Documentation/usb/authorization.txt

   1
   2 Authorizing (or not) your USB devices to connect to the system
   3
   4 (C) 2007 Inaky Perez-Gonzalez <inaky@linux.intel.com> Intel Corporation
   5
   6 Interface authorization part:
   7         (C) 2015 Stefan Koch <skoch@suse.de> SUSE LLC
   8
   9 This feature allows you to control if a USB device can be used (or
  10 not) in a system. This feature will allow you to implement a lock-down
  11 of USB devices, fully controlled by user space.
  12
  13 As of now, when a USB device is connected it is configured and
  14 its interfaces are immediately made available to the users.  With this
  15 modification, only if root authorizes the device to be configured will
  16 then it be possible to use it.
  17
  18 Usage:
  19
  20 Authorize a device to connect:
  21
  22 $ echo 1 > /sys/bus/usb/devices/DEVICE/authorized
  23
  24 Deauthorize a device:
  25
  26 $ echo 0 > /sys/bus/usb/devices/DEVICE/authorized
  27
  28 Set new devices connected to hostX to be deauthorized by default (ie:
  29 lock down):
  30
  31 $ echo 0 > /sys/bus/usb/devices/usbX/authorized_default
  32
  33 Remove the lock down:
  34
  35 $ echo 1 > /sys/bus/usb/devices/usbX/authorized_default
  36
  37 By default, Wired USB devices are authorized by default to
  38 connect. Wireless USB hosts deauthorize by default all new connected
  39 devices (this is so because we need to do an authentication phase
  40 before authorizing).
  41
  42
  43 Example system lockdown (lame)
  44 -----------------------
  45
  46 Imagine you want to implement a lockdown so only devices of type XYZ
  47 can be connected (for example, it is a kiosk machine with a visible
  48 USB port):
  49
  50 boot up
  51 rc.local ->
  52
  53  for host in /sys/bus/usb/devices/usb*
  54  do
  55     echo 0 > $host/authorized_default
  56  done
  57
  58 Hookup an script to udev, for new USB devices
  59
  60  if device_is_my_type $DEV
  61  then
  62    echo 1 > $device_path/authorized
  63  done
  64
  65
  66 Now, device_is_my_type() is where the juice for a lockdown is. Just
  67 checking if the class, type and protocol match something is the worse
  68 security verification you can make (or the best, for someone willing
  69 to break it). If you need something secure, use crypto and Certificate
  70 Authentication or stuff like that. Something simple for an storage key
  71 could be:
  72
  73 function device_is_my_type()
  74 {
  75    echo 1 > authorized          # temporarily authorize it
  76                                 # FIXME: make sure none can mount it
  77    mount DEVICENODE /mntpoint
  78    sum=$(md5sum /mntpoint/.signature)
  79    if [ $sum = $(cat /etc/lockdown/keysum) ]
  80    then
  81         echo "We are good, connected"
  82         umount /mntpoint
  83         # Other stuff so others can use it
  84    else
  85         echo 0 > authorized
  86    fi
  87 }
  88
  89
  90 Of course, this is lame, you'd want to do a real certificate
  91 verification stuff with PKI, so you don't depend on a shared secret,
  92 etc, but you get the idea. Anybody with access to a device gadget kit
  93 can fake descriptors and device info. Don't trust that. You are
  94 welcome.
  95
  96
  97 Interface authorization
  98 -----------------------
  99 There is a similar approach to allow or deny specific USB interfaces.
 100 That allows to block only a subset of an USB device.
 101
 102 Authorize an interface:
 103 $ echo 1 > /sys/bus/usb/devices/INTERFACE/authorized
 104
 105 Deauthorize an interface:
 106 $ echo 0 > /sys/bus/usb/devices/INTERFACE/authorized
 107
 108 The default value for new interfaces
 109 on a particular USB bus can be changed, too.
 110
 111 Allow interfaces per default:
 112 $ echo 1 > /sys/bus/usb/devices/usbX/interface_authorized_default
 113
 114 Deny interfaces per default:
 115 $ echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default
 116
 117 Per default the interface_authorized_default bit is 1.
 118 So all interfaces would authorized per default.
 119
 120 Note:
 121 If a deauthorized interface will be authorized so the driver probing must
 122 be triggered manually by writing INTERFACE to /sys/bus/usb/drivers_probe
 123
 124 For drivers that need multiple interfaces all needed interfaces should be
 125 authroized first. After that the drivers should be probed.
 126 This avoids side effects.