github.com/kubiko/snapd@v0.0.0-20201013125620-d4f3094d9ddf/interfaces/builtin/raw_usb.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2017 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const rawusbSummary = `allows raw access to all USB devices` 23 24 const rawusbBaseDeclarationSlots = ` 25 raw-usb: 26 allow-installation: 27 slot-snap-type: 28 - core 29 deny-auto-connection: true 30 ` 31 32 const rawusbConnectedPlugAppArmor = ` 33 # Description: Allow raw access to all connected USB devices. 34 # This gives privileged access to the system. 35 /dev/bus/usb/[0-9][0-9][0-9]/[0-9][0-9][0-9] rw, 36 37 # Allow access to all ttyUSB devices too 38 /dev/tty{USB,ACM}[0-9]* rwk, 39 40 # Allow raw access to USB printers (i.e. for receipt printers in POS systems). 41 /dev/usb/lp[0-9]* rwk, 42 43 # Allow detection of usb devices. Leaks plugged in USB device info 44 /sys/bus/usb/devices/ r, 45 /sys/devices/pci**/usb[0-9]** r, 46 /sys/devices/platform/{sbc,soc}/*.usb/usb[0-9]** r, 47 48 /run/udev/data/c16[67]:[0-9] r, # ACM USB modems 49 /run/udev/data/b180:* r, # various USB block devices 50 /run/udev/data/c18[089]:* r, # various USB character devices: USB serial converters, etc. 51 /run/udev/data/+usb:* r, 52 ` 53 54 const rawusbConnectedPlugSecComp = ` 55 # Description: Allow raw access to all connected USB devices. 56 # This gives privileged access to the system. 57 58 # kernel uevents 59 socket AF_NETLINK - NETLINK_KOBJECT_UEVENT 60 ` 61 62 var rawusbConnectedPlugUDev = []string{ 63 `SUBSYSTEM=="usb"`, 64 `SUBSYSTEM=="usbmisc"`, 65 `SUBSYSTEM=="tty", ENV{ID_BUS}=="usb"`, 66 } 67 68 func init() { 69 registerIface(&commonInterface{ 70 name: "raw-usb", 71 summary: rawusbSummary, 72 implicitOnCore: true, 73 implicitOnClassic: true, 74 baseDeclarationSlots: rawusbBaseDeclarationSlots, 75 connectedPlugAppArmor: rawusbConnectedPlugAppArmor, 76 connectedPlugSecComp: rawusbConnectedPlugSecComp, 77 connectedPlugUDev: rawusbConnectedPlugUDev, 78 }) 79 }