0

in RHEL 8.9, there is a holdover problem with usbguard. For example:

  • usbguard active with rules.conf having just allow with-interface one-of { 03:*:* 09:*:* } to allow human interface devices (kybds/mice) and usb hubs
  • I do service usbguard stop
  • I then plug in a usb external disk, Apricorn, which has id 0984:1400 and would be interface { 08:06:50 } with 08 being mass storage devices.
  • even with usbguard service stopped, it appears that anything previously not whitelisted will not function
    • you could whitelist the new device, do service usbguard start followed by service usbguard stop and then that device will work.
    • this is problematic when I have multiple or new devices I want to use or test and don't want to make a mess of an existing rules.conf
    • i want things to operate like they would have prior to ever having started usbguard
    • i don't want to resort to a reboot to clear things if usbguard had been in effect and then I have some usbdevice problem where now knowing just stopping the usbguard service doesn't really stop its effects.

is there a linux command that will reset this usbguard effect? causing a usb bus reset or something?

6
  • Does it work if you whitelist it and then restart the service? Feb 21 at 17:27
  • Does it work if you whitelist it and then restart the service? yes
    – ron
    Feb 21 at 18:13
  • Don’t you get a notification asking you whether to allow the device? You shouldn’t have to stop and start the service. Feb 21 at 19:35
  • @ron If you want to stop usbguard from blocking usb devices while testing, try systemctl disable usbguard.service Or, is there a reason that you need it running while testing usb devices?
    – Garnet
    Feb 22 at 15:48
  • a yum install usbguard does not also install usbguard-notifier. Once i installed usbguard-notifier the popup within the gnome desktop started happening saying usbguard allowed or usbguard blocked
    – ron
    Feb 22 at 17:09

1 Answer 1

0

Is there a way I can get my usb disk to be mountable without having to reboot the system given what i've described?

As tested in the comments: add the device to the whitelist and restart the service.

6
  • I literally copied the question from your post and answered it (so I'm a bit surprised you say it's not what you asked!). Can you explain what is wrong about this approach? How does it not fit your needs? Feb 21 at 18:36
  • you did not specify that in your question, so I'm now a bit surprised. Stopping usbguard doesn't leave your system in a dirty state – I'd say stopping to allow things is what should happen when you stop such a security service, right? Because that is failing towards a safe state, instead of failing towards an unsafe state. But why would you modify rules.conf? Isn't usbguard allow-device what you want in this situation to whitelist a device? Feb 21 at 18:55
  • i reworded the question
    – ron
    Feb 21 at 20:00
  • thanks. Why do you stop usbguard then? that seems like plain the wrong thing to do! refer to the usbguard man page on how to control the run-time behaviour of usbguard. Feb 21 at 20:03
  • you will have to explain why stopping the usbguard service is the wrong thing to do, and let me know what man page where explains how to control the runtime behavior. I started a service, it was problematic, stopping it didn't stop the problems it was causing until I reboot with the service disabled, I don't know how else to say it.
    – ron
    Feb 22 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .