Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit e8c17847 authored by Daniel Micay's avatar Daniel Micay Committed by Michael Benedict
Browse files

add toggle for disabling newly added USB devices

Based on the public grsecurity patches.
parent a4bccbb6
Loading
Loading
Loading
Loading
+8 −0
Original line number Diff line number Diff line
@@ -39,6 +39,8 @@
#define USB_VENDOR_GENESYS_LOGIC		0x05e3
#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND	0x01

extern int deny_new_usb;

/* Protect struct usb_device->state and ->children members
 * Note: Both are also protected by ->dev.sem, except that ->state can
 * change to USB_STATE_NOTATTACHED even when the semaphore isn't held. */
@@ -4746,6 +4748,12 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
			goto done;
		return;
	}

	if (deny_new_usb) {
		dev_err(&port_dev->dev, "denied insert of USB device on port %d\n", port1);
		goto done;
	}

	if (hub_is_superspeed(hub->hdev))
		unit_load = 150;
	else
+15 −0
Original line number Diff line number Diff line
@@ -98,6 +98,10 @@
#if defined(CONFIG_SYSCTL)

/* External variables not in a header file. */
#if IS_ENABLED(CONFIG_USB)
int deny_new_usb __read_mostly = 0;
EXPORT_SYMBOL(deny_new_usb);
#endif
extern int suid_dumpable;
#ifdef CONFIG_COREDUMP
extern int core_uses_pid;
@@ -875,6 +879,17 @@ static struct ctl_table kern_table[] = {
		.extra1		= &zero,
		.extra2		= &two,
	},
#endif
#if IS_ENABLED(CONFIG_USB)
	{
		.procname	= "deny_new_usb",
		.data		= &deny_new_usb,
		.maxlen		= sizeof(int),
		.mode		= 0644,
		.proc_handler	= proc_dointvec_minmax_sysadmin,
		.extra1		= &zero,
		.extra2		= &one,
	},
#endif
	{
		.procname	= "ngroups_max",