Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1550364

Re: [PATCH] Allow userspace control of runtime disabling/enabling of driver probing

Show all headers | View raw

On Wed, Jan 4, 2017 at 12:38 AM, Kees Cook <keescook@chromium.org> wrote:
> On Tue, Jan 3, 2017 at 3:34 PM, Rafael J. Wysocki <rafael@kernel.org> wrote:
>> On Tue, Jan 3, 2017 at 11:58 PM, Kees Cook <keescook@chromium.org> wrote:
>>> From: Matthew Garrett <mjg59@coreos.com>
>>>
>>> Various attacks are made possible due to the large attack surface of
>>> kernel drivers and the easy availability of hotpluggable hardware that can
>>> be programmed to mimic arbitrary devices. This allows attackers to find a
>>> single vulnerable driver and then produce a device that can exploit it by
>>> plugging into a hotpluggable bus (such as PCI or USB). This violates user
>>> assumptions about unattended systems being secure as long as the screen
>>> is locked.
>>>
>>> The kernel already has support for deferring driver binding in order
>>> to avoid problems over suspend/resume. By exposing this to userspace we
>>> can disable probing when the screen is locked and simply reenable it on
>>> unlock.
>>>
>>> This is not a complete solution - since this still permits device
>>> creation and simply blocks driver binding, it won't stop userspace
>>> drivers from attaching to devices and it won't protect against any kernel
>>> vulnerabilities in the core bus code. However, it should be sufficient to
>>> block attacks like Poisontap (https://samy.pl/poisontap/).
>>
>> It also looks like this may be worked around by tricking the user to
>> unlock the screen while the malicious device is still attached to the
>> system.
>
> It certainly changes the temporal aspect of the attack (i.e. there is
> a delay and must be "silent" in that the local user cannot notice it).

It will be silent until a driver binds to it anyway, won't it?

>> If that really is the case, I wonder if it's worth the extra complexity.
>
> I think so, since it's not that much more complexity (it uses the
> existing deferral mechanism).

But that existing mechanism certainly wasn't designed to be turned on
and off at random and concurrently etc.  The way it is going to be
used now is far more complex IMO.

Thanks,
Rafael

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Kees Cook <keescook@chromium.org> - 2017-01-04 00:00 +0100
  Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing "Rafael J. Wysocki" <rafael@kernel.org> - 2017-01-04 00:40 +0100
    Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Kees Cook <keescook@chromium.org> - 2017-01-04 00:50 +0100
      Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing "Rafael J. Wysocki" <rafael@kernel.org> - 2017-01-04 02:50 +0100
  Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 10:40 +0100
    Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 19:20 +0100
      Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 19:40 +0100
        Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 20:50 +0100
          Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 21:10 +0100
            Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 21:50 +0100
              Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 23:00 +0100
                Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 23:40 +0100
      Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-01-04 20:50 +0100
        Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Matthew Garrett <mjg59@coreos.com> - 2017-01-04 21:10 +0100
          Re: [PATCH] Allow userspace control of runtime disabling/enabling of  driver probing Tomeu Vizoso <tomeu.vizoso@collabora.com> - 2017-01-05 09:20 +0100

csiph-web