11

I want to disable usb devices based on vendor id in Linux environment. I want to allow only specific USB devices, based on vendor id.

10

You can make a udev rule that disables devices by default, but enables certain ones by vendor ID. Make a file /etc/udev/rules.d/01-usblockdown.rules that contains a rule to disable devices:

ACTION=="add", SUBSYSTEMS=="usb", RUN+="/bin/sh -c 'for host in /sys/bus/usb/devices/usb*; do echo 0 > $host/authorized_default; done'"

And then rules to enable the devices you want to allow (you can use ATTR{idVendor} to get at the vendor ID):

ACTION=="add", ATTR{idVendor}=="0000" RUN+="/bin/sh -c 'echo 1 >/sys$DEVPATH/authorized'"

See "Locking down Linux using UDEV" for more information.

  • is the above command is enough or we have to do any udevadm trigger to get effect of this. – subbarao Mar 4 '13 at 9:24
  • hi Stephane, we have to add both rules to allow specific pendrive? – subbarao Mar 5 '13 at 5:44
  • @subbarao Yes, you have to add both rules, the first blocks anything per default, the second allows certain devices. – DBX12 Oct 23 '17 at 9:15
3

(this might have been better as a comment but I lack the points so expanded it into an answer)

I came here searching for how to allow all usb devices except disabling a specific one by vendor and product id. How to disable a usb sound device with udev answers it for the 0d8c:000c example.

Create /etc/udev/rules.d/disable-usb-device.rules:

ACTION=="add", ATTR{idVendor}=="0d8c", ATTR{idProduct}=="000c", RUN="/bin/sh -c 'echo 0 >/sys/\$devpath/authorized'"

There a discrepancy between the answer and a comment below with RUN= vs. RUN+=, I tried the former and it worked fine.

I was expecting dmesg or lusb to report differently but they both show the un-authorized device getting enumerated just as before, but other processes/modules that would have launched automatically appear to not be running which was the desired effect. cat /sys/bus/usb/devices/1-2.2.1.1.4/authorized (the 1-2.2... for example which can be found in dmesg) shows that the 0 was put in the right place.

  • I don't know if there was some changes in-between in udev, but nowadays attributes are named ATTRS (plural) and not ATTR when I query devices with udevadm. – Baptiste Mille-Mathias Dec 4 '19 at 12:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.