3

I'm trying to write a udev rule to allow USB mass storage devices but reject anything else (keyboard, mouse, etc). I found this online:

ACTION!="add", GOTO="deauthorize_end"
SUBSYSTEM!="usb", GOTO="deauthorize_end"
TEST!="authorized", GOTO="deauthorize_end"

## make hubs deauthorize all devices by default
TEST=="authorized_default", ATTR{authorized_default}="0", GOTO="deauthorize_end"

## CHECK FOR USB MASS STORAGE HERE
SOMETHING=="something", ENV{valid}="1"


## authorize matched devices, warn about the rest
ENV{valid}=="1", ENV{valid}="", ATTR{authorized}="1", GOTO="deauthorize_end"
RUN+="/usr/local/bin/usb-unauth $devpath"
LABEL="deauthorize_end"

I have this saved in /etc/udev/rules.d/99-usb-unauth.rule - my problem is the CHECK FOR USB MASS STORAGE bit, I can't work out what to put there. The rule is working fine because I can put other things in there like vendor/product IDs and they work fine.

I've tried SUBSYSTEM=="block", SUBSYSTEMS=="block" and all sorts of other keys found using udevadm info -a -p $(udevadm info -q path -n /dev/myDevNode) but nothing seems to make it accept the drive.

What am I doing wrong? What can I match on to catch all mass storage devices? It needs to be all, not just a specific one.

Edit: Looking at the udev log it seems like my rule is running too soon:

set children_max to 16
validate module index
Check if link configuration needs reloading.
seq 2693 queued, 'add' 'usb'
seq 2693 forked new worker [26127]
seq 2693 running
no db file to read /run/udev/data/c189:224: No such file or directory
device 0xb77b68e0 has devpath '/devices/pci0000:00/0000:00:1d.0/usb2/2-1'
device 0xb77b6c90 has devpath '/devices/pci0000:00/0000:00:1d.0/usb2'
device 0xb77b7040 has devpath '/devices/pci0000:00/0000:00:1d.0'
device 0xb77b72c8 has devpath '/devices/pci0000:00'
IMPORT builtin 'usb_id' /lib/udev/rules.d/50-udev-default.rules:9
IMPORT builtin 'hwdb' /lib/udev/rules.d/50-udev-default.rules:9
MODE 0664 /lib/udev/rules.d/50-udev-default.rules:41
ATTR '/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.4/authorized' writing '1' /etc/udev/rules.d/99-usb-deauth.rules:21

Surely my rule, starting with 99-... should not be run third? I think I need it to run later.

Another edit: So I think the problem is that as soon as we get past SUBSYSTEM!="usb", GOTO="deauthorize_end" (i.e., SUBSYSTEM=="usb") the rest of this rule is evaluated, and I can see from udevadm that at that point the usb subsystem is just "USB" to get "usb-storage" it needs to go one level up. Is there any way to do that from the rule?

  • Try adding another key after SUBSYSTEM=="block", e.g. ENV{ID_USB_DRIVER}=="usb-storage" and/or ENV{ID_BUS}=="usb"... – don_crissti Nov 3 '15 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.