mirror of
https://github.com/ben-grande/qusal.git
synced 2024-09-21 09:45:40 +00:00
59 lines
2.5 KiB
Plaintext
59 lines
2.5 KiB
Plaintext
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
## Do not modify this file, create a new policy with with a lower number in the
|
|
## file name instead. For example `30-user.policy`.
|
|
{% if salt['pillar.get']('qvm:sys-usb:mouse-action', 'ask') == 'ask' -%}
|
|
{% set mouse_action = 'ask default_target=dom0' -%}
|
|
{% elif salt['pillar.get']('qvm:sys-usb:mouse-action', 'ask') == 'allow' -%}
|
|
{%- set mouse_action = 'allow' -%}
|
|
{% else -%}
|
|
{%- set mouse_action = 'deny' -%}
|
|
{% endif -%}
|
|
|
|
{% if salt['pillar.get']('qvm:sys-usb:keyboard-action', 'deny') == 'ask' -%}
|
|
{%- set keyboard_action = 'ask default_target=dom0' -%}
|
|
{% elif salt['pillar.get']('qvm:sys-usb:keyboard-action', 'deny') == 'allow' -%}
|
|
{%- set keyboard_action = 'allow' -%}
|
|
{% else -%}
|
|
{%- set keyboard_action = 'deny' -%}
|
|
{% endif -%}
|
|
|
|
{% if salt['pillar.get']('qvm:sys-usb:tablet-action', 'deny') == 'ask' -%}
|
|
{%- set tablet_action = 'ask default_target=dom0' -%}
|
|
{% elif salt['pillar.get']('qvm:sys-usb:tablet-action', 'deny') == 'allow' -%}
|
|
{%- set tablet_action = 'allow' -%}
|
|
{% else -%}
|
|
{%- set tablet_action = 'deny' -%}
|
|
{% endif -%}
|
|
|
|
qubes.InputMouse * @tag:usbvm @adminvm {{ mouse_action }}
|
|
qubes.InputMouse * @tag:usbvm @adminvm deny
|
|
|
|
qubes.InputKeyboard * @tag:usbvm @adminvm {{ keyboard_action }}
|
|
qubes.InputKeyboard * @tag:usbvm @adminvm deny
|
|
|
|
qubes.InputTablet * @tag:usbvm @adminvm {{ tablet_action }}
|
|
qubes.InputTablet * @tag:usbvm @adminvm deny
|
|
|
|
ctap.ClientPin * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
|
|
ctap.ClientPin * @anyvm @default ask user=root default_target=disp-{{ sls_path }}
|
|
ctap.ClientPin * @anyvm @anyvm deny
|
|
|
|
ctap.GetInfo * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
|
|
ctap.GetInfo * @anyvm @default ask user=root default_target=disp-{{ sls_path }}
|
|
ctap.GetInfo * @anyvm @anyvm deny
|
|
|
|
u2f.Authenticate * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
|
|
u2f.Authenticate * @anyvm @default ask user=root default_target=disp-{{ sls_path }}
|
|
u2f.Authenticate * @anyvm @anyvm deny
|
|
|
|
u2f.Register * @anyvm @tag:usbvm ask user=root default_target=disp-{{ sls_path }}
|
|
u2f.Register * @anyvm @default ask user=root default_target=disp-{{ sls_path }}
|
|
u2f.Register * @anyvm @anyvm deny
|
|
|
|
policy.RegisterArgument +u2f.Authenticate @tag:usbvm @anyvm allow target=dom0
|
|
policy.RegisterArgument +u2f.Authenticate @anyvm @anyvm deny
|
|
# vim:ft=qrexecpolicy
|