Due to security reasons, I want to prevent that input devices can not be used on a certain USB port. Non-input functionality (e.g. mass storage or ttyUSB) must be available on this port. Input devices must be still working on other USB ports.

"can not be used" means that e.g. no corresponding /dev/input/eventX device is created and common frameworks (X11, linux console) do not accept input from the device.

I can identify the USB port by udev rules like


but I am not sure how to disable it.

Ancient udev versions supported OPTIONS+="ignore_device" but this option is gone.

How can I do this?


You need to write a rule for each of the possible types of input device, ie:


In the rule, test that the environment variable with that name is non-empty, eg match it with the glob pattern ?* which only matches if there is at least one character. Eg:


In each rule, when it matches, set the device's authorized attribute to 0, eg:


It is best to replace = with := so it cannot be overridden by a later rule. This gives a typical rule of:

ACTION=="add", DEVPATH=="...", ENV{ID_INPUT_KEYBOARD}=="?*", ATTR{authorized}:="0"

See this presentation by Adrian Crenshaw.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.