14.6. Creating a structured custom policy for USB devices

Procédure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to a new .conf file, for example, policy.conf.

   # usbguard generate-policy --no-hashes > ./policy.conf

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. Display the policy.conf file with a text editor of your choice, for example:

   # vi ./policy.conf
   ...
   allow id 04f2:0833 serial "" name "USB Keyboard" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

3. Move selected lines into a separate .conf file.

   Note

   The two digits at the beginning of the file name specify the order in which the daemon reads the configuration files.

   For example, copy the rules for your keyboards into a new .conf file.

   # grep "USB Keyboard" ./policy.conf > ./10keyboards.conf

4. Install the new policy to the /etc/usbguard/rules.d/ directory.

   # install -m 0600 -o root -g root 10keyboards.conf /etc/usbguard/rules.d/10keyboards.conf

5. Move the rest of the lines to a main rules.conf file.

   # grep -v "USB Keyboard" ./policy.conf > ./rules.conf

6. Install the remaining rules.

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

7. Restart the usbguard daemon to apply your changes.

   # systemctl restart usbguard

Vérification

1. Display all active USBGuard rules.

   # usbguard list-rules
   ...
   15: allow id 04f2:0833 serial "" name "USB Keyboard" hash "kxM/iddRe/WSCocgiuQlVs6Dn0VEza7KiHoDeTz0fyg=" parent-hash "2i6ZBJfTl5BakXF7Gba84/Cp1gslnNc1DM6vWQpie3s=" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

2. Display the contents of the rules.conf file and all the .conf files in the /etc/usbguard/rules.d/ directory.

   # cat /etc/usbguard/rules.conf /etc/usbguard/rules.d/*.conf

3. Verify that the active rules contain all the rules from the files and are in the correct order.