Re: How to use Udev to restrict USB access only to particular set of

[Greg KH <greg@kroah.com>]

On Thu, Feb 24, 2011 at 03:52:16PM +0200, Vilius Benetis wrote:
> On Tue, Feb 22, 2011 at 4:38 PM, Greg KH <greg@kroah.com> wrote:
> > Ok, what is the udev rule that you tried and did not work?
> 
> we tried to disable USB storage sticks with the following command:
> 
> SUBSYSTEMS="usb" DRIVERS="usb-storage"  OPTIONS:="ignore_device"
> 
> but we failed to make it work.

Ignoring the device still makes it "active" in the system, especially as
you just tested that the usb-storage device was bound to your device
(which wouldn't be true that early in the process, which is one reason
why this failed).  

you need to write a 0 to the "authorized" file in sysfs which will
disable the whole USB device entirely if it meets your "list of devices
to reject".  You also need to test not for driver binding, which again
will not have happened, and you don't want to have happen, but that it
is a usb storage device type (by virtue of the correct class config
options as shown by sysfs) and that it doesn't pass your list of valid
serial numbers.

Note, all of that might be easier to do in a script than in a udev rule
alone, but it should be possible.

Hope this helps,

greg k-h