               goto done;
+       }
+
        if (hub_is_superspeed(hub->hdev))
                unit_load = 150;
        else

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index d3d2d466b5285f03691bf582d431aa48c752ab4a..d08fd394c77a47fc5530c71ee3752ee7e1b42be4 100644 (file)
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -98,6 +98,10 @@
 #if defined(CONFIG_SYSCTL)
 
 /* External variables not in a header file. */
+#ifdef CONFIG_USB
+int deny_new_usb __read_mostly = 0;
+EXPORT_SYMBOL(deny_new_usb);
+#endif
 extern int suid_dumpable;
 #ifdef CONFIG_COREDUMP
 extern int core_uses_pid;
@@ -900,6 +904,18 @@ static struct ctl_table kern_table[] = {
                .extra2         = &two,
        },
 #endif
+
+#ifdef CONFIG_USB
+       {
+               .procname       = "deny_new_usb",
+               .data           = &deny_new_usb,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec_minmax_sysadmin,
+               .extra1         = &zero,
+               .extra2         = &one,
+       },
+#endif
        {
                .procname       = "ngroups_max",
                .data           = &ngroups_max,