pyrox.dev
1{ pkgs, ... }:
2{
3 name = "usbguard";
4 meta = with pkgs.lib.maintainers; {
5 maintainers = [ tnias ];
6 };
7
8 nodes.machine =
9 { ... }:
10 {
11 services.usbguard = {
12 enable = true;
13 IPCAllowedUsers = [
14 "alice"
15 "root"
16 ];
17
18 # As virtual USB devices get attached to the "QEMU USB Hub" we need to
19 # allow Hubs. Otherwise we would have to explicitly allow them too.
20 rules = ''
21 allow with-interface equals { 09:00:00 }
22 '';
23 };
24 imports = [ ./common/user-account.nix ];
25 };
26
27 testScript = ''
28 # create a blank disk image for our fake USB stick
29 with open(machine.state_dir / "usbstick.img", "wb") as stick:
30 stick.write(b"\x00" * (1024 * 1024))
31
32 # wait for machine to have started and the usbguard service to be up
33 machine.wait_for_unit("usbguard.service")
34
35 with subtest("IPC access control"):
36 # User "alice" is allowed to access the IPC interface
37 machine.succeed("su alice -c 'usbguard list-devices'")
38
39 # User "bob" is not allowed to access the IPC interface
40 machine.fail("su bob -c 'usbguard list-devices'")
41
42 with subtest("check basic functionality"):
43 # at this point we expect that no USB HDD is connected
44 machine.fail("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
45
46 # insert usb device
47 machine.send_monitor_command(
48 f"drive_add 0 id=stick,if=none,file={stick.name},format=raw"
49 )
50 machine.send_monitor_command("device_add usb-storage,id=stick,drive=stick")
51
52 # the attached USB HDD should show up after a short while
53 machine.wait_until_succeeds("usbguard list-devices | grep -E 'QEMU USB HARDDRIVE'")
54
55 # at this point there should be a **blocked** USB HDD
56 machine.succeed("usbguard list-devices | grep -E 'block.*QEMU USB HARDDRIVE'")
57 machine.fail("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
58
59 # allow storage devices
60 machine.succeed("usbguard allow-device 'with-interface { 08:*:* }'")
61
62 # at this point there should be an **allowed** USB HDD
63 machine.succeed("usbguard list-devices | grep -E ' allow .*QEMU USB HARDDRIVE'")
64 machine.fail("usbguard list-devices | grep -E ' block .*QEMU USB HARDDRIVE'")
65 '';
66}