Require approval for new USB devices by default

Co-authored-by: Outfoxxed <outfoxxed@outfoxxed.me>

install/config/all.sh

@@ -7,5 +7,6 @@ run_logged "$OMARCHY_INSTALL/config/ssh-command-path.sh"
 run_logged "$OMARCHY_INSTALL/config/ssh-keepalive.sh"
 run_logged "$OMARCHY_INSTALL/config/docker.sh"
 run_logged "$OMARCHY_INSTALL/config/snapper.sh"
+run_logged "$OMARCHY_INSTALL/config/usb-authorization.sh"
 run_logged "$OMARCHY_INSTALL/config/enable-services.sh"
 run_logged "$OMARCHY_INSTALL/config/firewall.sh"

install/config/usb-authorization.sh

@@ -0,0 +1,28 @@
+echo "Configure USB device authorization"
+
+rules_file="${OMARCHY_USB_AUTHORIZATION_RULES_FILE:-/etc/usbguard/rules.conf}"
+daemon_config="${OMARCHY_USB_AUTHORIZATION_DAEMON_CONFIG:-/etc/usbguard/usbguard-daemon.conf}"
+
+source "$OMARCHY_INSTALL/helpers/usb-authorization.sh"
+usb_authorization_require_secure_settings "$daemon_config"
+
+if [[ ! -s $rules_file ]]; then
+  policy=$(mktemp "${TMPDIR:-/tmp}/omarchy-usb-policy.XXXXXXXXXX")
+  chmod 600 "$policy"
+
+  if usb_authorization_generate_policy "$policy"; then
+    install -Dm600 -o root -g root "$policy" "$rules_file"
+    rm -f "$policy"
+  else
+    rm -f "$policy"
+    return 1
+  fi
+fi
+
+if [[ -n ${OMARCHY_INSTALL_USER:-} ]]; then
+  usb_authorization_add_user "$OMARCHY_INSTALL_USER"
+fi
+
+# Installs are followed by a reboot, so enable the daemon without starting it
+# in the live ISO's chroot.
+systemctl enable usbguard.service

install/helpers/usb-authorization.sh

@@ -0,0 +1,99 @@
+usb_authorization_config_value() {
+  local config="$1" key="$2"
+  local awk_command=(awk)
+
+  if [[ ! -r $config ]]; then
+    if [[ $config == "/etc/usbguard/usbguard-daemon.conf" ]]; then
+      awk_command=(sudo awk)
+    else
+      echo "Cannot read USBGuard configuration: $config" >&2
+      return 1
+    fi
+  fi
+
+  "${awk_command[@]}" -F= -v key="$key" '
+    /^[[:space:]]*#/ { next }
+    $1 ~ "^[[:space:]]*" key "[[:space:]]*$" {
+      value=$0
+      sub(/^[^=]*=[[:space:]]*/, "", value)
+      sub(/[[:space:]]*$/, "", value)
+      print value
+      exit
+    }
+  ' "$config"
+}
+
+usb_authorization_rules_present() {
+  local rules="$1"
+
+  if [[ -r $rules ]]; then
+    [[ -s $rules ]]
+  elif [[ $rules == "/etc/usbguard/rules.conf" ]]; then
+    sudo test -s "$rules"
+  else
+    return 1
+  fi
+}
+
+usb_authorization_require_secure_setting() {
+  local config="$1" key="$2" expected="$3" actual
+
+  actual=$(usb_authorization_config_value "$config" "$key")
+  if [[ $actual != "$expected" ]]; then
+    echo "USBGuard's $key must be '$expected' before Omarchy enables it." >&2
+    echo "Current value: ${actual:-<unset>} in $config" >&2
+    return 1
+  fi
+}
+
+usb_authorization_require_secure_settings() {
+  local config="$1"
+
+  usb_authorization_require_secure_setting "$config" ImplicitPolicyTarget block
+  usb_authorization_require_secure_setting "$config" PresentDevicePolicy apply-policy
+  usb_authorization_require_secure_setting "$config" InsertedDevicePolicy apply-policy
+  usb_authorization_require_secure_setting "$config" AuthorizedDefault none
+  usb_authorization_require_secure_setting "$config" RestoreControllerDeviceState false
+}
+
+usb_authorization_generate_policy() {
+  local policy="$1"
+
+  usbguard generate-policy >"$policy"
+  if [[ ! -s $policy ]] || ! grep -q '^allow ' "$policy"; then
+    echo "USBGuard did not generate a usable policy; nothing was enabled." >&2
+    return 1
+  fi
+}
+
+usb_authorization_add_user() {
+  local user="$1"
+
+  # This user can inspect USBGuard events and approve the device named by an
+  # event. Policy and daemon parameters remain unavailable through the IPC ACL.
+  usbguard add-user "$user" \
+    --devices=list,listen,modify \
+    --policy=list \
+    --exceptions=listen
+}
+
+usb_authorization_trust_present_devices() {
+  local line id
+  local count=0
+  local -a devices
+
+  mapfile -t devices < <(usbguard list-devices)
+
+  for line in "${devices[@]}"; do
+    if [[ $line =~ ^([0-9]+):[[:space:]] ]]; then
+      id="${BASH_REMATCH[1]}"
+      usbguard allow-device --permanent "$id"
+      (( ++count ))
+    fi
+  done
+
+  if (( count == 0 )); then
+    echo "USBGuard did not report any connected USB devices; boot authorization was not enabled." >&2
+    return 1
+  fi
+}

install/omarchy-base.packages

@@ -133,6 +133,7 @@ udiskie
 ufw
 ufw-docker
 unzip
+usbguard
 usage
 uwsm
 vi

install/user/first-run/enable-user-units.sh

@@ -18,4 +18,5 @@ systemctl --user enable --now \
   omarchy-sleep-lock.service \
   omarchy-migrate-notify.service \
   omarchy-fcitx5.service \
-  omarchy-crash-watch.service
+  omarchy-crash-watch.service \
+  omarchy-usb-authorization.service