Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security purposes, is it possible to have the operating system enforce a whitelist of hardware devices?

This means that plugged in devices that are not in the whitelist will be ignored at an as low a level as possible (so that higher level abstractions in the OS will not even find out about these non-whitelisted devices).

I'm using Ubuntu 11.04, but I'm guessing whatever solution you may have will work on almost any recent Linux distribution.

share|improve this question
Linux doesn't work that way. – Ignacio Vazquez-Abrams May 21 '11 at 4:44
What do you mean? It certainly "works" for Linux to have USB vulnerabilities for example:… Also, I'm pretty sure this can be done by making custom changes to my kernel. I just wanted to know whether someone has already done this. Given that there's no shortage of such vulnerabilities (see above), I'd be surprised if something like this doesn't already exist. – user67834 May 21 '11 at 5:41
why not compile a custom kernel with only the hardware you want to support? – freethinker May 21 '11 at 5:48
I remember that you can use UDEV rules to ignore plugged in USB devices. Might be worth a try. – Turbo J May 21 '11 at 16:57
Thanks, I'll take a look at UDEV. About the custom kernel with only some hardware supported, I'm not sure this would be enough. Bear in mind that my knowledge about kernel internals is limited, but what I want is a whitelist for each specific hardware item (based on something like a hardware ID) and not for a global category of items. I think that with that solution, some drivers would support an entire category of items. – user67834 May 21 '11 at 19:18

When device gets added to the system, kernel asks usermode for appropriate driver by calling /sbin/hotplug as root (UID 0). Hotplug usually just calls insmod(8) with appropriate .ko file, but you may hack it to perform some filtering based on hardware ID (passed in the environment).

Of course, you'll need to protect insmod(8) from being called directly by unprivileged users and make sure ko driver is unloaded after device detachment (/sbin/hotplug gets called for that event too).

share|improve this answer

You must log in to answer this question.