USBGUARD(1) | USBGUARD(1) |
usbguard - USBGuard command-line interface
usbguard [OPTIONS] <subcommand> [SUBCOMMAND-OPTIONS] ...
usbguard get-parameter name
usbguard set-parameter name value
usbguard list-devices
usbguard allow-device id | rule | partial-rule
usbguard block-device id | rule | partial-rule
usbguard reject-device id | rule | partial-rule
usbguard list-rules
usbguard append-rule rule
usbguard remove-rule id
usbguard generate-policy
usbguard watch
usbguard read-descriptor file
usbguard add-user name
usbguard remove-user name
The usbguard command provides a command-line interface (CLI) to a running usbguard-daemon(8) instance. It also provides a tool for generating initial USBGuard policies based on USB devices connected to the system.
Get the value of a runtime parameter. Parameter name is one of InsertedDevicePolicy and ImplicitPolicyTarget.
Available options:
-h, --help
Set the value of a runtime parameter. Parameter name is one of InsertedDevicePolicy and ImplicitPolicyTarget.
Available options:
-v, --verbose
-h, --help
List all USB devices recognized by the USBGuard daemon.
Available options:
-a, --allowed
-b, --blocked
-h, --help
Authorize a device to interact with the system. The device can be identified by either a device id, rule or partial-rule (rule without target). Both rule and partial-rule can be used to allow multiple devices at once. Note that id refers to the internal device-rule ID (the very first number of the list-devices command output) rather than the device’s ID attribute.
Available options:
-p, --permanent
-h, --help
Deauthorize a device. The device can be identified by either a device id, rule or partial-rule (rule without target). Both rule and partial-rule can be used to block multiple devices at once. Note that id refers to the internal device-rule ID (the very first number of the list-devices command output) rather than the device’s ID attribute.
Available options:
-p, --permanent
-h, --help
Deauthorize and remove a device. The device can be identified by either a device id, rule or partial-rule (rule without target). Both rule and partial-rule can be used to reject multiple devices at once. Note that id refers to the internal device-rule ID (the very first number of the list-devices command output) rather than the device’s ID attribute.
Available options:
-p, --permanent
-h, --help
List the rule set (policy) used by the USBGuard daemon.
Available options:
-d, --show-devices
-l, --label label
-h, --help
Append the rule to the current rule set.
Available options:
-a, --after id
-t, --temporary
-h, --help
Remove a rule identified by the rule id from the rule set.
Available options:
-h, --help
Generate a rule set (policy) which authorizes the currently connected USB devices.
Available options:
-p, --with-ports
-P, --no-ports-sn
-d, --devpath devpath
-t, --target target
-X, --no-hashes
-H, --hash-only
-L, --ldif
-b, --usbguardbase base
-o, --objectclass objectclass
-n, --name-prefix prefix
-h, --help
Watch the IPC interface events and print them to stdout.
Available options:
-w, --wait
-o, --once
-e, --exec path
-h, --help
Read a USB descriptor from a file and print it in human-readable form.
Available options:
-h, --help
Create an IPC access control file allowing the user/group identified by name to use the USBGuard IPC bus. The change takes effect only after restarting the usbguard-daemon(8) instance.
Available options:
-u, --user
-g, --group
-p, --policy privileges
-d, --devices privileges
-e, --exceptions privileges
-P, --parameters privileges
-h, --help
Privileges:
The privileges are expected to be in the form of a list separated by a colon:
$ sudo usbguard add-user joe --devices=listen,modify
Consult the usbguard-daemon.conf(5) man-page for a detailed list of available privileges in each section.
Remove an IPC access control file associated with the user/group identified by name. The change takes effect only after restarting the usbguard-daemon(8) instance.
Available options:
-u, --user
-g, --group
-h, --help
Generating an initial policy:
Allow device(s):
usbguard-daemon(8), usbguard-daemon.conf(5), usbguard-rules.conf(5)
02/06/2021 |