90 lines
2.8 KiB
Bash
Executable File
90 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Stop asking before new USB devices can access the system
|
|
# omarchy:args=[--boot-only] [--yes]
|
|
# omarchy:requires-sudo=true
|
|
|
|
set -euo pipefail
|
|
|
|
assume_yes=0
|
|
boot_only=0
|
|
|
|
while (( $# > 0 )); do
|
|
case "$1" in
|
|
--yes) assume_yes=1 ;;
|
|
--boot-only) boot_only=1 ;;
|
|
-h | --help)
|
|
echo "Usage: omarchy-remove-security-usb-authorization [--boot-only] [--yes]"
|
|
echo
|
|
echo "Disables Omarchy's USB approval prompts and restores the kernel's"
|
|
echo "normal default-allow behavior."
|
|
echo "Use --boot-only to keep USBGuard enabled after the system starts."
|
|
exit 0
|
|
;;
|
|
*)
|
|
echo "omarchy-remove-security-usb-authorization: unknown option '$1'. Try --help." >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
shift
|
|
done
|
|
|
|
if (( boot_only )); then
|
|
if (( ! assume_yes )); then
|
|
gum style --foreground 212 --bold "Remove USB authorization from boot"
|
|
echo
|
|
echo "USBGuard will continue blocking unknown devices after its service starts."
|
|
echo "Devices can reach kernel drivers earlier during boot."
|
|
echo
|
|
gum confirm "Disable USB authorization from kernel boot?" || exit 130
|
|
fi
|
|
|
|
sudo omarchy-usb-authorization-boot disable
|
|
echo
|
|
echo "Boot-time USB authorization is disabled and takes effect after reboot."
|
|
exit 0
|
|
fi
|
|
|
|
state_dir="$HOME/.local/state/omarchy/usb-authorization"
|
|
unit="$HOME/.config/systemd/user/omarchy-usb-authorization.service"
|
|
|
|
if (( ! assume_yes )); then
|
|
gum style --foreground 212 --bold "Remove USB device authorization"
|
|
echo
|
|
echo "New USB devices will be allowed to bind to kernel drivers without approval."
|
|
echo
|
|
gum confirm "Disable USB device authorization?" || exit 130
|
|
fi
|
|
|
|
# Rebuild a permissive boot image before stopping USBGuard. If rebuilding
|
|
# fails, the command stops here and leaves the complete policy enabled.
|
|
sudo omarchy-usb-authorization-boot disable
|
|
|
|
if omarchy-pkg-present usbguard; then
|
|
# Keep the watcher and its IPC access until blocking has actually stopped.
|
|
# In particular, a failed stop must not strand a running daemon without UI.
|
|
sudo systemctl disable --now usbguard.service
|
|
if systemctl is-active --quiet usbguard.service || systemctl is-enabled --quiet usbguard.service; then
|
|
echo "USBGuard is still active or enabled; approval prompts have been preserved." >&2
|
|
exit 1
|
|
fi
|
|
sudo omarchy-usb-authorization-restore-default
|
|
sudo usbguard remove-user "$USER"
|
|
fi
|
|
|
|
systemctl --user disable --now omarchy-usb-authorization.service 2>/dev/null || true
|
|
rm -f "$unit"
|
|
systemctl --user daemon-reload
|
|
|
|
if [[ -d $state_dir/requests ]]; then
|
|
find "$state_dir/requests" -mindepth 1 -maxdepth 1 -type f -delete
|
|
rmdir "$state_dir/requests" 2>/dev/null || true
|
|
fi
|
|
|
|
rm -f "$state_dir/package-installed-by-omarchy" \
|
|
"$state_dir/policy-generated-by-omarchy" \
|
|
"$state_dir/service-enabled-by-omarchy"
|
|
rmdir "$state_dir" 2>/dev/null || true
|
|
|
|
echo "USB device authorization is disabled."
|