2

I want to block all usb devices except usb keyboard and usb mouse using udev rules? The purpose is to restrict users from attaching external storage devices (flash drives, phone internal storage and iOS devices storage).

To restrict users from transferring data to these device from Ubuntu machine with 16.04 and above.

Restricting mtp mobile transger protocol as well for restricting photo transfer.

Login to the machine with sudo rights in the terminal.

# Sudo –i 
List the usb ports:
#lsmod |grep usb 
Edit the blacklist.conf file
# Sudo vi /etc/modeprobe.d/blacklist.conf 
blacklist usb_storge
blacklist uas
blacklist usbhid
#Sudo vi /etc/rc.local/ 
modprobe -r usb_storage 
modprobe -r uas
modprob usbhid

save Restart machine. but some how mobile storage manages to connect storage to machine .
so trying the udev rules now , i have tried following for all ports(usb/1-3,usb1/1-3..) but it block kb mouse too

#echo 0 > / sys/bus/usb/devices/1-3/authorized 

other option i tried:

/etc/udev/rules.d/01-usblockdown.rules
The contents of the script are as follows:
#Script by Adrian Crenshaw
#With info from Michael Miller, Inaky Perez-Gonzalez and VMWare

#By default, disable it.
#ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'echo 0 >/sys$DEVPATH/authorized'"<br>
ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

#Enable hub devices. There may be a better way than this.
ACTION=="add", ATTR{bDeviceClass}=="09", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

#Other things to enable
ACTION=="add", ATTR{idVendor}=="046d", ATTR{idProduct}=="0809", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{serial}=="078606B90DD3", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
ACTION=="add", ATTR{product}=="802.11 n WLAN", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"
#ACTION=="add", ATTR{idVendor}=="413c", ATTR{idProduct}=="2106", RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

It also blocks the usb keyboard and mouse.

1
  • Please don't Double-trible post.
    – Bruni
    Oct 25, 2018 at 19:38

2 Answers 2

0

Just hints:

  • /etc/modeprobe.d/blacklist.conf .. blacklist does not work for all types of drivers. Some are not external modules and so they need a special argument passed through /etc/default/grub .. GRUB_CMDLINE_LINUX_DEFAULT.
  • usbhid is the core USB HID (Human Interface Devices) driver for keyboard, mouse & joystick. Better to drop it, It is good that you still have access to machine. Better, if you prepare OpenSSH login just in case.
  • Check lsusb -t and udevadm info -a ... when only mouse/keyboard are connected. Collect the list of all active USB drivers. I expect to get: USB1/2/3-hubs, mouse, keyboard, SD card reader, bluetooth.
  • Develop similar rule to one used for this post for Driver unbinding, allowing probably only USB hubs & USB HID drives.

If you face a block, update the question with collected info, let me know with a comment.

0

Try This

ctrl + alt + t

Type : sudo nautilus n /usr/lib/gvfs/

Press enter

Put your Password

One page will open in that check gvfsd-mtp right click on that

Uncheck that (Allow executing file as program)

Close that and in terminal type init 6 press enter

System will reboot and check now

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .