From 9d008d3d56f0afa5b839a79249790b54138560f0 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Tue, 16 May 2017 17:51:48 -0400 Subject: [PATCH] Add toggle for disabling newly added USB devices Based on the public grsecurity patches. Change-Id: I2cbea91b351cda7d098f4e1aa73dff1acbd23cce Signed-off-by: Daniel Micay --- drivers/usb/core/hub.c | 8 ++++++++ kernel/sysctl.c | 15 +++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c index e63c8c76a868..63b2a0e64c6a 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c @@ -40,6 +40,8 @@ static char *device_enum_fail[2] = { "USB_DEVICE_STATE=Device no response", NULL }; #endif +extern int deny_new_usb; + /* Protect struct usb_device->state and ->children members * Note: Both are also protected by ->dev.sem, except that ->state can * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */ @@ -4826,6 +4828,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, goto done; return; } + + if (deny_new_usb) { + dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1); + goto done; + } + if (hub_is_superspeed(hub->hdev)) unit_load = 150; else diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 2b3d1a04ca29..4e308b4e7949 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -98,6 +98,10 @@ #if defined(CONFIG_SYSCTL) /* External variables not in a header file. */ +#ifdef CONFIG_USB +int deny_new_usb __read_mostly = 0; +EXPORT_SYMBOL(deny_new_usb); +#endif extern int suid_dumpable; #ifdef CONFIG_COREDUMP extern int core_uses_pid; @@ -901,6 +905,17 @@ static struct ctl_table kern_table[] = { .extra1 = &zero, .extra2 = &two, }, +#endif +#ifdef CONFIG_USB + { + .procname = "deny_new_usb", + .data = &deny_new_usb, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec_minmax_sysadmin, + .extra1 = &zero, + .extra2 = &one, + }, #endif { .procname = "ngroups_max", -- 2.20.1