Merge pull request #11874 from acrogenesis/feature/usb-device-authorization

Require approval for new USB and Thunderbolt devices by default.

Reported-by: Jurre van Bergen me@jurrevanbergen.nl

default/systemd/user/omarchy-thunderbolt-authorization.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Offer approval for blocked Thunderbolt accessories
+After=graphical-session.target
+PartOf=graphical-session.target
+ConditionEnvironment=WAYLAND_DISPLAY
+ConditionPathExists=|/etc/omarchy/thunderbolt-authorization.enabled
+ConditionPathExists=|/etc/omarchy/thunderbolt-authorization.pending
+
+[Service]
+ExecStart=/usr/bin/omarchy-thunderbolt-authorization-watch
+Restart=always
+RestartSec=2
+UMask=0077
+
+[Install]
+WantedBy=graphical-session.target

default/systemd/user/omarchy-usb-authorization.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Ask before allowing new USB devices
+After=graphical-session.target dbus.socket
+Requires=dbus.socket
+PartOf=graphical-session.target
+ConditionEnvironment=OMARCHY_PATH
+ConditionEnvironment=WAYLAND_DISPLAY
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/bash -lc 'exec "$OMARCHY_PATH/bin/omarchy-usb-authorization-watch"'
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=graphical-session.target