14.5. Creating a custom policy for USB devices

Procédure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to the rules.conf file:

   # usbguard generate-policy --no-hashes > ./rules.conf

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. Edit the rules.conf file with a text editor of your choice, for example:

   # vi ./rules.conf

3. Add, remove, or edit the rules as required. For example, the following rule allows only devices with a single mass storage interface to interact with the system:

   allow with-interface equals { 08:*:* }

   See the usbguard-rules.conf(5) man page for a detailed rule-language description and more examples.

4. Install the updated policy:

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

5. Restart the usbguard daemon to apply your changes:

   # systemctl restart usbguard

Vérification

1. Check that your custom rules are in the active policy, for example:

   # usbguard list-rules
   ...
   4: allow with-interface 08:*:*
   ...