I want to block all usb devices except usb keyboard and usb mouse using udev rules? The purpose is to restrict users from attaching external storage devices (flash drives, phone internal storage and iOS devices storage).

To restrict users from transferring data to these device from Ubuntu machine with 16.04 and above.

Restricting mtp mobile transger protocol as well for restricting photo transfer.

Login to the machine with sudo rights in the terminal.

# Sudo –i 
List the usb ports:
#lsmod |grep usb 
Edit the blacklist.conf file
# Sudo vi /etc/modeprobe.d/blacklist.conf 
blacklist usb_storge
blacklist uas
blacklist usbhid
#Sudo vi /etc/rc.local/ 
modprobe -r usb_storage 
modprobe -r uas
modprob usbhid

save Restart machine. but some how mobile storage manages to connect storage to machine .
so trying the udev rules now , i have tried following for all ports(usb/1-3,usb1/1-3..) but it block kb mouse too

#echo 0 > / sys/bus/usb/devices/1-3/authorized 

other option i tried:

/etc/udev/rules.d/01-usblockdown.rules
The contents of the script are as follows:
#Script by Adrian Crenshaw
#With info from Michael Miller, Inaky Perez-Gonzalez and VMWare

#By default, disable it.
#ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'echo 0 >/sys$DEVPATH/authorized'"<br>
ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

#Enable hub devices. There may be a better way than this.
ACTION=="add", ATTR{bDeviceClass}=="09", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

#Other things to enable
ACTION=="add", ATTR{idVendor}=="046d", ATTR{idProduct}=="0809", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{serial}=="078606B90DD3", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{product}=="802.11 n WLAN", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
#ACTION=="add", ATTR{idVendor}=="413c", ATTR{idProduct}=="2106", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

It also blocks the usb keyboard and mouse.

  • Please don't Double-trible post. – Bruni Oct 25 at 19:38

Just hints:

  • /etc/modeprobe.d/blacklist.conf .. blacklist does not work for all types of drivers. Some are not external modules and so they need a special argument passed through /etc/default/grub .. GRUB_CMDLINE_LINUX_DEFAULT.
  • usbhid is the core USB HID (Human Interface Devices) driver for keyboard, mouse & joystick. Better to drop it, It is good that you still have access to machine. Better, if you prepare OpenSSH login just in case.
  • Check lsusb -t and udevadm info -a ... when only mouse/keyboard are connected. Collect the list of all active USB drivers. I expect to get: USB1/2/3-hubs, mouse, keyboard, SD card reader, bluetooth.
  • Develop similar rule to one used for this post for Driver unbinding, allowing probably only USB hubs & USB HID drives.

If you face a block, update the question with collected info, let me know with a comment.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.