From: Damien Miller <djm@mindrot.org>
Subject: Re: your mail
To: "Kirill A. Korinsky" <kirill@korins.ky>
Cc: OpenBSD tech <tech@openbsd.org>
Date: Mon, 7 Sep 2026 14:05:10 +1000

ok djm; sorry for missing this in the review

On Sun, 6 Sep 2026, Kirill A. Korinsky wrote:

> tech@,
> 
> my update libfido accidently reverted a hardcoded USB device metadata which
> leads broken pledge in, for example, chromium.
> 
> Ok?
> 
> Index: src/hid_openbsd.c
> ===================================================================
> RCS file: /home/cvs/src/lib/libfido2/src/hid_openbsd.c,v
> diff -u -p -r1.9 hid_openbsd.c
> --- src/hid_openbsd.c	4 Sep 2026 16:20:01 -0000	1.9
> +++ src/hid_openbsd.c	6 Sep 2026 09:52:18 -0000
> @@ -7,9 +7,6 @@
>  
>  #include <sys/types.h>
>  
> -#include <sys/ioctl.h>
> -#include <dev/usb/usb.h>
> -
>  #include <errno.h>
>  #include <fcntl.h>
>  #include <poll.h>
> @@ -32,33 +29,23 @@ static int
>  copy_info(fido_dev_info_t *di, const char *path)
>  {
>  	int fd = -1, ok = -1;
> -	struct usb_device_info udi;
>  
>  	memset(di, 0, sizeof(*di));
> -	memset(&udi, 0, sizeof(udi));
>  
>  	if ((fd = fido_hid_unix_open(path)) == -1)
>  		goto fail;
> -	if (ioctl(fd, USB_GET_DEVICEINFO, &udi) == -1) {
> -		fido_log_error(errno, "%s: ioctl %s", __func__, path);
> -		goto fail;
> -	}
> -
> -	fido_log_debug("%s: %s: bus = 0x%02x, addr = 0x%02x", __func__, path,
> -	    udi.udi_bus, udi.udi_addr);
> -	fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", __func__,
> -	    path, udi.udi_vendor, udi.udi_product);
> -	fido_log_debug("%s: %s: productNo = 0x%04x, vendorNo = 0x%04x, "
> -	    "releaseNo = 0x%04x", __func__, path, udi.udi_productNo,
> -	    udi.udi_vendorNo, udi.udi_releaseNo);
>  
> +	/* USB_GET_DEVICEINFO is not permitted by pledge(2). */
>  	if ((di->path = strdup(path)) == NULL ||
> -	    (di->manufacturer = strdup(udi.udi_vendor)) == NULL ||
> -	    (di->product = strdup(udi.udi_product)) == NULL)
> +	    (di->manufacturer = strdup("OpenBSD")) == NULL ||
> +	    (di->product = strdup("fido(4)")) == NULL)
>  		goto fail;
>  
> -	di->vendor_id = (int16_t)udi.udi_vendorNo;
> -	di->product_id = (int16_t)udi.udi_productNo;
> +	di->vendor_id = 0x0b5d; /* PCI_VENDOR_OPENBSD */
> +	di->product_id = 0;
> +
> +	fido_log_debug("%s: %s: vendor = \"%s\", product = \"%s\"", __func__,
> +	    path, di->manufacturer, di->product);
>  
>  	ok = 0;
>  fail:
> 
> 
> -- 
> wbr, Kirill
>