Merge pull request #11874 from acrogenesis/feature/usb-device-authorization

Require approval for new USB and Thunderbolt devices by default.

Reported-by: Jurre van Bergen me@jurrevanbergen.nl

etc/polkit-1/rules.d/40-omarchy-thunderbolt.rules

@@ -0,0 +1,17 @@
+polkit.addRule(function(action, subject) {
+  if (action.id === "org.omarchy.thunderbolt.approve" &&
+      subject.active && subject.local && subject.isInGroup("wheel")) {
+    return polkit.Result.YES;
+  }
+  // Bolt's vendor rule grants wheel passwordless management, including enabling
+  // automatic approval of every IOMMU device. Keep blanket policy changes behind
+  // administrator authentication; the narrow Omarchy action approves one device.
+  if (action.id === "org.freedesktop.bolt.manage" && subject.user !== "root") {
+    try {
+      polkit.spawn(["/usr/bin/test", "-f", "/etc/omarchy/thunderbolt-authorization.enabled"]);
+      return polkit.Result.AUTH_ADMIN;
+    } catch (error) {
+      // Protection is disabled: retain the packaged Bolt permission rules.
+    }
+  }
+});

etc/polkit-1/rules.d/40-omarchy-usb.rules

@@ -0,0 +1,6 @@
+polkit.addRule(function(action, subject) {
+  if (action.id === "org.omarchy.usb.approve" &&
+      subject.active && subject.local && subject.isInGroup("wheel")) {
+    return polkit.Result.YES;
+  }
+});

etc/systemd/system/bolt.service.d/omarchy-authorization.conf

@@ -0,0 +1,3 @@
+[Service]
+# Runs before Bolt enumerates hardware, including D-Bus/udev activation.
+ExecStartPre=/usr/bin/omarchy-thunderbolt-authorization-admin guard

etc/systemd/system/omarchy-thunderbolt-authorization.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Restore approved Thunderbolt devices and handle new approvals
+Wants=bolt.service
+After=bolt.service polkit.service
+ConditionPathExists=/etc/omarchy/thunderbolt-authorization.enabled
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/omarchy-thunderbolt-authorization-daemon
+RuntimeDirectory=omarchy-thunderbolt-authorization
+RuntimeDirectoryMode=0755
+Restart=on-failure
+RestartSec=2
+UMask=0077
+NoNewPrivileges=yes
+ProtectSystem=strict
+ReadWritePaths=/var/lib/omarchy/thunderbolt-authorization /run/lock
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_UNIX
+
+[Install]
+WantedBy=multi-user.target