Enhancement request: disable new USB devices while locked

[Rudd-O]

Quick spec

• systemwide daemon (auto started on boot if enabled via systemd). job of daemon is to latch onto dbus logind interface, and maintain a boolean "is active session unlocked?". when boolean changes, apply USB configuration to runtime kernel as appropriate. this obviously must also be the case upon startup of daemon.

• preference panel that allows the user to select whether to make systemwide daemon active or not, and if config file is not writable, uses consolekit to change its config (probably with permission to change config file defaulting to console user). daemon detects config change and reloads its config. simple state machine to cover all state transitions must be written in daemon.

Qubes integration:

a) qubes preference panel for GUI VM that 1. allows user to designate USB VM 2. allows user to enable / disable the functionality of the systemwide daemon. consolekit policy probably enough to default to qubes one.

b) in the case of running in GUI VM, and sys USB VM is present and configured, the systemwide daemon (server to the user session daemon) no longer does its job of altering runtime kernel config directly, but rather proxies its decisions via qrexec to a process in the USB VM via qrexec service qubes.AlterRuntimeUSBConfig. if qrexec operation fails with VM not connected, then operation should be queued and retried later, to allow for startup of VM.

Here's an idea I thought about when I was traveling last week. I'm posting it now to see if it gets any traction. We don't want USB devices to be activated when machines are locked.

[andrewdavidwong]

How is this different from #2811?

[andrewdavidwong]

How is this different from #2811?

[Rudd-O]

It's both a simpler design and can be contributed to Fedora upstream rather than being Qubes-specific.

…

On April 27, 2018 2:46:34 AM GMT+02:00, Andrew David Wong ***@***.***> wrote: How is this different from #2811? -- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: #3860 (comment)

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.

[Rudd-O]

It's both a simpler design and can be contributed to Fedora upstream rather than being Qubes-specific.

…

On April 27, 2018 2:46:34 AM GMT+02:00, Andrew David Wong ***@***.***> wrote: How is this different from #2811? -- You are receiving this because you authored the thread. Reply to this email directly or view it on GitHub: #3860 (comment)

-- Sent from my Android device with K-9 Mail. Please excuse my brevity.