Keep USB approvals portable and preserve approval prompts

bin/omarchy-remove-security-usb-authorization

@@ -60,19 +60,22 @@ fi
 # fails, the command stops here and leaves the complete policy enabled.
 sudo omarchy-usb-authorization-boot disable
 
+if omarchy-pkg-present usbguard; then
+  # Keep the watcher and its IPC access until blocking has actually stopped.
+  # In particular, a failed stop must not strand a running daemon without UI.
+  sudo systemctl disable --now usbguard.service
+  if systemctl is-active --quiet usbguard.service || systemctl is-enabled --quiet usbguard.service; then
+    echo "USBGuard is still active or enabled; approval prompts have been preserved." >&2
+    exit 1
+  fi
+  sudo omarchy-usb-authorization-restore-default
+  sudo usbguard remove-user "$USER"
+fi
+
 systemctl --user disable --now omarchy-usb-authorization.service 2>/dev/null || true
 rm -f "$unit"
 systemctl --user daemon-reload
 
-if omarchy-pkg-present usbguard; then
-  sudo usbguard remove-user "$USER" 2>/dev/null || true
-fi
-
-if omarchy-pkg-present usbguard; then
-  sudo systemctl disable --now usbguard.service 2>/dev/null || true
-  sudo omarchy-usb-authorization-restore-default
-fi
-
 if [[ -d $state_dir/requests ]]; then
   find "$state_dir/requests" -mindepth 1 -maxdepth 1 -type f -delete
   rmdir "$state_dir/requests" 2>/dev/null || true

bin/omarchy-setup-security-usb-authorization

@@ -1,20 +1,22 @@
 #!/bin/bash
 
 # omarchy:summary=Ask before new USB devices can access the system
-# omarchy:args=[--boot] [--yes]
+# omarchy:args=[--boot] [--yes] [--review-existing]
 # omarchy:requires-sudo=true
 
 set -euo pipefail
 
 assume_yes=0
 from_boot=0
+review_existing=0
 
 while (( $# > 0 )); do
   case "$1" in
   --yes) assume_yes=1 ;;
   --boot) from_boot=1 ;;
+  --review-existing) review_existing=1 ;;
   -h | --help)
-    echo "Usage: omarchy-setup-security-usb-authorization [--boot] [--yes]"
+    echo "Usage: omarchy-setup-security-usb-authorization [--boot] [--yes] [--review-existing]"
     echo
     echo "Trusts USB devices that are connected now, then blocks new devices"
     echo "until you approve them from an Omarchy notification."
@@ -25,6 +27,9 @@ while (( $# > 0 )); do
     echo "Older snapshots without USBGuard keep all USB disabled after startup,"
     echo "including keyboards, network adapters, and storage. Use --boot only if"
     echo "disk unlock and recovery work without any USB devices."
+    echo
+    echo "--review-existing reviews connected devices with older port-bound approvals."
+    echo "Each portable approval requires confirmation; existing rules are preserved."
     exit 0
     ;;
   *)
@@ -43,6 +48,58 @@ daemon_config=/etc/usbguard/usbguard-daemon.conf
 
 source "$OMARCHY_PATH/install/helpers/usb-authorization.sh"
 
+if (( review_existing )); then
+  # Older Omarchy rules have no per-rule ownership marker. They cannot safely
+  # be distinguished from intentionally restricted administrator rules.
+  (( ! assume_yes && ! from_boot )) || { echo "Review requires individual confirmation; do not combine it with --yes or --boot." >&2; exit 2; }
+  policy=$(usbguard list-rules)
+  declare -A reviewed=()
+  # Keep stdin attached to the terminal for gum (and any sudo prompt).
+  mapfile -t policy_lines <<<"$policy"
+  for line in "${policy_lines[@]}"; do
+    if [[ $line =~ ^[0-9]+:[[:space:]] ]]; then
+      rule=${line#*: }
+      [[ $rule == allow\ * ]] || continue
+      portable=$(usb_authorization_portable_rule "$rule") || continue
+      [[ ${portable% label *} != "$rule" ]] || continue
+      devices=$(usbguard list-devices "$rule")
+      mapfile -t candidates <<<"$devices"
+      for device in "${candidates[@]}"; do
+        [[ $device =~ ^([0-9]+):[[:space:]](allow[[:space:]].*)$ ]] || continue
+        id=${BASH_REMATCH[1]} current=${BASH_REMATCH[2]}
+        [[ ! -v reviewed[$id] ]] || continue
+        reviewed[$id]=1
+        echo
+        printf '%s\n' "$current" | LC_ALL=C tr -c '\11\12\15\40-\176' '?'
+        echo "This device has a location-bound approval. Details are supplied by the device."
+        if gum confirm "Trust this device on any USB port or hub?"; then
+          sudo /usr/bin/omarchy-usb-authorization-approve "$id" "$current"
+        fi
+      done
+    fi
+  done
+  echo "Review complete. Disconnected devices can be approved when reconnected."
+  exit 0
+fi
+
+# The watcher runs in the session's environment, which may differ from a
+# command invoked in a checkout. Fail before enabling blocking on mismatched
+# or incomplete installations, including dangling dev-link unit symlinks.
+session_environment=$(systemctl --user show-environment)
+grep -Fqx -- "OMARCHY_PATH=$OMARCHY_PATH" <<<"$session_environment" || {
+  echo "The session and this command use different Omarchy installations. Update the session before enabling USB protection." >&2
+  exit 1
+}
+for required in "$unit_source" /usr/share/omarchy/install/helpers/usb-authorization-policy.sh; do
+  [[ -r $required ]] || { echo "USB authorization installation is incomplete: $required" >&2; exit 1; }
+done
+for required in "$OMARCHY_PATH/bin/omarchy-usb-authorization-watch" \
+  "$OMARCHY_PATH/bin/omarchy-usb-authorization-event" \
+  "$OMARCHY_PATH/bin/omarchy-usb-authorization-review" \
+  /usr/bin/omarchy-usb-authorization-approve; do
+  [[ -r $required && -x $required ]] || { echo "USB authorization command is unavailable: $required" >&2; exit 1; }
+done
+
 if (( ! assume_yes )); then
   if (( from_boot )); then
     gum style --foreground 212 --bold "USB authorization from boot"
@@ -93,19 +150,27 @@ sudo usbguard add-user "$USER" \
   --policy=list \
   --exceptions=listen
 
+sudo install -Dm644 "$OMARCHY_PATH/default/polkit/org.omarchy.usb.policy" /usr/share/polkit-1/actions/org.omarchy.usb.policy
+
+# Install a real file: a link into a checkout can become dangling on a branch
+# switch. Start the waiting watcher before USBGuard can block new devices.
+unit_temporary=$(mktemp "${unit}.XXXXXXXXXX")
+install -m644 "$unit_source" "$unit_temporary"
+mv -fT "$unit_temporary" "$unit"
+systemctl --user daemon-reload
+systemctl --user enable omarchy-usb-authorization.service
+systemctl --user restart omarchy-usb-authorization.service
+systemctl --user is-active --quiet omarchy-usb-authorization.service
+
 sudo systemctl enable usbguard.service
 # add-user ACL changes are loaded only when the daemon starts, so restart an
 # existing service as well as starting a fresh one.
 sudo systemctl restart usbguard.service
-
-ln -sfn "$unit_source" "$unit"
-systemctl --user daemon-reload
-systemctl --user enable --now omarchy-usb-authorization.service
+systemctl is-active --quiet usbguard.service
+systemctl --user is-active --quiet omarchy-usb-authorization.service
 
 if (( from_boot )); then
-  # Take the trust snapshot only after USBGuard is enforcing the policy. Every
-  # ID is resolved by the daemon, and no device-controlled descriptor text is
-  # passed to a privileged command.
+  # The fixed helper independently verifies each full live device snapshot.
   usb_authorization_trust_present_devices
   sudo omarchy-usb-authorization-boot enable
 fi
@@ -113,6 +178,7 @@ fi
 echo
 echo "USB device authorization is enabled."
 echo "Devices connected during setup remain trusted; new devices require approval."
+echo "To review older port-bound approvals, run: omarchy-setup-security-usb-authorization --review-existing"
 if (( from_boot )); then
   echo "Boot-time authorization is enabled and takes effect after reboot."
 fi

bin/omarchy-usb-authorization-approve

@@ -0,0 +1,25 @@
+#!/bin/bash -p
+
+# omarchy:hidden=true
+# omarchy:summary=Save portable trust for one verified USB device
+
+# This narrow Polkit boundary accepts a live device snapshot, never a policy or
+# file path. Privileged Bash suppresses startup code from the caller's environment.
+if [[ $- != *p* ]]; then exit 126; fi
+source /usr/bin/omarchy-security-functions || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+omarchy_security_sanitize_bash_environment "$0" "$@"
+set -euo pipefail
+(( EUID == 0 )) || exit 126
+export PATH=/usr/bin:/bin LC_ALL=C
+unset USBGUARD_DAEMON_CONF USBGUARD_DEBUG
+source /usr/share/omarchy/install/helpers/usb-authorization-policy.sh
+
+(( $# == 2 )) || exit 64
+# Omarchy persists to this file. Refuse custom daemon storage rather than
+# mistaking a stale copy of a rule for a successful persistent decision.
+rules_file=$(awk -F= '/^[[:space:]]*RuleFile[[:space:]]*=/ { value=$2; gsub(/^[[:space:]]+|[[:space:]]+$/, "", value); print value; exit }' /etc/usbguard/usbguard-daemon.conf)
+[[ $rules_file == "/etc/usbguard/rules.conf" ]] || exit 1
+exec 8>/run/omarchy-usb-authorization.lock
+flock -x 8
+usb_authorization_permanent "$1" "$2"

bin/omarchy-usb-authorization-review

@@ -98,13 +98,11 @@ case "$choice" in
   jq --arg approval "$choice" '.approval = $approval' "$request" >"$temporary"
   mv -f "$temporary" "$request"
 
-  if [[ $current_rule == "$expected_rule" ]]; then
+  if [[ $choice == "Always allow this device" ]]; then
+    pkexec /usr/bin/omarchy-usb-authorization-approve "$id" "$current_rule" || approval_failed
+  elif [[ $current_rule == "$expected_rule" ]]; then
     # Match the complete identity, since numeric IDs can be reassigned.
-    options=()
-    if [[ $choice == "Always allow this device" ]]; then
-      options+=(--permanent)
-    fi
-    usbguard allow-device "${options[@]}" "$expected_rule" || approval_failed
+    usbguard allow-device "$expected_rule" || approval_failed
   fi
 
   # Rule-based USBGuard commands swallow applyDevicePolicy exceptions and can
@@ -115,7 +113,7 @@ case "$choice" in
   if [[ $choice == "Always allow this device" ]]; then
     # Let USBGuard match policy rules: saved rules can omit the device's port.
     # --show-devices indents the devices matching each policy rule.
-    policy=$(usbguard list-rules --show-devices) || approval_failed
+    policy=$(usbguard list-rules --label omarchy-usb-authorization-v1 --show-devices) || approval_failed
     policy_allows=0
     matched=0
     while IFS= read -r line; do