Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to disable usb devices based on vendor id in Linux environment. I want to allow only specific USB devices, based on vendor id.

share|improve this question
    
How to Block USB/PEN DRIVE in Linux (kali linux) grprajapat.blogspot.in/2014/09/… –  user84781 Sep 20 '14 at 6:38
    
I have one specific vendor:device ID I want to disable cdc_acm for. I have since made this into a separate question. –  mirabilos Nov 3 '14 at 13:52

2 Answers 2

You can make a udev rule that disables devices by default, but enables certain ones by vendor ID. Make a file /etc/udev/rules.d/01-usblockdown.rules that contains a rule to disable devices:

ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

And then rules to enable the devices you want to allow (you can use ATTR{idVendor} to get at the vendor ID):

ACTION=="add", ATTR{idVendor}=="0000" RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

See "Locking down Linux using UDEV" for more information.

share|improve this answer
    
is the above command is enough or we have to do any udevadm trigger to get effect of this. –  subbarao Mar 4 '13 at 9:24
    
hi Stephane, we have to add both rules to allow specific pendrive? –  subbarao Mar 5 '13 at 5:44
    
@mirabilos, try asking a separate question. –  Stéphane Chazelas Nov 2 '14 at 19:31

(this might have been better as a comment but I lack the points so expanded it into an answer)

I came here searching for how to allow all usb devices except disabling a specific one by vendor and product id. How to disable a usb sound device with udev answers it for the 0d8c:000c example.

Create /etc/udev/rules.d/disable-usb-device.rules:

ACTION=="add", ATTR{idVendor}=="0d8c", ATTR{idProduct}=="000c", RUN="/bin/sh -c 'echo 0 >/sys/\$devpath/authorized'"

There a discrepancy between the answer and a comment below with RUN= vs. RUN+=, I tried the former and it worked fine.

I was expecting dmesg or lusb to report differently but they both show the un-authorized device getting enumerated just as before, but other processes/modules that would have launched automatically appear to not be running which was the desired effect. cat /sys/bus/usb/devices/1-2.2.1.1.4/authorized (the 1-2.2... for example which can be found in dmesg) shows that the 0 was put in the right place.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.