* SECURITY UPDATE: privilege escalation via improper access control
- debian/patches/CVE-2020-0556-1.patch: HOGP must only accept data from
bonded devices in profiles/input/hog.c.
- debian/patches/CVE-2020-0556-2.patch: HID accepts bonded device
connections only in profiles/input/device.c, profiles/input/device.h,
profiles/input/input.conf, profiles/input/manager.c.
- debian/patches/CVE-2020-0556-3.patch: attempt to set security level
if not bonded in profiles/input/hog.c.
- debian/patches/CVE-2020-0556-4.patch: add LEAutoSecurity setting to
input.conf in profiles/input/device.h, profiles/input/hog.c,
profiles/input/input.conf, profiles/input/manager.c.
- CVE-2020-0556
05d1bb8...
by
Luiz Augusto von Dentz <email address hidden>
input: Add LEAutoSecurity setting to input.conf
LEAutoSecurity can be used to enable/disable automatic upgrades of
security for LE devices, by default it is enabled so existing devices
that did not require security and were not bonded will automatically
upgrade the security.
Note: Platforms disabling this setting would require users to manually
bond the device which may require changes to the user interface to
always force bonding for input devices as APIs such as Device.Connect
will no longer work which maybe perceived as a regression.
b5ce2e1...
by
Luiz Augusto von Dentz <email address hidden>
input: hog: Attempt to set security level if not bonded
This attempts to set the security if the device is not bonded, the
kernel will block any communication on the ATT socket while bumping
the security and if that fails the device will be disconnected which
is better than having the device dangling around without being able to
communicate with it until it is properly bonded.
af9fd50...
by
Alain Michaud <email address hidden>
HID accepts bonded device connections only.
This change adds a configuration for platforms to choose a more secure
posture for the HID profile. While some older mice are known to not
support pairing or encryption, some platform may choose a more secure
posture by requiring the device to be bonded and require the
connection to be encrypted when bonding is required.
Add autogen.sh script to force Makefile regeneration
As we're basing off an upstream release tarball we have a ready built
configure script already available but do modifications on top which
doesn't trigger a recreation of the involved Makefiles. Having a
autogen.sh file available tells the snapcraft autotools plugin to run
it and with that force a regeneration of the Makefile's.
