3

I want to create something like "white list" for USB flash drives. I mean "deny everything that is not allowed".

I know that I should use udev rules:

  1. Add to /etc/udev/rules.d/ a rule to deny every usb flash drive
  2. Add another rule with higher number to allow what I want

I want to deal with USB flash drives only. The rules can be based on any information from USB drive. I mean vendor id, serial number. I mean i don't have any wishes on this case. Any solution.

But I don't know what I should write to rule files. Can you make an example?

UPD. I create a file with following content:

deck@crunch /etc/udev/rules.d $ cat 90-deny-usbflash.rules 
BUS=="usb", OPTIONS+="ignore_device"

As I know this folder is watched by udev using inotify so changes should take effect in a flash. But no changes applied.

3

You did not say whether you had other software installed which is automounting all drives. My solution below assumes that you don't. If you do, then your problem is different: you should specify what it is so that someone can suggest how to either uninstall it or control it.

Here is an example of udev rules to mount only allowed drives (not tested but based on similar rules that I use):

#-- Skip if not an appropriate "sd" device
KERNEL!="sd[b-z]*", GOTO="99_exit"
SUBSYSTEM!="block", GOTO="99_exit"

#-- Handle 'remove' and 'change' events
SUBSYSTEMS=="usb", ACTION=="remove", RUN+="/usr/bin/pumount /dev/%k", GOTO="99_exit"
ACTION=="remove|change", GOTO="99_exit"

#-- Create useful environment variables
SUBSYSTEMS=="usb", ENV{ID_SERIAL}!="?*", IMPORT{builtin}="usb_id"
SUBSYSTEMS=="usb", ENV{ID_FS_LABEL}!="?*", IMPORT{program}="/sbin/blkid -o udev -p %N"

#-- Skip if this is not a filesystem (e.g. if this is the whole drive, not a formatted partition)
ENV{ID_FS_USAGE}!="filesystem", GOTO="99_exit"

#-- Mount only allowed drives:
SUBSYSTEMS=="usb", ACTION=="add", ENV{ID_FS_LABEL}=="something_allowed", RUN+="/usr/bin/sudo -u someuser /usr/bin/pmount -t vfat /dev/%k /media/some_name"
SUBSYSTEMS=="usb", ACTION=="add", ENV{ID_FS_LABEL}=="other_allowed", RUN+="/usr/bin/sudo -u someuser /usr/bin/pmount -t vfat /dev/%k /media/other_name"

#-- Exit
LABEL="99_exit"

The mounting command that you use is, of course, up to your preference. The one that I showed is only an example.

UPDATE: I gather from your comments that you do have something installed that does automounting. On my system (Debian Wheezy), I don't. I tried the grep you suggested and got a different result. In /lib/udev/rules.d/80-udisks.rules, I found this section of code:

# Mark devices that shouldn't be automounted / autoassembled etc.
#
# Deny all, then punch holes for what looks like physical drives
# (TODO: this heuristic might need some work)
#

ENV{UDISKS_PRESENTATION_NOPOLICY}="1"
KERNEL=="sd*|hd*|sr*|mmcblk*|mspblk*", ENV{DISKS_PRESENTATION_NOPOLICY}="0"

This suggests that, if I had automounting software installed, it could be controlled by the UDISKS_PRESENTATION_NOPOLICY environment variable. You have not specified your distribution but it is apparently different.

  • I understand your solution. I just thought that I could just ignore the connected device and my rules overwrites the others so that they wont mount anything – Deck Dec 2 '13 at 21:11
  • By the way cat /lib/udev/rules.d/* | grep mount prints nothing – Deck Dec 2 '13 at 21:13
  • @Deck, I updated the answer with info from my system (Debian) which is apparently different from yours. Also, as per man udev, you might want to run grep mount through the /etc/udev/rules.d/ and /run/udev/rules.d/ directories. – John1024 Dec 2 '13 at 21:45
1

You could try USBGuard. It implements a USB device blacklist/whitelist on top of UDev and the Linux kernel USB authorization framework. You could achieve the same using UDev as already proposed, but USBGuard is a dedicated tool for that job and it has a rule language and an (optional) GUI applet.

Since USB flash disks usually have a serial number, then whitelist using VID:PID and a serial number would like like this in usbguard:

allow 1234:5678 serial "123456" with-interface equals { 08:*:* }
allow 1234:5678 serial "abcdef" with-interface equals { 08:*:* }
block

This would allow (authorize) to connect two USB devices with only a mass storage interface, VID:PID or 1234:5678 and an iSerial value of either "123456" or "abcdef". Everything else would be blocked.

Disclaimer: I'm the author of that project.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.