On 11/30/2015 06:20 PM, Greg KH wrote:
On Mon, Nov 30, 2015 at 06:12:22PM +0100, Krzysztof Opasiak wrote:
On 11/30/2015 05:16 PM, Alan Stern wrote:
On Fri, 27 Nov 2015, Krzysztof Opasiak wrote:
I run through your code and as far as I understand above is not
true. Your patch allows only to prevent userspace from accessing
which has kernel drivers, there is no way to stop an application
control over all free interfaces.
Let's say that your device has 3 interfaces. First of them has a
driver but second and third doesn't. You have 2 apps. One should
using second interface and another one third. But first app is
it claims all free interfaces of received device (your patch
this). And when second app starts it is unable to do anything
device because all interfaces are taken. How would you like to
You can't, and why would you ever want to, as you can't tell what
"should" or "should not" do. If you really care about this, then
LSM policy to prevent this.
Well, an app can declare what it does and what it needs in it's
file (or some equivalent of this) and the platform should ensure that
app can do only what it has declared.
I would really like to use LSM policy in here but currently it is
impossible as one device node represents whole device. Permissions
those from LSM) are being checked only on open() not on each
as far as I know there is nothing which prevents any owner of
to claim all available (not taken by someone else) interfaces and LSM
policy is unable to filter those calls (unless we add some LSM hooks
How about this approach? Once a process has dropped its usbfs
privileges, it's not allowed to claim any interfaces (either explicitly
or implicitly). Instead, it or some manager program must claim the
appropriate interfaces before dropping privileges.
I agree that restricting interface claiming only to privileged
process is a
good idea. Unfortunately this generates a problem when program needs
than one interface (like in cdc - data + control for example). We
declare both of them in first call to "usb-manager" or reopen the dev
at second call and claim all interfaces claimed using this fd till
claim one more and then drop privileges and send a new fd.