11.5. Creating a custom policy for USB devices

Procedure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to the rules.conf file:

   # usbguard generate-policy --no-hashes > ./rules.conf

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. In the rules.conf file, add, remove, or edit the rules as required by using a text editor. For example, the following rule allows only devices with a single mass storage interface to interact with the system:

   allow with-interface equals { 08:*:* }

   See the usbguard-rules.conf(5) man page for a detailed rule-language description and more examples.

3. Install the updated policy:

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

4. Restart the usbguard daemon to apply your changes:

   # systemctl restart usbguard

Verification

1. Check that your custom rules are in the active policy, for example:

   # usbguard list-rules
   ...
   4: allow with-interface 08:*:*
   ...