Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Factory
gnome-settings-daemon
0001-usb-protection-Treat-hubs-and-HID-devices-...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0001-usb-protection-Treat-hubs-and-HID-devices-like-any-o.patch of Package gnome-settings-daemon
From a3c62f442981e39186ce78c140921c4bedfd7b16 Mon Sep 17 00:00:00 2001 From: Carlos Garnacho <carlosg@gnome.org> Date: Fri, 17 May 2024 11:35:41 +0200 Subject: [PATCH] usb-protection: Treat hubs and HID devices like any other USB gadget The checks on the classes offered by a USB device are pretty lax and uninformative from the kernel and UsbGuard levels, so our attempt at user friendliness with USB hubs and HID devices may result in everyone (lastly us) allowing maliciously crafted devices that present themselves as one of these devices, but implement other classes (e.g. mass storage). We believe this is ultimately an issue in the lower layers if this may go through as good up to us and we cannot truly believe UsbGuard information, but it is definitely us being the front face of this issue. Avoid treating USB hubs and HID devices different to any other USB gadget, this will require users to "enroll" them the same ways. --- .../gsd-usb-protection-manager.c | 58 +++++-------------- 1 file changed, 15 insertions(+), 43 deletions(-) diff --git a/plugins/usb-protection/gsd-usb-protection-manager.c b/plugins/usb-protection/gsd-usb-protection-manager.c index 43644408..538b6b1f 100644 --- a/plugins/usb-protection/gsd-usb-protection-manager.c +++ b/plugins/usb-protection/gsd-usb-protection-manager.c @@ -678,56 +678,28 @@ on_usbguard_signal (GDBusProxy *proxy, * If this device advertises also interfaces outside the HID class, or the * HUB class, it is suspect. It could be a false positive because this could * be a "smart" keyboard for example, but at this stage is better be safe. */ - if (hid_or_hub && !has_other_classes) { - guint device_id; + if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) { show_notification (manager, - _("New device detected"), - _("Either one of your existing devices has been reconnected or a new one has been plugged in. " - "If you did not do it, check your system for any suspicious device.")); - g_variant_get_child (parameters, POLICY_APPLIED_DEVICE_ID, "u", &device_id); - authorize_device (manager, device_id); + _("Reconnect USB device"), + _("New device has been detected while you were away. " + "Please disconnect and reconnect the device to start using it.")); } else { - if (protection_level == G_DESKTOP_USB_PROTECTION_LOCKSCREEN) { - show_notification (manager, - _("Reconnect USB device"), - _("New device has been detected while you were away. " - "Please disconnect and reconnect the device to start using it.")); - } else { - const char* name_for_notification = device_name ? device_name : "unknown name"; - g_debug ("Showing notification for %s", name_for_notification); - show_notification (manager, - _("USB device blocked"), - _("New device has been detected while you were away. " - "It has been blocked because the USB protection is active.")); - } + const char* name_for_notification = device_name ? device_name : "unknown name"; + g_debug ("Showing notification for %s", name_for_notification); + show_notification (manager, + _("USB device blocked"), + _("New device has been detected while you were away. " + "It has been blocked because the USB protection is active.")); } } else { /* If the protection level is "lockscreen" the device will be automatically * authorized by usbguard. */ if (protection_level == G_DESKTOP_USB_PROTECTION_ALWAYS) { - /* We authorize the device if this is a HID, - * e.g. a keyboard or a mouse, or an HUB. - * We also lock the screen to prevent an attacker to plug malicious - * devices if the legitimate user forgot to lock his session. - * - * If this device advertises also interfaces outside the HID class, or the - * HUB class, it is suspect. It could be a false positive because this could - * be a "smart" keyboard for example, but at this stage is better be safe. */ - if (hid_or_hub && !has_other_classes) { - ManagerDeviceId* manager_devid = g_malloc ( sizeof (ManagerDeviceId) ); - manager_devid->manager = manager; - g_variant_get_child (parameters, POLICY_APPLIED_DEVICE_ID, "u", &(manager_devid->device_id)); - gsd_screen_saver_call_lock (manager->screensaver_proxy, - manager->cancellable, - (GAsyncReadyCallback) on_screen_locked, - manager_devid); - } else { - show_notification (manager, - _("USB device blocked"), - _("The new inserted device has been blocked because the USB protection is active. " - "If you want to activate the device, disable the USB protection and re-plug " - "the device.")); - } + show_notification (manager, + _("USB device blocked"), + _("The new inserted device has been blocked because the USB protection is active. " + "If you want to activate the device, disable the USB protection and re-plug " + "the device.")); } else { /* This is protection level == Lockscreen, so we allow everything when the session is unlocked. There should be a USBGuard rule that automatically allows all devices, -- 2.44.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
