Re: Restricting USB access

[Greg KH <greg@kroah.com>]

On Fri, Oct 08, 2010 at 10:25:31AM -0400, Ryan Lawrie wrote:
> Hi Greg,
> 
> Mostly, we're concerned with portable USB drives.  (We still want USB mice
> and keyboards to function properly)  With openSUSE11.0 we were able to
> restrict all USB access (in the org.freedesktop.hal.storage.mount-removable
> file) and then add a list of privileged usernames into the policykit.conf
> file to override permissions for those people. This allowed our special
> users to use USB sticks while everyone else was unable to.
> 
> I'm trying to figure out if PolicyKit is still working for openSUSE11.2
> (all the files seems to be there so I assumed that meant it was
> available .... but the system doesn't seem to care what I put into those
> files)

You should ask the policykit people about this, it's not really a
hotplug issue at all here.  I'm not sure what they have changed over the
past few years in this area in that program.

> Could you give me some simple instructions on how to write a udev rule to
> do this (I've never worked with udev before) .... or direct me to a good
> tutorial website perhaps. I will do some more web hunting on that.
>  (I guess I will have to take care of the CD burner also. I want that to be
> readable by everyone but not writable. Would udev rules work for this
> also?)

Well, block devices get "wierd" in that HAL is probably doing the
mounting of the device when it is seen by the system automatically.  So
you need to tell it to only mount it 'read-only'.  And I think that
falls back to policykit to handle properly, so I don't think writing a
udev here will help you out at all, sorry.

good luck,

greg k-h