From: Niko Mauno <niko.mauno@vaisala.com>

Make the default USB device authorization mode configurable at build
time. This is useful for systems that require a mode that is stricter
than the standard setting, as it avoids relying on the kernel command
line being properly set.

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
---
 drivers/usb/core/Kconfig | 15 +++++++++++++++
 drivers/usb/core/hcd.c   |  2 +-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 351ede4b5de2..10ad320cc2f3 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -116,3 +116,18 @@ config USB_AUTOSUSPEND_DELAY
 	  The default value Linux has always had is 2 seconds.  Change
 	  this value if you want a different delay and cannot modify
 	  the command line or module parameter.
+
+config USB_DEFAULT_AUTHORIZATION_MODE
+	int "Default authorization mode for USB devices"
+	range -1 2
+	default -1
+	depends on USB
+	help
+	  Select the default USB device authorization mode. Can be overridden
+	  with usbcore.authorized_default command line or module parameter.
+
+	  The available values have the following meanings:
+		-1 is authorized for all devices (leftover from wireless USB)
+		0 is unauthorized for all devices
+		1 is authorized for all devices
+		2 is authorized for internal devices
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 12b6dfeaf658..f39170c46be7 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -357,7 +357,7 @@ static const u8 ss_rh_config_descriptor[] = {
 #define USB_AUTHORIZE_ALL	1
 #define USB_AUTHORIZE_INTERNAL	2
 
-static int authorized_default = USB_AUTHORIZE_WIRED;
+static int authorized_default = CONFIG_USB_DEFAULT_AUTHORIZATION_MODE;
 module_param(authorized_default, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(authorized_default,
 		"Default USB device authorization: 0 is not authorized, 1 is "
-- 
2.39.2

On Thu, Jan 04, 2024 at 06:32:03PM +0200, niko.mauno@vaisala.com wrote:
> From: Niko Mauno <niko.mauno@vaisala.com>
> 
> Make the default USB device authorization mode configurable at build
> time. This is useful for systems that require a mode that is stricter
> than the standard setting, as it avoids relying on the kernel command
> line being properly set.
> 
> Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
> ---
>  drivers/usb/core/Kconfig | 15 +++++++++++++++
>  drivers/usb/core/hcd.c   |  2 +-
>  2 files changed, 16 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
> index 351ede4b5de2..10ad320cc2f3 100644
> --- a/drivers/usb/core/Kconfig
> +++ b/drivers/usb/core/Kconfig
> @@ -116,3 +116,18 @@ config USB_AUTOSUSPEND_DELAY
>  	  The default value Linux has always had is 2 seconds.  Change
>  	  this value if you want a different delay and cannot modify
>  	  the command line or module parameter.
> +
> +config USB_DEFAULT_AUTHORIZATION_MODE
> +	int "Default authorization mode for USB devices"
> +	range -1 2
> +	default -1
> +	depends on USB
> +	help
> +	  Select the default USB device authorization mode. Can be overridden
> +	  with usbcore.authorized_default command line or module parameter.
> +
> +	  The available values have the following meanings:
> +		-1 is authorized for all devices (leftover from wireless USB)
> +		0 is unauthorized for all devices
> +		1 is authorized for all devices

What's the difference now between -1 and 1?  We don't have wireless USB
anymore as that never turned into an actual product, so we shouldn't
reference it anymore, right?

We should get rid of the -1 option entirely, but keep the module option
and properly map it to '1'.


> +		2 is authorized for internal devices

Needs a "if you don't know what to select, please choose X" text here.

thanks,

greg k-h

On 4.1.2024 18.41, Greg KH wrote:
> On Thu, Jan 04, 2024 at 06:32:03PM +0200, niko.mauno@vaisala.com wrote:
...
>> +       The available values have the following meanings:
>> +             -1 is authorized for all devices (leftover from wireless USB)
>> +             0 is unauthorized for all devices
>> +             1 is authorized for all devices
> 
> What's the difference now between -1 and 1?  We don't have wireless USB
> anymore as that never turned into an actual product, so we shouldn't
> reference it anymore, right?
> 
> We should get rid of the -1 option entirely, but keep the module option
> and properly map it to '1'.
> 
> 
>> +             2 is authorized for internal devices
> 
> Needs a "if you don't know what to select, please choose X" text here.

Thanks, submitted v2 which strives to address also these considerations.
-Niko

On Fri, Jan 05, 2024 at 01:56:35PM +0200, Niko Mauno wrote:
> On 4.1.2024 18.41, Greg KH wrote:
> > On Thu, Jan 04, 2024 at 06:32:03PM +0200, niko.mauno@vaisala.com wrote:
> ...
> > > +       The available values have the following meanings:
> > > +             -1 is authorized for all devices (leftover from wireless USB)
> > > +             0 is unauthorized for all devices
> > > +             1 is authorized for all devices
> > 
> > What's the difference now between -1 and 1?  We don't have wireless USB
> > anymore as that never turned into an actual product, so we shouldn't
> > reference it anymore, right?
> > 
> > We should get rid of the -1 option entirely, but keep the module option
> > and properly map it to '1'.
> > 
> > 
> > > +             2 is authorized for internal devices
> > 
> > Needs a "if you don't know what to select, please choose X" text here.
> 
> Thanks, submitted v2 which strives to address also these considerations.

Much better, thanks.  I'll look at them after 6.8-rc1 is out.

greg k-h