faukah/nichts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

usbguard: add enable option, enable on temperance

Browse source
This commit is contained in:
Charlie Root 2025-04-06 23:17:40 +02:00
commit 41b3d31129
Signed by: faukah
SSH key fingerprint: SHA256:Uj2AXqvtdCA4hn5Hq0ZonhIAyUqI1q4w2sMG3Z1TH7E
2 changed files with 20 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

31
modules/services/usbguard/module.nix
View file

@ -5,19 +5,26 @@
...
}: let
inherit (config.meta.mainUser) username;
inherit (lib.modules) mkIf;
inherit (lib.options) mkEnableOption;
cfg = config.modules.services.usbguard;
in {
environment.systemPackages = [pkgs.usbguard];
services.usbguard = {
IPCAllowedUsers = ["root" "${username}"];
presentDevicePolicy = "allow";
rules = ''
allow with-interface equals { 08:*:* }
options.modules.services.usbguard.enable = mkEnableOption "usbguard";
config = mkIf cfg.enable {
environment.systemPackages = [pkgs.usbguard];
services.usbguard = {
enable = true;
IPCAllowedUsers = ["root" "${username}"];
presentDevicePolicy = "allow";
rules = ''
allow with-interface equals { 08:*:* }
# Reject devices with suspicious combination of interfaces
reject with-interface all-of { 08:*:* 03:00:* }
reject with-interface all-of { 08:*:* 03:01:* }
reject with-interface all-of { 08:*:* e0:*:* }
reject with-interface all-of { 08:*:* 02:*:* }
'';
# Reject devices with suspicious combination of interfaces
reject with-interface all-of { 08:*:* 03:00:* }
reject with-interface all-of { 08:*:* 03:01:* }
reject with-interface all-of { 08:*:* e0:*:* }
reject with-interface all-of { 08:*:* 02:*:* }
'';
};
};
}