41 lines
1.4 KiB
Bash
Executable File
41 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:hidden=true
|
|
# omarchy:summary=Create an approval request for a blocked USB device
|
|
|
|
set -euo pipefail
|
|
|
|
[[ ${USBGUARD_IPC_SIGNAL:-} == "Device.PresenceChanged" ]] || exit 0
|
|
[[ ${USBGUARD_DEVICE_EVENT:-} == "Insert" ]] || exit 0
|
|
[[ ${USBGUARD_DEVICE_TARGET:-} == "block" ]] || exit 0
|
|
[[ ${USBGUARD_DEVICE_ID:-} =~ ^[0-9]+$ ]] || exit 0
|
|
[[ -n ${USBGUARD_DEVICE_RULE:-} ]] || exit 0
|
|
|
|
requests="$HOME/.local/state/omarchy/usb-authorization/requests"
|
|
mkdir -p "$requests"
|
|
chmod 700 "${requests%/*}" "$requests"
|
|
|
|
# The token is safe to carry through the presentation launcher's command
|
|
# string. The device-controlled rule itself stays in a mode-0600 JSON file and
|
|
# is never interpolated into a shell command.
|
|
token="request-$(printf '%s\0%s' "$USBGUARD_DEVICE_ID" "$USBGUARD_DEVICE_RULE" | sha256sum | cut -d' ' -f1)"
|
|
request="$requests/$token.json"
|
|
temporary=$(mktemp "$requests/.request.XXXXXXXXXX")
|
|
trap 'rm -f "$temporary"' EXIT
|
|
|
|
jq -n \
|
|
--arg id "$USBGUARD_DEVICE_ID" \
|
|
--arg rule "$USBGUARD_DEVICE_RULE" \
|
|
'{id: $id, rule: $rule}' >"$temporary"
|
|
chmod 600 "$temporary"
|
|
mv -f "$temporary" "$request"
|
|
|
|
omarchy-notification-send \
|
|
--app-name omarchy-action \
|
|
--urgency critical \
|
|
--glyph \
|
|
"USB accessory blocked" \
|
|
"Click to review it. Keep it blocked unless you recognize the device." \
|
|
--exec omarchy-launch-floating-terminal-with-presentation \
|
|
omarchy-usb-authorization-review "$token"
|