Require approval for new USB devices by default

Co-authored-by: Outfoxxed <outfoxxed@outfoxxed.me>

install/config/all.sh

@@ -7,5 +7,6 @@ run_logged "$OMARCHY_INSTALL/config/ssh-command-path.sh"
 run_logged "$OMARCHY_INSTALL/config/ssh-keepalive.sh"
 run_logged "$OMARCHY_INSTALL/config/docker.sh"
 run_logged "$OMARCHY_INSTALL/config/snapper.sh"
+run_logged "$OMARCHY_INSTALL/config/usb-authorization.sh"
 run_logged "$OMARCHY_INSTALL/config/enable-services.sh"
 run_logged "$OMARCHY_INSTALL/config/firewall.sh"

install/config/usb-authorization.sh

@@ -0,0 +1,28 @@
+echo "Configure USB device authorization"
+
+rules_file="${OMARCHY_USB_AUTHORIZATION_RULES_FILE:-/etc/usbguard/rules.conf}"
+daemon_config="${OMARCHY_USB_AUTHORIZATION_DAEMON_CONFIG:-/etc/usbguard/usbguard-daemon.conf}"
+
+source "$OMARCHY_INSTALL/helpers/usb-authorization.sh"
+usb_authorization_require_secure_settings "$daemon_config"
+
+if [[ ! -s $rules_file ]]; then
+  policy=$(mktemp "${TMPDIR:-/tmp}/omarchy-usb-policy.XXXXXXXXXX")
+  chmod 600 "$policy"
+
+  if usb_authorization_generate_policy "$policy"; then
+    install -Dm600 -o root -g root "$policy" "$rules_file"
+    rm -f "$policy"
+  else
+    rm -f "$policy"
+    return 1
+  fi
+fi
+
+if [[ -n ${OMARCHY_INSTALL_USER:-} ]]; then
+  usb_authorization_add_user "$OMARCHY_INSTALL_USER"
+fi
+
+# Installs are followed by a reboot, so enable the daemon without starting it
+# in the live ISO's chroot.
+systemctl enable usbguard.service