21

I want to disable usb devices based on vendor id in Linux environment. I want to allow only specific USB devices, based on vendor id.

Improve this question
2

3 Answers 3

Reset to default
18

You can make a udev rule that disables devices by default, but enables certain ones by vendor ID. Make a file /etc/udev/rules.d/01-usblockdown.rules that contains a rule to disable devices:

ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

And then rules to enable the devices you want to allow (you can use ATTR{idVendor} to get at the vendor ID):

ACTION=="add", ATTR{idVendor}=="0000" RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

See "Locking down Linux using UDEV" for more information.

Improve this answer
4
  • is the above command is enough or we have to do any udevadm trigger to get effect of this.
    – subbarao
    Mar 4, 2013 at 9:24
  • hi Stephane, we have to add both rules to allow specific pendrive?
    – subbarao
    Mar 5, 2013 at 5:44
  • @subbarao Yes, you have to add both rules, the first blocks anything per default, the second allows certain devices.
    – DBX12
    Oct 23, 2017 at 9:15
  • This works for when you plug in, say a keyboard, once the system is booted. But if the keyboard is connected and you reboot, the keyboard works upon the OS booting back up. Unplugging the keyboard then re-plug, the keyboard doesn't work as expected. Is there some area more lower level that this rule can be run before boot devices are activated?
    – ScottN
    Mar 24, 2020 at 21:26
7

(this might have been better as a comment but I lack the points so expanded it into an answer)

I came here searching for how to allow all usb devices except disabling a specific one by vendor and product id. How to disable a usb sound device with udev answers it for the 0d8c:000c example.

Create /etc/udev/rules.d/disable-usb-device.rules:

ACTION=="add", ATTR{idVendor}=="0d8c", ATTR{idProduct}=="000c", RUN="/bin/sh -c 'echo 0 >/sys/\$devpath/authorized'"

There a discrepancy between the answer and a comment below with RUN= vs. RUN+=, I tried the former and it worked fine.

I was expecting dmesg or lusb to report differently but they both show the un-authorized device getting enumerated just as before, but other processes/modules that would have launched automatically appear to not be running which was the desired effect. cat /sys/bus/usb/devices/1-2.2.1.1.4/authorized (the 1-2.2... for example which can be found in dmesg) shows that the 0 was put in the right place.

Improve this answer
3
  • I don't know if there was some changes in-between in udev, but nowadays attributes are named ATTRS (plural) and not ATTR when I query devices with udevadm.
    – Baptiste Mille-Mathias
    Dec 4, 2019 at 12:43
  • 1
    It is ATTR for the attributes of the exact device udev is focusing on, and ATTRS for attributes belonging to its parent devices.
    – telcoM
    Jul 9, 2020 at 8:46
  • 1
    Maybe worth mentioning that the "idVendor" and "idProduct" can be found with lsusb .. they are the 2 sets of 4 hexadecimal numbers separated by :, left side is vendor, right side is product, so e.g. 0bda:8153 -> 0bda for idVendor and 8153 for idProduct.
    – Janne Enberg
    Oct 7 at 7:57
5

This worked for me on Ubuntu 20.04:

$ cat /etc/udev/rules.d/81-elan-fingerprint.rules
# ID 04f3:0c28 Elan Microelectronics Corp. ELAN:Fingerprint should be disabled
ACTION=="add", ATTR{idVendor}=="04f3", ATTR{idProduct}=="0c28", RUN="/bin/sh -c 'echo 1 >/sys/\$devpath/remove'"

This makes the usb device unusuable, as it's removed as soon as is plugged in, removing 'ATTR{idProduct}=="0c28",' should do the same for all devices from that vendor.

Improve this answer
1
  • Thanks for your contribution. Can you edit your question and add a little explanation about what part of your answer solves the question? Thanks.
    – Mark Stewart
    Oct 28, 2020 at 12:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .