Linux 6.9 Adds New Build-Time Control Whether To Authorize Attached USB Devices

[phoronix]

Phoronix: Linux 6.9 Adds New Build-Time Control Whether To Authorize Attached USB Devices

The in-development Linux 6.9 kernel is introducing a new USB_DEFAULT_AUTHORIZATION_MODE Kconfig build-time switch to change the default authorization mode for how Linux should deal with attached USB devices...

https://www.phoronix.com/news/Linux-6.9-USB-Authorized-Mode

[luno]

this might be useful for anticheat framework

[uid313]

It would be really cool if when you plugged in a USB device you got a notification in GNOME asking you if you want to authorize the device.

[spicfoo]

It would be really cool if when you plugged in a USB device you got a notification in GNOME asking you if you want to authorize the device.

If you don't want to authorize it why would you plug it?

[Volta]

If you don't want to authorize it why would you plug it?

Steam sometimes gets confused due to various USB devices such as steering wheel, gamepad and joystick. Instead of disconnecting them, it would be easier to turn on the desired ones.

[Etherman]

It would be really cool if when you plugged in a USB device you got a notification in GNOME asking you if you want to authorize the device.

I do get that, both in KDE and GNOME.
Asks for my password.

[ahrs]

If you don't want to authorize it why would you plug it?

It's to protect against people randomly plugging USBs in without you noticing. A highly unlikely threat but could happen. On Android, it's the norm to ask for permission to use any USB device you plug into it.

I have to authorise it to use the USB dongle / hub
I have to authorise it to use Ethernet
I have to authorise it to use my smart card / Yubikey
…

[Chewi]

I think it's really targeted at situations like data centres where you don't want some random plugging some device into your rack server.

[peterdk]

MacOS has this by default, I did like it. As long as you can say 'always trust this device'.

[Gonk]

I think it's really targeted at situations like data centres where you don't want some random plugging some device into your rack server.

This is useful for any situation where you have computers that aren't behind locked doors/cages. It takes a bad guy just a few seconds to plug something into the back of a receptionist's computer sitting on the desk. Anyone who has administered university computer labs knows what I am talking about. It requires a totally different mindset about security.