11.6. Creating a structured custom policy for USB devices

Procedure

1. Create a policy which authorizes the currently connected USB devices, and store the generated rules to a new .conf file, for example, <policy.conf>.

   # usbguard generate-policy --no-hashes > ./<policy.conf>

   The --no-hashes option does not generate hash attributes for devices. Avoid hash attributes in your configuration settings because they might not be persistent.

2. Open the <policy.conf> file with a text editor of your choice, and select the lines with the rules that you want to record, for example:

   ...
   allow id 04f2:0833 serial "" name "USB Keyboard" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

3. Copy the selected lines into a separate .conf file.

   참고

   The two digits at the beginning of the file name specify the order in which the daemon reads the configuration files.

   For example, to copy the rules for your keyboards into a new .conf file:

   # grep "USB Keyboard" ./<policy.conf> > ./<10keyboards.conf>

4. Install the new policy to the /etc/usbguard/rules.d/ directory.

   # install -m 0600 -o root -g root <10keyboards.conf> /etc/usbguard/rules.d/<10keyboards.conf>

5. Move the rest of the lines to the main rules.conf file.

   # grep -v "USB Keyboard" ./policy.conf > ./rules.conf

6. Install the remaining rules.

   # install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf

7. Restart the usbguard daemon to apply your changes.

   # systemctl restart usbguard

Verification

1. Display all active USBGuard rules.

   # usbguard list-rules
   ...
   15: allow id 04f2:0833 serial "" name "USB Keyboard" hash "kxM/iddRe/WSCocgiuQlVs6Dn0VEza7KiHoDeTz0fyg=" parent-hash "2i6ZBJfTl5BakXF7Gba84/Cp1gslnNc1DM6vWQpie3s=" via-port "7-2" with-interface { 03:01:01 03:00:00 } with-connect-type "unknown"
   ...

2. Display the contents of the rules.conf file and all the .conf files in the /etc/usbguard/rules.d/ directory.

   # cat /etc/usbguard/rules.conf /etc/usbguard/rules.d/*.conf

3. Verify that the active rules contain all the rules from the files and are in the correct order.