Bloxx12
e641dfa114
Signed-off-by: Bloxx12 <charlie@charlieroot.dev> Change-Id: I6a6a69641c36f9763e104087a559c148d0449f00
35 lines
887 B
Nix
35 lines
887 B
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
inherit (config.meta.mainUser) username;
|
|
inherit (lib.modules) mkIf;
|
|
inherit (lib.options) mkEnableOption;
|
|
cfg = config.modules.services.usbguard;
|
|
in
|
|
{
|
|
options.modules.services.usbguard.enable = mkEnableOption "usbguard";
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.usbguard ];
|
|
services.usbguard = {
|
|
enable = true;
|
|
IPCAllowedUsers = [
|
|
"root"
|
|
"${username}"
|
|
];
|
|
presentDevicePolicy = "allow";
|
|
rules = ''
|
|
allow with-interface equals { 08:*:* }
|
|
|
|
# Reject devices with suspicious combination of interfaces
|
|
reject with-interface all-of { 08:*:* 03:00:* }
|
|
reject with-interface all-of { 08:*:* 03:01:* }
|
|
reject with-interface all-of { 08:*:* e0:*:* }
|
|
reject with-interface all-of { 08:*:* 02:*:* }
|
|
'';
|
|
};
|
|
};
|
|
}
|