I have blocked all USB storage devices by using this udev rule:

ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

Everything works fine before and after reboot. But the problem is that USB storage devices that are attached before or during reboot process are still mounting in the system.

  • Make sure that your udev rules are also contained in the initramfs that's used for booting. It's possible to have different rules in the initramsfs and on your normal filesystem, and I've tripped over this in the past. – dirkt Jan 5 '18 at 19:32

To ensure the equivalent of your udev rule is applied at boot, before any device is considered, you should add usbcore.authorized_default=0 to the kernel command line. This will de-authorise all USB devices by default.

Note that if you do need certain USB devices to boot (your keyboard perhaps), you’ll need to add a rule to enable them.

usb device attacks, can udev save the kernel? has more on this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.