| Summary: | RFE: option to lock USB ports when no session is opened | ||
|---|---|---|---|
| Product: | systemd | Reporter: | Yves-Alexis <corsac> |
| Component: | general | Assignee: | systemd-bugs |
| Status: | NEW --- | QA Contact: | systemd-bugs |
| Severity: | enhancement | ||
| Priority: | medium | CC: | fdo-bugs |
| Version: | unspecified | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
|
Description
Yves-Alexis
2014-08-08 20:57:11 UTC
So, it seems that the correct way is to do:
for bus in /sys/bus/usb/usb*;
do
echo 0 > ${bus}/authorized_default
done
to disable registration of new devices on the USB busses. The devices still get enumerated by the kernel, but they're not handled by any driver.
Same thing with 1 (or -1) will re-enable the registration.
I can see the usefulness of this, but this also sounds like security theatre. If you just implement it like this, then you add a big DoS, because people can pull your kbd and you cannot unlock your session anymore, ever. Unless of course you accept keyboards that are plugged back in. But in that case, the whole excercise is moot. Hence I am not convinced that this is really a sound idea, I must say. I can see benefits. For one, a keyboard is usually a relatively dumb HID device. So not much harm caused. Especially not if you already had the very same vendorid and productid attached. The attack surface is certainly smaller when only allowing a limited set of (already seen) devices. Spontaneously, that would would be a great security feature for single user machines running contemporary desktops. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.