[Spice-devel] usbfilter for USB Select dialog

[Snir Sheriber]

Hi,


On 06/05/2017 04:53 AM, leaboy wrote:
> hi,
> On the server side, it just control the USB connection  is on or off, 
> can not
> control some USB type can be use or not.

Server side can also use the USB filter string, please look here:
https://www.spice-space.org/usbredir.html
under "Host Filtering"

Hope this helps :)

> For Example:
> case 1. I’m a admin user, I don’t want client user to use storage 
> device and can
>     use other usb device. the server side can’t handle it.
>
> case 2. I’m a admin user, I don’t want client user to use storage 
> device, but I
>     want let them use a storage device  assigned by VID:PID, which device
>     I have a authentication. the server side can’t handle it.
>
> so, I think this feature is worth useful. and make full use of the usb 
> filter
>
> My code diff is simple & rude, ^_^, so, like you said, add a cmd line 
> option is better.
>
>> On 4 Jun 2017, at 17:55, Snir Sheriber <ssheribe at redhat.com 
>> <mailto:ssheribe at redhat.com>> wrote:
>>
>> Hi,
>>
>>
>> On 06/02/2017 12:52 PM, leaboy wrote:
>>> hello, everyone.
>>> I found if I disable some USB device use usb_filter, it’s just take 
>>> effect for the auto_connect.
>>> but when I open the USBSelectDialog, I can see the disabled device, 
>>> and even I can checked it.
>>> So, I just modified a little code let the disabled device disappear 
>>> in the USBSelectDialog.
>>
>> The auto-connect filter is used to filter already plugged in USB 
>> devices from auto-connect
>> to the guest after spice connection has established.
>> Sorry it is not clear from the documentation, i will update it.
>>
>> Thank you for this suggestion:), though IMO (since currently it does 
>> what it supposed to) , if the
>> user decide to redirect a USB device during the spice session he 
>> should still have the option to
>> select & redirect each one of the connected devices on the client's 
>> machine. But if you still find this
>> feature useful i would say it should be in new cmd line option like 
>> --spice-usb-filter or something.
>>
>> BTW, on the server side you can determine to block USB devices, i 
>> think it should make them disabled
>> on the client's USBSelectDialog.
>>
>> Thanks, Snir.
>>
>>>
>>> the code diff is:
>>>
>>> diff --git a/spice-common b/spice-common
>>> --- a/spice-common
>>> +++ b/spice-common
>>> @@ -1 +1 @@
>>> -Subproject commit af682b1b06dea55007d9aa7c37cd443e4349e43f
>>> +Subproject commit af682b1b06dea55007d9aa7c37cd443e4349e43f-dirty
>>> diff --git a/src/usb-device-manager.c b/src/usb-device-manager.c
>>> index bbe2391..1645497 100644
>>> --- a/src/usb-device-manager.c
>>> +++ b/src/usb-device-manager.c
>>> @@ -966,6 +966,19 @@ static void 
>>> spice_usb_device_manager_add_dev(SpiceUsbDeviceManager  *self,
>>>                                     device, NULL,
>>>                                     spice_usb_device_manager_auto_connect_cb,
>>>                                     spice_usb_device_ref(device));
>>> +    }else{
>>> +        gboolean auto_ok;
>>> +        auto_ok = usbredirhost_check_device_filter(
>>> +                            priv->auto_conn_filter_rules,
>>> +                            priv->auto_conn_filter_rules_count,
>>> +                            libdev, 0) == 0;
>>> +        if (!auto_ok){
>>> +            SPICE_DEBUG("device denied %04x:%04x (%p)",
>>> +                spice_usb_device_get_vid(device),
>>> +                spice_usb_device_get_pid(device),
>>> +                device);
>>> +            return;
>>> +        }
>>>      }
>>>        SPICE_DEBUG("device added %04x:%04x (%p)",
>>> @@ -1348,7 +1361,11 @@ GPtrArray* 
>>> spice_usb_device_manager_get_devices_with_filter(
>>>   */
>>>  GPtrArray* 
>>> spice_usb_device_manager_get_devices(SpiceUsbDeviceManager *self)
>>>  {
>>> -    return spice_usb_device_manager_get_devices_with_filter(self, 
>>> NULL);
>>> +    SpiceUsbDeviceManager *udm = SPICE_USB_DEVICE_MANAGER(self);
>>> +    SpiceUsbDeviceManagerPrivate *udm_priv;
>>> +    udm_priv = udm->priv;
>>> +
>>> +    return spice_usb_device_manager_get_devices_with_filter(self, 
>>> udm_priv->auto_connect_filter);
>>>  }
>>>
>>>
>>> _______________________________________________
>>> Spice-devel mailing list
>>> Spice-devel at lists.freedesktop.org 
>>> <mailto:Spice-devel at lists.freedesktop.org>
>>> https://lists.freedesktop.org/mailman/listinfo/spice-devel
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20170605/54465bfd/attachment.html>