![usbguard规则允许任何键盘和鼠标](https://linux22.com/image/229206/usbguard%E8%A7%84%E5%88%99%E5%85%81%E8%AE%B8%E4%BB%BB%E4%BD%95%E9%94%AE%E7%9B%98%E5%92%8C%E9%BC%A0%E6%A0%87.png)
这是一个/etc/usbguard/rules.conf
文件,是通过生成的usbguard generate-policy > /etc/usbguard/rules.conf
这是在戴尔 optiplex 电脑上,仅连接了有线键盘和有线鼠标,RHEL-8.9和usbguard-1.0.0-13.el8.x86_64
allow id 1d6b:0002 serial "0000:00:1d.0" name "EHCI Host Controller" hash "WHBTxNaEoMGNSNc31KpFNSAeFF4HbLMQgSBqORlC6S8=" parent-hash "jW2YTPWRLeQOE7Q8I2f0pdN13zFYXVQGQoNmr1gDZgg=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0002 serial "0000:00:1a.0" name "EHCI Host Controller" hash "ej1WVedyLyUMLiQxzEcrwbY45zCodwV85Kzy7hm2Gv4=" parent-hash "e/RW0mMbM+TSFQxpRiMEfL7/3RJfKVdqffBm9F5qA+E=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "3Wo3XWDgen1hD5xM3PSNl3P98kLp1RUTgGQ5HSxtf8k=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
allow id 8087:0024 serial "" name "" hash "Zx7v0FMQEjScKSAFENAiobEs1OGPPB0YWR+yXDCVE04=" parent-hash "WHBTxNaEoMGNSNc31KpFNSAeFF4HbLMQgSBqORlC6S8=" via-port "1-1" with-interface 09:00:00 with-connect-type "hardwired"
allow id 0461:4d51 serial "" name "DELL Laser Mouse" hash "w2bwgTsGy6TVhOOr7smHrvF8PtmYVKQwxbqgA5betmI=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "2-3" with-interface 03:01:02 with-connect-type "hotplug"
allow id 413c:2003 serial "" name "Dell USB Keyboard" hash "3eEGsGE566EIofQwRf06EINoPRynZIa/09c3uyy4TTY=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "2-4" with-interface 03:01:01 with-connect-type "hotplug"
allow id 8087:0024 serial "" name "" hash "kv3v2+rnq9QvYI3/HbJ1EV9vdujZ0aVCQ/CGBYIkEB0=" parent-hash "ej1WVedyLyUMLiQxzEcrwbY45zCodwV85Kzy7hm2Gv4=" via-port "3-1" with-interface 09:00:00 with-connect-type "hardwired"
allow id 0461:4d22 serial "" name "USB Optical Mouse" hash "OZ6XJQmjdeDg7Dp2MelZt+ewNTtdNTt92FtGPI0VPAc=" parent-hash "kv3v2+rnq9QvYI3/HbJ1EV9vdujZ0aVCQ/CGBYIkEB0=" via-port "3-1.4" with-interface 03:01:02 with-connect-type "hotplug"
如果规则文件中没有最后一行,第二个鼠标在插入时将无法工作,所以我知道这个规则文件是特定于键盘和鼠标的。
我的问题是 - 我被告知这是可能的 - 如何编写规则语法以允许任何键盘和任何鼠标连接到系统的[到任何 USB 端口]?
额外问题:如果将有线 USB kybd 和鼠标插入具有 USB 端口的显示器,那么您有一根 USB 电缆从该显示器连接到计算机 USB 端口,是否可以将其列入白名单以允许任何显示器?
答案1
生成的规则并非特定于键盘和鼠标,而是特定于生成规则时连接到系统的设备。
要允许任何键盘和鼠标,请使用匹配这些的规则:
allow with-interface one-of { 03:00:01 03:01:01 03:00:02 03:01:02 }
在每个冒号分隔的三元组中,第一个值是接口类,第二个值是接口子类,第三个值是接口协议。第 3 类是“人机接口设备”。指定子类 0 和 1 允许引导设备和非引导设备匹配。协议 1 是键盘,协议 2 是鼠标。
该文档显示了一个更奇特的变体,它只允许第一个键盘:
allow with-interface one-of { 03:00:01 03:01:01 } if !allowed-matches(with-interface one-of { 03:00:01 03:01:01 })
这可以通过将协议更改为 2 来适应小鼠。
就监视器而言,大多数情况下相关功能是它们的集线器;这是接口类 9:
allow with-interface equals { 09:*:* }