USBGuard
summary
USBGuard provides a kernel‑backed whitelist/blacklist service that generates an initial policy from whatever USB devices are plugged in, requires the rules file to be root‑owned and read‑only, and then enforces decisions at the kernel level so allowed devices mount and blocked ones are disabled. Core tools shown are usbguard generate-policy to capture current devices, usbguard watch to inspect events, and commands to allow vs reject where reject drops the device reference and requires reinsertion. A Qt applet shows notifications and lets users allow temporarily or permanently.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:55Outline
- 1:22Access Attacks
- 4:26Basic Design
- 5:21Installation
- 6:10Service
- 8:07Command line interface
- 11:00Generate command
- 11:28Watch command
- 14:47List command
- 17:46attribute forms
- 18:31conditional rules
- 19:40graphical interface
- 23:56system tray
related talks
20mWhat's new in USBGuard 1.0?
33mMaking USB Great Again with USBFILTER
37mUsing RHEL built in Security Technologies daily
36mUSB Arsenal for Masses
18mμUSB: Practical and Safe USB Driver Reuse for Arm TrustZone
52mDebugging Usually Slightly Broken (USB) Devices and Drivers
47mTrojanizing Hardware: Be Careful What (USB) You Plug In and Where
47mApplication Whitelisting