Linux Support Is Coming To Allow De-Authorizing Thunderbolt Devices

If wanting to de-authorize a previously authorized Thunderbolt device for whatever reason or if wanting to establish policies like where on user log-out that devices would be automatically de-authorized, it's looking like Linux 5.12 will support this ability.
Queued this past week into the Thunderbolt dev tree is the subsystem support for de-authorizing Thunderbolt devices. The de-authorization support relies upon the Thunderbolt software connection manager being active as it's able to directly control the PCIe tunnels.
A new "deauthorization" sysfs attribute is exposed to indicate whether the system supports de-authorization of Thunderbolt devices. Specific devices can then be deauthorized by writing "0" to the "authorized" sysfs attribute.
This is the kernel side support while we will see once landed if any user-space policies are proposed for automatically de-authorizing Thunderbolt devices on log-out or other changes in the name of system security.
11 Comments