Arch Linux

ndhakara

Member

Registered: 2015-01-16

Posts: 25

Gnome - Usbguard asking password each time after login/lockreen 3 time

I opened a bug tracker too but maybe it can be my fault.
After usbguard 1.1.0-1 update; when usbguard-dbus.service enabled; each time after login or screenlock enter, usbguard asking 3 times password. There was no problem(asking password) before the update.

usbguard-daemon.conf

#
# Rule set file path.
#
# The USBGuard daemon will use this file to load the policy
# rule set from it and to write new rules received via the
# IPC interface.
#
# RuleFile=/path/to/rules.conf
#
RuleFile=/etc/usbguard/rules.conf

#
# Rule set folder path.
#
# The USBGuard daemon will use this folder to load the policy
# rule set from it and to write new rules received via the
# IPC interface. Usually, we set the option to
# /etc/usbguard/rules.d/. The USBGuard daemon is supposed to
# behave like any other standard Linux daemon therefore it
# loads rule files in alpha-numeric order. File names inside
# RuleFolder directory should start with a two-digit number
# prefix indicating the position, in which the rules are
# scanned by the daemon.
#
# RuleFolder=/path/to/rulesfolder/
#
#RuleFolder=/etc/usbguard/rules.d/



#
# Implicit policy target.
#
# How to treat devices that don't match any rule in the
# policy. One of:
#
# * allow  - authorize the device
# * block  - block the device
# * reject - remove the device
#
ImplicitPolicyTarget=allow

#
# Present device policy.
#
# How to treat devices that are already connected when the
# daemon starts. One of:
#
# * allow        - authorize every present device
# * block        - deauthorize every present device
# * reject       - remove every present device
# * keep         - just sync the internal state and leave it
# * apply-policy - evaluate the ruleset for every present
#                  device
#
PresentDevicePolicy=apply-policy

#
# Present controller policy.
#
# How to treat USB controllers that are already connected
# when the daemon starts. One of:
#
# * allow        - authorize every present device
# * block        - deauthorize every present device
# * reject       - remove every present device
# * keep         - just sync the internal state and leave it
# * apply-policy - evaluate the ruleset for every present
#                  device
#
PresentControllerPolicy=keep

#
# Inserted device policy.
#
# How to treat USB devices that are already connected
# *after* the daemon starts. One of:
#
# * block        - deauthorize every present device
# * reject       - remove every present device
# * apply-policy - evaluate the ruleset for every present
#                  device
#
InsertedDevicePolicy=apply-policy

#
# Control which devices are authorized by default.
#
# The USBGuard daemon modifies some the default authorization state attributes
# of controller devices. This setting, enables you to define what value the
# default authorization is set to.
#
# * keep         - do not change the authorization state
# * none         - every new device starts out deauthorized
# * all          - every new device starts out authorized
# * internal     - internal devices start out authorized, external devices start
#                  out deauthorized (this requires the ACPI tables to properly
#                  label internal devices, and kernel support)
#
AuthorizedDefault=none

#
# Restore controller device state.
#
# The USBGuard daemon modifies some attributes of controller
# devices like the default authorization state of new child device
# instances. Using this setting, you can control whether the
# daemon will try to restore the attribute values to the state
# before modification on shutdown.
#
# SECURITY CONSIDERATIONS: If set to true, the USB authorization
# policy could be bypassed by performing some sort of attack on the
# daemon (via a local exploit or via a USB device) to make it shutdown
# and restore to the operating-system default state (known to be permissive).
#
RestoreControllerDeviceState=false

#
# Device manager backend
#
# Which device manager backend implementation to use. One of:
#
# * uevent   - Netlink based implementation which uses sysfs to scan for present
#              devices and an uevent netlink socket for receiving USB device
#              related events.
# * umockdev - umockdev based device manager capable of simulating devices based
#              on umockdev-record files. Useful for testing.
#
DeviceManagerBackend=uevent

#!!! WARNING: It's good practice to set at least one of the !!!
#!!!          two options below. If none of them are set,   !!!
#!!!          the daemon will accept IPC connections from   !!!
#!!!          anyone, thus allowing anyone to modify the    !!!
#!!!          rule set and (de)authorize USB devices.       !!!

#
# Users allowed to use the IPC interface.
#
# A space delimited list of usernames that the daemon will
# accept IPC connections from.
#
# IPCAllowedUsers=username1 username2 ...
#
IPCAllowedUsers=root myusername

#
# Groups allowed to use the IPC interface.
#
# A space delimited list of groupnames that the daemon will
# accept IPC connections from.
#
# IPCAllowedGroups=groupname1 groupname2 ...
#
IPCAllowedGroups=wheel root myusername

#
# IPC access control definition files path.
#
# The files at this location will be interpreted by the USBGuard
# daemon as access control definition files for the IPC interface.
# The (base)name of a file should be in the form:
#
#   [user][:<group>]
#
# where user is either username or UID and group is either groupname or GID.
# IPC access control files should contain lines in the form:
#
#   <section>=[privilege1][,privilege2] ...
#
# This way each file defines who is able to connect to the IPC
# bus and what privileges he has. Note that the IPC access control
# files need to have file permissions set to 0600.
#
IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/

#
# Generate device specific rules including the "via-port"
# attribute.
#
# This option modifies the behavior of the allowDevice
# action. When instructed to generate a permanent rule,
# the action can generate a port specific rule. Because
# some systems have unstable port numbering, the generated
# rule might not match the device after rebooting the system.
#
# If set to false, the generated rule will still contain
# the "parent-hash" attribute which also defines an association
# to the parent device. See usbguard-rules.conf(5) for more
# details.
#
DeviceRulesWithPort=false

#
# USBGuard Audit events log backend
#
# One of:
#
# * FileAudit - Log audit events into a file specified by
#               AuditFilePath setting (see below)
# * LinuxAudit - Log audit events using the Linux Audit
#                subsystem (using audit_log_user_message)
#
AuditBackend=FileAudit

#
# USBGuard audit events log file path.
#
AuditFilePath=/var/log/usbguard/usbguard-audit.log

#
# Hides personally identifiable information such as device serial numbers and
# hashes of descriptors (which include the serial number) from audit entries.
#
HidePII=false

rules.conf

allow id 1d6b:0002 serial "0000:00:0d.0" name "xHCI Host Controller" hash "d3YN7OD60Ggqc9hClW0/al6tlFEshidDnQKzZRRk410=" parent-hash "Y1kBdG1uWQr5CjULQs7uh2F6pHgFb6VDHcWLk83v+tE=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0003 serial "0000:00:0d.0" name "xHCI Host Controller" hash "4Q3Ski/Lqi8RbTFr10zFlIpagY9AKVMszyzBQJVKE+c=" parent-hash "Y1kBdG1uWQr5CjULQs7uh2F6pHgFb6VDHcWLk83v+tE=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0002 serial "0000:00:14.0" name "xHCI Host Controller" hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
allow id 1d6b:0003 serial "0000:00:14.0" name "xHCI Host Controller" hash "prM+Jby/bFHCn2lNjQdAMbgc6tse3xVx+hZwjOPHSdQ=" parent-hash "rV9bfLq7c2eA4tYjVjwO4bxhm+y6GgZpl9J60L0fBkY=" with-interface 09:00:00 with-connect-type ""
allow id 27c6:5125 serial "00000000001A" name "Goodix Fingerprint Device " hash "4kN4PdzGzsGuDMSb8SOygPzvrH9R7nuGYNUEZ/8znIs=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" with-interface { 02:01:01 0a:00:00 } with-connect-type "hardwired"
allow id 3408:c200 serial "200901010001" name "USB Camera" hash "qoCRLSJ2ek+oLzqFQP8xDYC0Vdnc852hSsZvm/Agm3M=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:01:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 0e:02:01 fe:01:01 } with-connect-type "hardwired"
allow id 8087:0026 serial "" name "" hash "Z5csNGxiUukPPZwSHPyUqpVCNagsfOSSNL2CfXhw4IY=" parent-hash "jEP/6WzviqdJ5VSeTUY8PatCNBKeaREvo2OqdplND/o=" via-port "3-10" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hardwired"

glitsj16

Member

Registered: 2015-04-26

Posts: 126

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

Maybe you had a different configuration that got wiped out by an upgrade. Did you see a *.pacnew file during the upgrade? The usbguard package has etc/usbguard/usbguard-daemon.conf in the backup array. I notice you have ImplicitPolicyTarget=allow, which isn't the most secure setup according to the wiki:

With the key ImplicitPolicyTarget you can configure the default treatment of devices, if no rules match. The most secure option here is block.

Have you tried using ImplicitPolicyTarget=block yet?

ndhakara

Member

Registered: 2015-01-16

Posts: 25

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

Maybe you had a different configuration that got wiped out by an upgrade. Did you see a *.pacnew file during the upgrade? The usbguard package has etc/usbguard/usbguard-daemon.conf in the backup array. I notice you have ImplicitPolicyTarget=allow, which isn't the most secure setup according to the wiki:

With the key ImplicitPolicyTarget you can configure the default treatment of devices, if no rules match. The most secure option here is block.

Have you tried using ImplicitPolicyTarget=block yet?

Yes, I tried but the main problem is upstream changes. I had opened a bug report too and the answer is new package has change about dbus setting that's why login/restart needs password. I remove usbguard, it's security feature/usage balance not for me any more.

progandy

Member

Registered: 2012-05-17

Posts: 5,321

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

You can probably create policykit configuration that allows access to the dbus methods.
https://wiki.archlinux.org/title/Polkit
https://www.freedesktop.org/software/po … kit.8.html
/usr/share/polkit-1/actions/org.usbguard1.policy
For example

polkit.addRule(function(action, subject) {
    if ((action.id == "org.usbguard.Policy1.listRules" ||
	 action.id == "org.usbguard.Devices1.listDevices") &&
        subject.user == "your_username" )
    {
        return polkit.Result.YES;
    }
});

Last edited by progandy (2022-03-03 07:34:29)

---

| alias CUTF='LANG=en_XX.UTF-8@POSIX ' | alias ENGLISH='LANG=C.UTF-8 ' |

ndhakara

Member

Registered: 2015-01-16

Posts: 25

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

You can probably create policykit configuration that allows access to the dbus methods.
https://wiki.archlinux.org/title/Polkit
https://www.freedesktop.org/software/po … kit.8.html
/usr/share/polkit-1/actions/org.usbguard1.policy
For example

polkit.addRule(function(action, subject) {
    if ((action.id == "org.usbguard.Policy1.listRules" ||
	 action.id == "org.usbguard.Devices1.listDevices") &&
        subject.user == "your_username" )
    {
        return polkit.Result.YES;
    }
});

Thank you, I will use this.
@progandy Thank you again, it works perfectly. Blocking at lockscreen, password asking login or unlock lockscreen and no connect/mount issue while my user is logged in.

Last edited by ndhakara (2022-03-05 08:51:38)

ndhakara

Member

Registered: 2015-01-16

Posts: 25

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

I find another way and I think this is best practice for Usbguard settings. When I check the usbguar man pages, I see that adding username / group in usbguard-daemon.conf legacy way; instead of conf file, I use

usbguard add-user USERNAME --devices=modify,list,listen --policy=list --exceptions=listen

then I created whitelist rules with

usbguard generate-policy > /etc/usbguard/rules.conf

and finally enable usbguard-dbus.service. With these steppes, there is no password asking and no need polkit rules.
Maybe these steppes should add in Usbguard arch wiki.

Not: I applied these steppes in root account.

Last edited by ndhakara (2022-03-07 14:34:17)

Aleksana

Member

From: Chengdu,Sichuan,China

Registered: 2022-04-12

Posts: 2

Re: Gnome - Usbguard asking password each time after login/lockreen 3 time

It is said in issue https://github.com/USBGuard/usbguard/issues/544 that it "replacing auth_self_keep by yes three times for read-only methods listDevices, listRules, getParameter" by one of the maintainers,but the corresponding pull request hasn't come yet.

Edit: I still need to enter password once after applying this method.

Last edited by Aleksana (2022-04-12 15:37:51)

---

Performance & Security Enthusiast.Not free software fantatics.
Currently using Lenovo Xiaoxin ACH 2021,with amd ryzen7 5800H.