github.com/rigado/snapd@v2.42.5-go-mod+incompatible/interfaces/builtin/raw_usb.go (about) 1 // -*- Mode: Go; indent-tabs-mode: t -*- 2 3 /* 4 * Copyright (C) 2017 Canonical Ltd 5 * 6 * This program is free software: you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 3 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License 16 * along with this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 */ 19 20 package builtin 21 22 const rawusbSummary = `allows raw access to all USB devices` 23 24 const rawusbBaseDeclarationSlots = ` 25 raw-usb: 26 allow-installation: 27 slot-snap-type: 28 - core 29 deny-auto-connection: true 30 ` 31 32 const rawusbConnectedPlugAppArmor = ` 33 # Description: Allow raw access to all connected USB devices. 34 # This gives privileged access to the system. 35 /dev/bus/usb/[0-9][0-9][0-9]/[0-9][0-9][0-9] rw, 36 37 # Allow access to all ttyUSB devices too 38 /dev/tty{USB,ACM}[0-9]* rwk, 39 40 # Allow detection of usb devices. Leaks plugged in USB device info 41 /sys/bus/usb/devices/ r, 42 /sys/devices/pci**/usb[0-9]** r, 43 /sys/devices/platform/soc/*.usb/usb[0-9]** r, 44 45 /run/udev/data/c16[67]:[0-9] r, # ACM USB modems 46 /run/udev/data/b180:* r, # various USB block devices 47 /run/udev/data/c18[089]:* r, # various USB character devices: USB serial converters, etc. 48 /run/udev/data/+usb:* r, 49 ` 50 51 const rawusbConnectedPlugSecComp = ` 52 # Description: Allow raw access to all connected USB devices. 53 # This gives privileged access to the system. 54 55 # kernel uevents 56 socket AF_NETLINK - NETLINK_KOBJECT_UEVENT 57 ` 58 59 var rawusbConnectedPlugUDev = []string{ 60 `SUBSYSTEM=="usb"`, 61 `SUBSYSTEM=="tty", ENV{ID_BUS}=="usb"`, 62 } 63 64 func init() { 65 registerIface(&commonInterface{ 66 name: "raw-usb", 67 summary: rawusbSummary, 68 implicitOnCore: true, 69 implicitOnClassic: true, 70 baseDeclarationSlots: rawusbBaseDeclarationSlots, 71 connectedPlugAppArmor: rawusbConnectedPlugAppArmor, 72 connectedPlugSecComp: rawusbConnectedPlugSecComp, 73 connectedPlugUDev: rawusbConnectedPlugUDev, 74 reservedForOS: true, 75 }) 76 }