faukah/nichts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

usbguard: add enable option, enable on temperance

Browse source
This commit is contained in:
Charlie Root 2025-04-06 23:17:40 +02:00
commit 41b3d31129
Signed by: faukah
SSH key fingerprint: SHA256:Uj2AXqvtdCA4hn5Hq0ZonhIAyUqI1q4w2sMG3Z1TH7E
2 changed files with 20 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/temperance/configuration.nix
View file

@ -80,6 +80,7 @@ in {
services = { services = {
locate.enable = true; locate.enable = true;
usbguard.enable = true;
media.mpd = { media.mpd = {
enable = true; enable = true;

31
modules/services/usbguard/module.nix
View file

@ -5,19 +5,26 @@
... ...
}: let }: let
inherit (config.meta.mainUser) username; inherit (config.meta.mainUser) username;
inherit (lib.modules) mkIf;
inherit (lib.options) mkEnableOption;
cfg = config.modules.services.usbguard;
in { in {
environment.systemPackages = [pkgs.usbguard]; options.modules.services.usbguard.enable = mkEnableOption "usbguard";
services.usbguard = { config = mkIf cfg.enable {
IPCAllowedUsers = ["root" "${username}"]; environment.systemPackages = [pkgs.usbguard];
presentDevicePolicy = "allow"; services.usbguard = {
rules = '' enable = true;
allow with-interface equals { 08:*:* } IPCAllowedUsers = ["root" "${username}"];
presentDevicePolicy = "allow";
rules = ''
allow with-interface equals { 08:*:* }
# Reject devices with suspicious combination of interfaces # Reject devices with suspicious combination of interfaces
reject with-interface all-of { 08:*:* 03:00:* } reject with-interface all-of { 08:*:* 03:00:* }
reject with-interface all-of { 08:*:* 03:01:* } reject with-interface all-of { 08:*:* 03:01:* }
reject with-interface all-of { 08:*:* e0:*:* } reject with-interface all-of { 08:*:* e0:*:* }
reject with-interface all-of { 08:*:* 02:*:* } reject with-interface all-of { 08:*:* 02:*:* }
''; '';
};
}; };
} }