Chapter 13. Protecting systems against intrusive USB devices

Procedure

1. Install the usbguard package:

   # yum install usbguard

   Copy to Clipboard Toggle word wrap

2. Create an initial rule set:

   # usbguard generate-policy > /etc/usbguard/rules.conf

   Copy to Clipboard Toggle word wrap

3. Start the usbguard daemon and ensure that it starts automatically on boot:

   # systemctl enable --now usbguard

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the usbguard service is running:

   # systemctl status usbguard
   ● usbguard.service - USBGuard daemon
      Loaded: loaded (/usr/lib/systemd/system/usbguard.service; enabled; vendor preset: disabled)
      Active: active (running) since Thu 2019-11-07 09:44:07 CET; 3min 16s ago
        Docs: man:usbguard-daemon(8)
    Main PID: 6122 (usbguard-daemon)
       Tasks: 3 (limit: 11493)
      Memory: 1.2M
      CGroup: /system.slice/usbguard.service
              └─6122 /usr/sbin/usbguard-daemon -f -s -c /etc/usbguard/usbguard-daemon.conf
   
   Nov 07 09:44:06 localhost.localdomain systemd[1]: Starting USBGuard daemon...
   Nov 07 09:44:07 localhost.localdomain systemd[1]: Started USBGuard daemon.

   Copy to Clipboard Toggle word wrap

2. List USB devices recognized by USBGuard:

   # usbguard list-devices
   4: allow id 1d6b:0002 serial "0000:02:00.0" name "xHCI Host Controller" hash...

   Copy to Clipboard Toggle word wrap

Procedure

1. List USB devices recognized by USBGuard, for example:

   # usbguard list-devices
   1: allow id 1d6b:0002 serial "0000:00:06.7" name "EHCI Host Controller" hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" parent-hash "4PHGcaDKWtPjKDwYpIRG722cB9SlGz9l9Iea93+Gt9c=" via-port "usb1" with-interface 09:00:00
   ...
   6: block id 1b1c:1ab1 serial "000024937962" name "Voyager" hash "CrXgiaWIf2bZAU+5WkzOE7y0rdSO82XMzubn7HDb95Q=" parent-hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" via-port "1-3" with-interface 08:06:50

   Copy to Clipboard Toggle word wrap

2. Authorize the device <6> to interact with the system:

   # usbguard allow-device <6>

   Copy to Clipboard Toggle word wrap

3. Deauthorize and remove the device <6>:

   # usbguard reject-device <6>

   Copy to Clipboard Toggle word wrap

4. Deauthorize and retain the device <6>:

   # usbguard block-device <6>

   Copy to Clipboard Toggle word wrap

Procedure

1. Configure SELinux to allow the usbguard daemon to write rules.

   1. Display the semanage Booleans relevant to usbguard.

      # semanage boolean -l | grep usbguard
      usbguard_daemon_write_conf     (off  ,  off)  Allow usbguard to daemon write conf
      usbguard_daemon_write_rules    (on   ,   on)  Allow usbguard to daemon write rules

      Copy to Clipboard Toggle word wrap

   2. Optional: If the usbguard_daemon_write_rules Boolean is turned off, turn it on.

      # semanage boolean -m --on usbguard_daemon_write_rules

      Copy to Clipboard Toggle word wrap

2. List USB devices recognized by USBGuard:

   # usbguard list-devices
   1: allow id 1d6b:0002 serial "0000:00:06.7" name "EHCI Host Controller" hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" parent-hash "4PHGcaDKWtPjKDwYpIRG722cB9SlGz9l9Iea93+Gt9c=" via-port "usb1" with-interface 09:00:00
   ...
   6: block id 1b1c:1ab1 serial "000024937962" name "Voyager" hash "CrXgiaWIf2bZAU+5WkzOE7y0rdSO82XMzubn7HDb95Q=" parent-hash "JDOb0BiktYs2ct3mSQKopnOOV2h9MGYADwhT+oUtF2s=" via-port "1-3" with-interface 08:06:50

   Copy to Clipboard Toggle word wrap

3. Permanently authorize device 6 to interact with the system:

   # usbguard allow-device 6 -p

   Copy to Clipboard Toggle word wrap

4. Permanently deauthorize and remove device 6:

   # usbguard reject-device 6 -p

   Copy to Clipboard Toggle word wrap

5. Permanently deauthorize and retain device 6:

   # usbguard block-device 6 -p

   Copy to Clipboard Toggle word wrap

Verification

1. Check that USBGuard rules include the changes you made.

   # usbguard list-rules

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to the rules.conf file:

   # usbguard generate-policy --no-hashes > ./rules.conf

   Copy to Clipboard Toggle word wrap

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. Edit the rules.conf file with a text editor of your choice, for example:

   # vi ./rules.conf

   Copy to Clipboard Toggle word wrap

3. Add, remove, or edit the rules as required. For example, the following rule allows only devices with a single mass storage interface to interact with the system:

   allow with-interface equals { 08:*:* }

   Copy to Clipboard Toggle word wrap

   See the usbguard-rules.conf(5) man page for a detailed rule-language description and more examples.

4. Install the updated policy:

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

   Copy to Clipboard Toggle word wrap

5. Restart the usbguard daemon to apply your changes:

   # systemctl restart usbguard

   Copy to Clipboard Toggle word wrap

Verification

1. Check that your custom rules are in the active policy, for example:

   # usbguard list-rules
   ...
   4: allow with-interface 08:*:*
   ...

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to a new .conf file, for example, policy.conf.

   # usbguard generate-policy --no-hashes > ./policy.conf

   Copy to Clipboard Toggle word wrap

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. Display the policy.conf file with a text editor of your choice, for example:

   # vi ./policy.conf
   ...
   allow id 04f2:0833 serial "" name "USB Keyboard" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

   Copy to Clipboard Toggle word wrap

3. Move selected lines into a separate .conf file.

   Note

   The two digits at the beginning of the file name specify the order in which the daemon reads the configuration files.

   For example, copy the rules for your keyboards into a new .conf file.

   # grep "USB Keyboard" ./policy.conf > ./10keyboards.conf

   Copy to Clipboard Toggle word wrap

4. Install the new policy to the /etc/usbguard/rules.d/ directory.

   # install -m 0600 -o root -g root 10keyboards.conf /etc/usbguard/rules.d/10keyboards.conf

   Copy to Clipboard Toggle word wrap

5. Move the rest of the lines to a main rules.conf file.

   # grep -v "USB Keyboard" ./policy.conf > ./rules.conf

   Copy to Clipboard Toggle word wrap

6. Install the remaining rules.

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

   Copy to Clipboard Toggle word wrap

7. Restart the usbguard daemon to apply your changes.

   # systemctl restart usbguard

   Copy to Clipboard Toggle word wrap

Verification

1. Display all active USBGuard rules.

   # usbguard list-rules
   ...
   15: allow id 04f2:0833 serial "" name "USB Keyboard" hash "kxM/iddRe/WSCocgiuQlVs6Dn0VEza7KiHoDeTz0fyg=" parent-hash "2i6ZBJfTl5BakXF7Gba84/Cp1gslnNc1DM6vWQpie3s=" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

   Copy to Clipboard Toggle word wrap

2. Display the contents of the rules.conf file and all the .conf files in the /etc/usbguard/rules.d/ directory.

   # cat /etc/usbguard/rules.conf /etc/usbguard/rules.d/*.conf

   Copy to Clipboard Toggle word wrap
3. Verify that the active rules contain all the rules from the files and are in the correct order.

Procedure

1. Edit the /etc/usbguard/usbguard-daemon.conf file with a text editor of your choice:

   # vi /etc/usbguard/usbguard-daemon.conf

   Copy to Clipboard Toggle word wrap

2. For example, add a line with a rule that allows all users in the wheel group to use the IPC interface, and save the file:

   IPCAllowGroups=wheel

   Copy to Clipboard Toggle word wrap

3. You can add users or groups also with the usbguard command. For example, the following command enables the joesec user to have full access to the Devices and Exceptions sections. Furthermore, joesec can list and modify the current policy:

   # usbguard add-user joesec --devices ALL --policy modify,list --exceptions ALL

   Copy to Clipboard Toggle word wrap

   To remove the granted permissions for the joesec user, use the usbguard remove-user joesec command.

4. Restart the usbguard daemon to apply your changes:

   # systemctl restart usbguard

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the usbguard-daemon.conf file with a text editor of your choice:

   # vi /etc/usbguard/usbguard-daemon.conf

   Copy to Clipboard Toggle word wrap

2. Change the AuditBackend option from FileAudit to LinuxAudit:

   AuditBackend=LinuxAudit

   Copy to Clipboard Toggle word wrap

3. Restart the usbguard daemon to apply the configuration change:

   # systemctl restart usbguard

   Copy to Clipboard Toggle word wrap

Verification

1. Query the audit daemon log for a USB authorization event, for example:

   # ausearch -ts recent -m USER_DEVICE

   Copy to Clipboard Toggle word wrap