reidlab/nix-dotfiles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

usbguard and drop todo

Browse source
This commit is contained in:
Reid 2025-01-28 21:28:00 -08:00
parent 3e9d8af023
commit d5f82d159e
Signed by: reidlab
GPG key ID: DAF5EAF6665839FD
5 changed files with 20 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

17
modules/security.nix
View file

@ -63,7 +63,22 @@ in {
# personal computer? no firewall ty :3
networking.firewall.enable = false;
# TODO: usbguard
services.usbguard = {
IPCAllowedUsers = [ "root" "${env.mainUser}" ];
presentDevicePolicy = "allow";
rules = ''
allow with-interface equals { 08:*:* }
# reject devices with suspicious combination of interfaces (ex. mass storage + keyboard)
reject with-interface all-of { 08:*:* 03:00:* }
reject with-interface all-of { 08:*:* 03:01:* }
reject with-interface all-of { 08:*:* e0:*:* }
reject with-interface all-of { 08:*:* 02:*:* }
'';
};
services.fwupd.enable = true;
} // (mkIf cfg.useDoas {
security.sudo.enable = false;
security.doas.enable = true;