tree 126798411e1b3cdff2d24b536253ee3457925598
parent 87f7e0ddfc8fc7f0b561d892934edac654bb20ed
author Rajat Jain <rajatja@google.com> 1604444368 -0800
committer Commit Bot <commit-bot@chromium.org> 1608923297 +0000

pciguard: daemon to secure external PCI devices

Add a daemon to secure external PCI devices. It reacts to different
user session management events (login/logoff/screen locks/unlock),
thunderbolt device udev events, and chrome flag changed events.
We have different policies for authorizing external PCI devices
depending on whether the user is away from chromebook.

BUG=b:167448768,b:171541662,b:172397647
TEST=Tested along with kernel changes that
1) Devices plugged in while system was booted do not show up on PCI bus.
2) Devices plugged in before login do not show up on PCI bus.
3) When user logins, such devices now show up and drivers are bound to
them.
4) When screen locked, the existing devices keep working, but no new
thunderbolt devices are authorized.
5) When screen unlocked they begin to work again.
6) When log off, everything is gone.

Cq-Depend: chromium:2543285,chromium:2551845
Change-Id: I2d306765f2fc186602782de85f45fb6ba4fbd89a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/2591812
Reviewed-by: Todd Broch <tbroch@chromium.org>
Commit-Queue: Rajat Jain <rajatja@google.com>
Tested-by: Rajat Jain <rajatja@google.com>