summaryrefslogtreecommitdiff
path: root/sys/arch/hppa
diff options
context:
space:
mode:
authorReyk Floeter <reyk@cvs.openbsd.org>2019-12-17 13:08:57 +0000
committerReyk Floeter <reyk@cvs.openbsd.org>2019-12-17 13:08:57 +0000
commit93c5a80cd9505a17528ed97b6fc75b8a12a2adc6 (patch)
treeb744b8472950e501afef29498928e14ae3b24652 /sys/arch/hppa
parent3a713a9a6753ac8aa6d5e955f64f8b47b79e516a (diff)
Add fido(4), a HID driver for FIDO/U2F security keys
While FIDO/U2F keys were already supported by the generic uhid(4) driver, this driver adds the first step to tighten the security of FIDO/U2F access. Specifically, users don't need read/write access to all USB/HID devices anymore and the driver also improves integration with pledge(2) and unveil(2): It is pledge-friendly because it doesn't require any ioctls to discover the device and unveil-friendly because it uses a single /dev/fido/* directory for its device nodes. It also allows to support FIDO/U2F in firefox without further weakening the "sandbox" of the browser. Firefox does not have a proper privsep design and many operations, such as U2F access, are handled directly by the main process. This means that the browser's "fat" main process needs direct read/write access to all USB HID devices, at least on other operating systems. With fido(4) we can support security keys in Firefox under OpenBSD without such a compromise. With this change, libfido2 stops using the ioctl to query the device vendor/product and just assumes "OpenBSD" "fido(4)" instead. The ioctl is still supported but there was no benefit in obtaining the vendor product or name; it also allows to use libfido2 under pledge. With feedback from deraadt@ and many others OK kettenis@ djm@ and jmc@ for the manpage bits
Diffstat (limited to 'sys/arch/hppa')
-rw-r--r--sys/arch/hppa/conf/GENERIC3
-rw-r--r--sys/arch/hppa/hppa/conf.c4
2 files changed, 5 insertions, 2 deletions
diff --git a/sys/arch/hppa/conf/GENERIC b/sys/arch/hppa/conf/GENERIC
index 30c6ca305d8..d1fb312f04c 100644
--- a/sys/arch/hppa/conf/GENERIC
+++ b/sys/arch/hppa/conf/GENERIC
@@ -1,4 +1,4 @@
-# $OpenBSD: GENERIC,v 1.179 2019/05/08 23:54:39 kettenis Exp $
+# $OpenBSD: GENERIC,v 1.180 2019/12/17 13:08:55 reyk Exp $
#
# For further information on compiling OpenBSD kernels, see the config(8)
# man page.
@@ -110,6 +110,7 @@ wsmouse* at ums? mux 0
ukbd* at uhidev? # USB keyboard
wskbd* at ukbd? mux 1
uhid* at uhidev? # USB generic HID support
+fido* at uhidev? # FIDO/U2F security key support
upd* at uhidev? # USB Power Devices sensors
aue* at uhub? # ADMtek AN986 Pegasus Ethernet
url* at uhub? # Realtek RTL8150L based adapters
diff --git a/sys/arch/hppa/hppa/conf.c b/sys/arch/hppa/hppa/conf.c
index 11766084833..ff36e34aca4 100644
--- a/sys/arch/hppa/hppa/conf.c
+++ b/sys/arch/hppa/hppa/conf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf.c,v 1.66 2016/09/04 10:51:23 naddy Exp $ */
+/* $OpenBSD: conf.c,v 1.67 2019/12/17 13:08:55 reyk Exp $ */
/*-
* Copyright (c) 1991 The Regents of the University of California.
@@ -111,6 +111,7 @@ cdev_decl(pci);
#include "usb.h"
#include "uhid.h"
+#include "fido.h"
#include "ugen.h"
#include "ulpt.h"
#include "ucom.h"
@@ -186,6 +187,7 @@ struct cdevsw cdevsw[] =
cdev_fuse_init(NFUSE,fuse), /* 58: fuse */
cdev_tun_init(NTUN,tap), /* 59: Ethernet network tunnel */
cdev_switch_init(NSWITCH,switch), /* 60: switch(4) control interface */
+ cdev_fido_init(NFIDO,fido), /* 61: FIDO/U2F security key */
};
int nchrdev = nitems(cdevsw);