How to prevent HID device on certain USB ports?

Question

Due to security reasons, I want to prevent that input devices can not be used on a certain USB port. Non-input functionality (e.g. mass storage or ttyUSB) must be available on this port. Input devices must be still working on other USB ports.

"can not be used" means that e.g. no corresponding /dev/input/eventX device is created and common frameworks (X11, linux console) do not accept input from the device.

I can identify the USB port by udev rules like

DEVPATH=="/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.7/2-1.7.1/*"

but I am not sure how to disable it.

Ancient udev versions supported OPTIONS+="ignore_device" but this option is gone.

How can I do this?

Answer 1

You need to write a rule for each of the possible types of input device, ie:

• ID_INPUT_KEYBOARD
• ID_INPUT_KEY
• ID_INPUT_MOUSE
• ID_INPUT_TOUCHPAD
• ID_INPUT_TABLET
• ID_INPUT_JOYSTICK

In the rule, test that the environment variable with that name is non-empty, eg match it with the glob pattern ?* which only matches if there is at least one character. Eg:

ENV{ID_INPUT_KEYBOARD}=="?*"

In each rule, when it matches, set the device's authorized attribute to 0, eg:

ATTR{authorized}="0"

It is best to replace = with := so it cannot be overridden by a later rule. This gives a typical rule of:

ACTION=="add", DEVPATH=="...", ENV{ID_INPUT_KEYBOARD}=="?*", ATTR{authorized}:="0"

See this presentation by Adrian Crenshaw.