Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upNo confirmation dialog when attaching USB mouse #3481
Comments
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
marmarek
Jan 19, 2018
Member
This is intended effect, only mouse is allowed by default (but keyboard is not). See https://www.qubes-os.org/doc/usb/#security-warning-about-usb-input-devices for details
If you want to get confirmation, edit /etc/qubes-rpc/policy/qubes.InputMouse and change allow to ask,default_target=dom0.
|
This is intended effect, only mouse is allowed by default (but keyboard is not). See https://www.qubes-os.org/doc/usb/#security-warning-about-usb-input-devices for details If you want to get confirmation, edit |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
mossy-nw
Jan 19, 2018
From qrexec policy documentation I think this is the result of default setting /etc/qubes-rpc/policy/qubes.InputMouse to
sys-usb dom0 allow,user=root
mossy-nw
commented
Jan 19, 2018
|
From qrexec policy documentation I think this is the result of default setting |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
mossy-nw
Jan 19, 2018
ah. you beat me to it. perfect, thanks @marmarek
I'll read through to see if the docs need updating, update if need be then close the issue.
mossy-nw
commented
Jan 19, 2018
•
edited
Edited 1 time
-
mossy-nw
edited Jan 19, 2018 (most recent)
edited
-
Jan 19, 2018 (most recent)
|
ah. you beat me to it. perfect, thanks @marmarek |
mossy-nw commentedJan 19, 2018
Qubes OS version:
R4.0
Affected TemplateVMs:
Steps to reproduce the behavior:
Attach USB mouse to system running sys-usb qube
Expected behavior:
Dialog pops up requiring confirmation before mouse input is passed through sys-usb to dom0
Actual behavior:
Mouse input it passed through with just a popup notification (no dialog/user action required).
General notes:
Seems like even if intentional this could be a security risk? I always feel nervous giving anything access to dom0, it makes me feel slightly better to give explicit consent (as under R3.2).
Related issues:
perhaps removing friction from the default target input issue #3251 removed too much friction? : )