Received-SPF: pass (google.com: domain of linux-kernel+bounces-59173-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: niko.mauno@vaisala.com
To: gregkh@linuxfoundation.org
Cc: linux-usb@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	vesa.jaaskelainen@vaisala.com,
	geert@linux-m68k.org,
	Niko Mauno <niko.mauno@vaisala.com>
Subject: [PATCH v3 2/2] usb: core: Make default authorization mode configurable
Date: Fri,  9 Feb 2024 11:46:51 +0200
Message-Id: <20240209094651.5379-2-niko.mauno@vaisala.com>
In-Reply-To: <20240209094651.5379-1-niko.mauno@vaisala.com>
References: <20240209094651.5379-1-niko.mauno@vaisala.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?S932HNzDKiFPagAyChql44PWXwcvu0nzxp50S9oQycQsOvrUdcTSUUvnjB+6?=
 =?us-ascii?Q?Dt6aTZY6CatvNVf7OCxnqLibP6uppmRWhEs79FWdCzEF1KHe7KQyQXaV+avm?=
 =?us-ascii?Q?U4x3WLRlMiqQ4yhLcMBhLDwaU6GFV6IxW+mLj7Bp7picvha2cAu+gTUXSrBx?=
 =?us-ascii?Q?iSL4PxLAw8ZC8XlO85gSo4qFdQyDQHQm/VXIJm4jM3ZGj42SuzDgwAeuOvkh?=
 =?us-ascii?Q?Dy2KkOtLUF65n6mIDUHjGzmbluwkCagxRJdSMVAG/schXKS6TAJMs9leTLmu?=
 =?us-ascii?Q?kobtK6vycVvd/UsIdNr3PPIfIRf5nRrDHacerwqFAnlSu+THb3omw/mZCTdF?=
 =?us-ascii?Q?xCtBccSRikWPnKt8benV1UzYBSC9u6lI49av2q2qdw4nem+zfApALkGOAF9s?=
 =?us-ascii?Q?/G3Q+VQGDxtQQ7SVvsRjXfPTyHCVk4PsdZMcw/ZobGqfil+uhzzJJqUQfBo0?=
 =?us-ascii?Q?EA5W+ZELoThaf3xVOPJwnajvl7WXbMp1UY1c/zBchFrxoflAKap/hWplGS3I?=
 =?us-ascii?Q?uyq/mqnaFy59h7rjjMNFCaH2RktvUkhfEasNjkADxcFlUi5J61bcDtW7SznO?=
 =?us-ascii?Q?FlnVq9YaFHn4CdaD201DVQahkAEnA+5+fos0HsuC3FHXwQ0esCOdJY4xdrH6?=
 =?us-ascii?Q?Z59SHCcjlN5JFaDH+RQm31iHocmcKV28CBhz1yq1lCK9sGoO3G4D/T8498LR?=
 =?us-ascii?Q?/RmKRCBfDNH08NdsxFb90HxECCi824znSNUTZu/1T1H7+/vWZtwwcFmGxXFn?=
 =?us-ascii?Q?WMiQ31UD6nJ+4Ts0EY5vqUUkHTn13sV+Q2TnhJHquJV4breuse0MGM5dHb5w?=
 =?us-ascii?Q?S6KbuVDreRJi6J1PyPHf/X29OXJi9VjsqxoW03mjwQkyQKjidAey1oMPUd30?=
 =?us-ascii?Q?mxc8iHf+9dzyN177PIP4mPbu7oisQS/k0YE2IjP2CSanjOUep3fBRyZonb7A?=
 =?us-ascii?Q?INSKZf3MUaEY5nzwUt9yfp2XbFAh1mC0g5wne76YdgYpvQ+yHsF+BCtbtgto?=
 =?us-ascii?Q?oLmAD2DFl5WrBFM/jZ3lV58vAzi5w8O8N3dSrz49akgXoczv9R8HW/f7LM8H?=
 =?us-ascii?Q?nM3Xddq/91T8BOemvB2BXlOHurjdn4klQ0detEiDyHIVu8RFzH+HYN+wTr4z?=
 =?us-ascii?Q?9xP0Q07LXUA6ZSIDylH2DYlkIJk+92F3RU9NwFIonlx5MDeJWsV/HiVTkyz6?=
 =?us-ascii?Q?trNGZPsxvV6gCrcF8QO1vlkiDlXVeO8o/AKBlwhR1d9lorO4JeNweApZIfPS?=
 =?us-ascii?Q?C8OLyFfvcPc7/O0+YpJPUxJg+H56RtuIwRGeuySB0JzD/FufLITiXyv6O35e?=
 =?us-ascii?Q?LO5wEkFk2staR9jiHw3A8Y4vtcH0iSMuHcUw8Ja5+dwbwE7cxC9CYG6aOvG7?=
 =?us-ascii?Q?EtR1vYJ39SceUAN+sVJ3Y+JnLnXlF5EW+WdpsfXeZCKmWG3r3oZ6r0C0Gqee?=
 =?us-ascii?Q?MMcZT6JUhWrhDmAE/ppj8rLPINEa6Dg8XRFgf4GD4dzLMpwamUaHHguULlA/?=
 =?us-ascii?Q?rTgX3gvwy4oItMvURV3OJOR6JSCVHeLaEJlpHjB1TuZhUIzblFDxNRUy/AH3?=
 =?us-ascii?Q?xMSULdp5j7XLqalMvzQuAyE1hlR3V0GluVbvsTCgpVU5VOrgEkSqqX3cIQXS?=
 =?us-ascii?Q?Ag=3D=3D?=
X-OriginatorOrg: vaisala.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 11aba808-819b-4f8d-6bb6-08dc29542406
X-MS-Exchange-CrossTenant-AuthSource: AS4PR06MB8447.eurprd06.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Feb 2024 09:47:33.9017
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6d7393e0-41f5-4c2e-9b12-4c2be5da5c57
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: E5tVmplTtPnK+vszcWTHMmbOsjWu549yFYanppZAxT0nfZNWFjWpLhSsQgoY46V7I1j7LGHpG0MtfnsO8gUvSw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR06MB6578

From: Niko Mauno <niko.mauno@vaisala.com>

Make the default USB device authorization mode configurable at build
time. This is useful for systems that require a mode that is stricter
than the standard setting, as it avoids relying on the kernel command
line being properly set.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
---
 drivers/usb/core/Kconfig | 28 ++++++++++++++++++++++++++++
 drivers/usb/core/hcd.c   |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 351ede4b5de2..0bf425889c10 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -116,3 +116,31 @@ config USB_AUTOSUSPEND_DELAY
 	  The default value Linux has always had is 2 seconds.  Change
 	  this value if you want a different delay and cannot modify
 	  the command line or module parameter.
+
+config USB_DEFAULT_AUTHORIZATION_MODE
+	int "Default authorization mode for USB devices"
+	range 0 2
+	default 1
+	depends on USB
+	help
+	  Select the default USB device authorization mode. Can be overridden
+	  with usbcore.authorized_default command line or module parameter.
+
+	  This option allows you to choose whether USB devices that are
+	  connected to the system can be used by default, or if they are
+	  locked down.
+
+	  With value 0 all connected USB devices with the exception of root
+	  hub require user space authorization before they can be used.
+
+	  With value 1 (default) no user space authorization is required to
+	  use connected USB devices.
+
+	  With value 2 all connected USB devices with exception of internal
+	  USB devices require user space authorization before they can be
+	  used. Note that in this mode the differentiation between internal
+	  and external USB devices relies on ACPI, and on systems without
+	  ACPI selecting value 2 is analogous to selecting value 0.
+
+	  If the default value is too permissive but you are unsure which
+	  mode to use, say 2.
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 9aa5e6bf9b9d..d56597dc7d42 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -357,7 +357,7 @@ static const u8 ss_rh_config_descriptor[] = {
 #define USB_AUTHORIZE_ALL	1
 #define USB_AUTHORIZE_INTERNAL	2
 
-static int authorized_default = USB_AUTHORIZE_ALL;
+static int authorized_default = CONFIG_USB_DEFAULT_AUTHORIZATION_MODE;
 module_param(authorized_default, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(authorized_default,
 		"Default USB device authorization: 0 is not authorized, 1 is authorized (default), 2 is authorized for internal devices, -1 is authorized (same as 1)");
-- 
2.39.2