qusal/salt/sys-usb/files/admin/policy/default.policy

# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
#
# SPDX-License-Identifier: AGPL-3.0-or-later

## Do not modify this file, create a new policy with with a lower number in the
## file name instead. For example `30-user.policy`.
{% if salt['pillar.get']('qvm:sys-usb:mouse-action', 'ask') == 'ask' -%}
  {% set mouse_action = 'ask default_target=dom0' -%}
{% elif salt['pillar.get']('qvm:sys-usb:mouse-action', 'ask') == 'allow' -%}
  {%- set mouse_action = 'allow' -%}
{% else -%}
  {%- set mouse_action = 'deny' -%}
{% endif -%}

{% if salt['pillar.get']('qvm:sys-usb:keyboard-action', 'deny') == 'ask' -%}
  {%- set keyboard_action = 'ask default_target=dom0' -%}
{% elif salt['pillar.get']('qvm:sys-usb:keyboard-action', 'deny') == 'allow' -%}
  {%- set keyboard_action = 'allow' -%}
{% else -%}
  {%- set keyboard_action = 'deny' -%}
{% endif -%}

{% if salt['pillar.get']('qvm:sys-usb:tablet-action', 'deny') == 'ask' -%}
  {%- set tablet_action = 'ask default_target=dom0' -%}
{% elif salt['pillar.get']('qvm:sys-usb:tablet-action', 'deny') == 'allow' -%}
  {%- set tablet_action = 'allow' -%}
{% else -%}
  {%- set tablet_action = 'deny' -%}
{% endif -%}

qubes.InputMouse    * @tag:usbvm @adminvm {{ mouse_action }}
qubes.InputMouse    * @tag:usbvm @adminvm deny

qubes.InputKeyboard * @tag:usbvm @adminvm {{ keyboard_action }}
qubes.InputKeyboard * @tag:usbvm @adminvm deny

qubes.InputTablet   * @tag:usbvm @adminvm {{ tablet_action }}
qubes.InputTablet   * @tag:usbvm @adminvm deny

ctap.ClientPin   * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
ctap.ClientPin   * @anyvm @default   ask user=root default_target=disp-{{ sls_path }}
ctap.ClientPin   * @anyvm @anyvm     deny

ctap.GetInfo     * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
ctap.GetInfo     * @anyvm @default   ask user=root default_target=disp-{{ sls_path }}
ctap.GetInfo     * @anyvm @anyvm     deny

u2f.Authenticate * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
u2f.Authenticate * @anyvm @default   ask user=root default_target=disp-{{ sls_path }}
u2f.Authenticate * @anyvm @anyvm     deny

u2f.Register     * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
u2f.Register     * @anyvm @default   ask user=root default_target=disp-{{ sls_path }}
u2f.Register     * @anyvm @anyvm     deny

policy.RegisterArgument +u2f.Authenticate @tag:usbvm @anyvm allow target=dom0
policy.RegisterArgument +u2f.Authenticate @anyvm     @anyvm deny
# vim:ft=qrexecpolicy