Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-27 16:40:53 -05:00
Code Issues Projects Releases Packages Wiki Activity

Enable USB video and audio devices, reject USB RNDIS devices

Browse source
This commit is contained in:
Aaron Rainbolt 2025-08-28 16:42:16 -05:00
parent b95598b6f7
commit 85fd8ea52b
No known key found for this signature in database
GPG key ID: A709160D73C79109
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
etc/usbguard/rules.d/30_security-misc.conf
View file

@ -19,6 +19,15 @@ allow with-interface equals { 03:01:02 } if !allowed-matches(with-interface equa
## and keyboards. Also note, all HID devices other than mice and keyboards
## will be blocked, **including touchscreens.**
## Allow USB audio devices. The intended functionality of these devices is
## unlikely to be usable in a malicious capacity without having already
## compromised the machine.
allow with-interface equals { 01:*:* }
## Allow USB video devices (i.e. webcams). Also tricky to use in a malicious
## manner without having already compromised the machine.
allow with-interface equals { 0e:*:* }
## Explicitly reject any device with a mouse/keyboard interface in
## combination with some other interface.
## Mice and keyboards should likely never have non-HID interfaces provided
@ -48,6 +57,10 @@ reject with-interface all-of { 03:*:* ef:*:* }
reject with-interface all-of { 03:*:* fe:*:* }
reject with-interface all-of { 03:*:* ff:*:* }
## Explicitly reject any device with an RNDIS interface. RNDIS is believed to
## have protocol-level buffer overflow vulnerabilities that cannot be fixed.
reject with-interface one-of { ef:04:* }
## Allow USB mass storage, if and only if the USB device only has the mass
## storage interface and nothing extra.
## Suspicious interface combinations with mass storage are blocked.