commit c52ac7bbcf9f60390d7222b11204118aed5fb1c7
Author: unman <unman@thirdeyesecurity.org>
Date:   Wed Aug 14 15:10:16 2019 +0000

    Salt - sys-usb as named disposableVM

diff --git a/create.sls b/create.sls
new file mode 100644
index 0000000..a2731ee
--- /dev/null
+++ b/create.sls
@@ -0,0 +1,63 @@
+include:
+  - sys-usb.clone
+
+
+remove:
+  qvm.absent:
+    - name: sys-usb
+
+remove2:
+  qvm.absent:
+    - name: sys-usb-dvm
+
+qvm-present-id:
+  qvm.present:
+    - name: sys-usb-dvm
+    - template: template-sys-usb
+    - label: red
+
+qvm-prefs-id:
+  qvm.prefs:
+    - name: sys-usb-dvm
+    - netvm: none
+    - memory: 300
+    - vcpus: 2
+    - virt_mode: hvm
+    - autostart: False
+    - template_for_dispvms: True
+    - include_in_backups: false
+
+sys-usb:
+  qvm.present:
+    - name: sys-usb
+    - template: sys-usb-dvm
+    - class: DispVM
+    - label: red
+
+sys-usb-prefs:
+  qvm.prefs:
+    - name: sys-usb
+    - autostart: false
+    - include_in_backups: false
+    - pcidevs: ['00:1d.0']
+    - pci_strictreset: False
+
+qvm-features-id:
+  qvm.features:
+    - name: sys-usb
+    - disable:
+      - service.cups
+      - service.cups-browsed
+      - service.meminfo-writer
+      - service.cups-browsed
+      - service.qubes-updates-proxy
+
+update_file:
+  file.prepend:
+    - name: /etc/qubes-rpc/policy/qubes.InputMouse
+    - text: sys-usb dom0 allow,user=root
+
+update_file_keyboard:
+  file.prepend:
+    - name: /etc/qubes-rpc/policy/qubes.InputKeyboard
+    - text: sys-usb dom0 allow,user=root 
diff --git a/create.top b/create.top
new file mode 100644
index 0000000..f6f69d3
--- /dev/null
+++ b/create.top
@@ -0,0 +1,4 @@
+base:
+  dom0:
+    - match: nodegroup
+    - sys-usb.create