Commit bec7e43b authored by Niko Mauno's avatar Niko Mauno Committed by Greg Kroah-Hartman
Browse files

usb: core: Make default authorization mode configurable 



Make the default USB device authorization mode configurable at build
time. This is useful for systems that require a mode that is stricter
than the standard setting, as it avoids relying on the kernel command
line being properly set.

Signed-off-by: default avatarNiko Mauno <niko.mauno@vaisala.com>
Link: https://lore.kernel.org/r/20240105114956.30714-2-niko.mauno@vaisala.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent aa6e11e9

drivers/usb/core/Kconfig

+17 −0
Original line number Diff line number Diff line
@@ -116,3 +116,20 @@ config USB_AUTOSUSPEND_DELAY 
	  The default value Linux has always had is 2 seconds.  Change

	  this value if you want a different delay and cannot modify

	  the command line or module parameter.



config USB_DEFAULT_AUTHORIZATION_MODE

	int "Default authorization mode for USB devices"

	range 0 2

	default 1

	depends on USB

	help

	  Select the default USB device authorization mode. Can be overridden

	  with usbcore.authorized_default command line or module parameter.



	  The available values have the following meanings:

		0 is unauthorized for all devices

		1 is authorized for all devices (default)

		2 is authorized for internal devices



	  If the default value is too permissive but you are unsure which mode

	  to use, say 2.

drivers/usb/core/hcd.c

+1 −1
Original line number Diff line number Diff line
@@ -357,7 +357,7 @@ static const u8 ss_rh_config_descriptor[] = { 
#define USB_AUTHORIZE_ALL	1

#define USB_AUTHORIZE_INTERNAL	2



static int authorized_default = USB_AUTHORIZE_ALL;

static int authorized_default = CONFIG_USB_DEFAULT_AUTHORIZATION_MODE;

module_param(authorized_default, int, S_IRUGO|S_IWUSR);

MODULE_PARM_DESC(authorized_default,

		"Default USB device authorization: 0 is not authorized, 1 is authorized (default), 2 is authorized for internal devices, -1 is authorized (same as 1)");