Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1670346

Re: [PATCH 04/11] S.A.R.A. USB Filtering

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon 2017-06-12 18:56:53, Salvatore Mesoraca wrote:
> Introduction of S.A.R.A. USB Filtering.
> It uses the "usb_device_auth" LSM hook to provide a mechanism to decide
> which USB devices should be authorized to connect to the system and
> which shouldn't.
> The main goal is to narrow the attack surface for custom USB devices
> designed to exploit vulnerabilities found in some USB device drivers.
> Via configuration it's possible to allow or to deny authorization, based
> on one or more of: Vendor ID, Product ID, bus name and port number. There
> is also support for "trailing wildcards".

Hmm. Given that USB device provides vendor id/product id, this does
not really stop anyone, right?

AFAICT you can still get USB stick with vid/pid of logitech keyboard,
and kernel will recognize it as a usb stick.

So you should not really filter on vid/pid, but on device
types (sha sum of USB descriptor?).

> Depending on the configuration, it can work both as a white list or as a
> black list.

Blacklisting vid/pid is completely useless. Whitelisting vid/pid is
nearly so. Attacker able to plug USB devices sees devices already
attached, so he can guess right vid/pids quite easily.

								Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/11] S.A.R.A. a new stacked LSM Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
  [PATCH 08/11] Creation of "pagefault_handler_x86" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
    Re: [PATCH 08/11] Creation of "pagefault_handler_x86" LSM hook Thomas Gleixner <tglx@linutronix.de> - 2017-06-12 19:40 +0200
      Re: [PATCH 08/11] Creation of "pagefault_handler_x86" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 09:50 +0200
  [PATCH 10/11] Allowing for stacking procattr support in S.A.R.A. Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
  [PATCH 01/11] S.A.R.A. Documentation Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
    Re: [kernel-hardening] [PATCH 01/11] S.A.R.A. Documentation Jann Horn <jannh@google.com> - 2017-06-12 19:50 +0200
      Re: [kernel-hardening] [PATCH 01/11] S.A.R.A. Documentation Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 09:50 +0200
    Re: [PATCH 01/11] S.A.R.A. Documentation Kees Cook <keescook@chromium.org> - 2017-06-28 01:00 +0200
    Re: [PATCH 01/11] S.A.R.A. Documentation Kees Cook <keescook@chromium.org> - 2017-06-28 01:00 +0200
  [PATCH 09/11] Trampoline emulation Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
  [PATCH 04/11] S.A.R.A. USB Filtering Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
    Re: [PATCH 04/11] S.A.R.A. USB Filtering Pavel Machek <pavel@ucw.cz> - 2017-06-20 09:10 +0200
      Re: [PATCH 04/11] S.A.R.A. USB Filtering Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-20 10:00 +0200
  [PATCH 05/11] Creation of "check_vmflags" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
    Re: [PATCH 05/11] Creation of "check_vmflags" LSM hook Casey Schaufler <casey@schaufler-ca.com> - 2017-06-12 23:40 +0200
      Re: [PATCH 05/11] Creation of "check_vmflags" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 10:00 +0200
    Re: [PATCH 05/11] Creation of "check_vmflags" LSM hook Christoph Hellwig <hch@infradead.org> - 2017-06-13 08:40 +0200
      Re: [PATCH 05/11] Creation of "check_vmflags" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 10:00 +0200
  [PATCH 02/11] S.A.R.A. framework creation Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
  [PATCH 03/11] Creation of "usb_device_auth" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
    Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Krzysztof Opasiak <k.opasiak@samsung.com> - 2017-06-12 19:40 +0200
      Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 09:50 +0200
    Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-06-12 21:40 +0200
      Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 10:00 +0200
    Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Casey Schaufler <casey@schaufler-ca.com> - 2017-06-12 23:40 +0200
      Re: [PATCH 03/11] Creation of "usb_device_auth" LSM hook Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-13 10:00 +0200
  [PATCH 07/11] S.A.R.A. WX Protection Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:00 +0200
  [PATCH 06/11] S.A.R.A. cred blob management Salvatore Mesoraca <s.mesoraca16@gmail.com> - 2017-06-12 19:10 +0200

csiph-web