Article Summary: This article should point out the need for protecting against unknown or malicious USB devices, teach the user to install and enable usbguard-dbus, teach how to do the initial setup and then how to add extra devices.
It should also point out for the user to be careful as, unless the keyboard and mouse are attached (such as on a laptop) or they can be connected via PS/2, misconfiguration might make the device temporarily unusable.
Article Description:
Nowadays you can’t really trust any USB device, malicious devices that appear to be something but are actually only spoofing a safe appearance and are actually malicious are common.
You might not really trust just anyone to plug a USB device on a important device if you don’t trust them enough.
There’s also the problem where you might for some reason to leave the device unattended and can’t guarantee no unauthorized person might have access.
Well, GNOME has integration with usbguard, which works similar to this:
- On boot, by default all USB devices are blocked except the ones on the allowlist
- Once you are logged in, GNOME temporarily disables usbguard (i.e. puts into a state where it allow any new device)
- On the lock screen the following behavior appears:
- For devices on the allowlist: the device will work and a notification will pop up on unlock about a known device being reconnected
- For a device not on the allowlist (possibly similar behavior for the ones on blocklist): the device will not work, possibly a notification pops up as well
- Once unlocked, GNOME disables usbguard again (the same state as mentioned before)
The user would be required to run a command which gets all current USB devices (inclusing system ones) and they will be taught on how to edit that config to add new devices.
A disclaimer should be available indicating that the procedure is risky on some devices due to the possibility of making the system unable to detect the user’s mouse or USB
The steps for the tutorial will be done on a Fedora (wither Workstation or Silverblue) VM with a mouse being used via spice passthrough