USB Hub peripherals are erroneously blocked (Framework 13)

[danimalquackers]

I'm running USBGuard 1.1.4 on NixOS 25.11, with GDM/GNOME. I'm using a Framework 13 laptop, which means that the USB expansion cards can end up in any slot and appear differently to USBGuard, but I'm not sure if/how that explains the issue I'm running into. Every other USBGuard rule is working fine, it's just the below rules that don't seem to be working. I would appreciate any pointers or further troubleshooting steps I can take.

When disconnected from peripherals, USBGuard functions correctly with my rules file, allowing all my devices. When I plug into a USB hub and my monitor, USBGuard immediately blocks the connected devices and GNOME locks my screen, even though all of the connected devices are allowed in my rules. I have an AX88179A USB Ethernet adapter and a C925e webcam connected either directly to the hub or to a USB switch connected to the hub, and I have a keyboard and a couple mice connected to the switch as well. Diagram below for the hierarchy.

graph TD;
    FW13-->USB-C-->A["USB Hub"];
    FW13-->HDMI;
    A-->AX88179A;
    A-->B["USB Switch"];
    B-->C["C925e Webcam"];
    B-->Keyboard;
    B-->D["Mouse 1"];
    B-->E["Mouse 2"];

Loading

When I run usbguard list-devices -b it shows the HDMI expansion card, the Ethernet adapter, and the webcam, but the details exactly match the USBGuard rules I already have in place.

❯ usbguard list-devices -b
40: block id 32ac:0002 serial "11AD1D009612330C240F0B00" name "HDMI Expansion Card" hash "v1ruvm+5NRXKwLpbBrLo1loqESsDVY4jaGcDT+GWEj0=" parent-hash "MQZip+JBePURrFBYD63bneLjoNL8BOCc0suxKX7kWPg=" via-port "3-2" with-interface { 11:00:00 03:00:00 } with-connect-type "hotplug"
43: block id 0b95:1790 serial "00000000002D54" name "AX88179A" hash "upreoKfvnqxfoFobGPGThnTzQeMfeYyE2hLPco3DKa4=" parent-hash "xR6PTkjwjSjy35F6CLo1bqKuUk9r7Bqolp55uMSaKAs=" via-port "8-1.3" with-interface { ff:ff:00 02:0d:00 0a:00:01 0a:00:01 02:06:00 0a:00:00 0a:00:00 } with-connect-type "unknown"
47: block id 046d:085b serial "71DCC9DF" name "Logitech Webcam C925e" hash "Vn912biQ0xToqQEK/l13OByxq0eLjMRjpf/7GLCbEJs=" parent-hash "CbRB9LX/JdGjNWCYSOcIwMVXE0UpOR03LCotWrTbuCM=" via-port "7-1.4.3" with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 } with-connect-type "unknown"

The relevant rules are below, especially confusing is why the HDMI Expansion Card is being blocked when it is part of a wildcard rule.

12: allow id 32ac:*
...
20: allow id 046d:085b serial "71DCC9DF" name "Logitech Webcam C925e" hash "Vn912biQ0xToqQEK/l13OByxq0eLjMRjpf/7GLCbEJs="
21: allow id 0b95:1790 serial "00000000002D54" name "AX88179A" hash "upreoKfvnqxfoFobGPGThnTzQeMfeYyE2hLPco3DKa4="

When I look at the USBGuard logs, it shows that they're blocked but doesn't explain why, even though I get the impression the rules should match. Is there something I'm missing with my rules that is needed to make this work? Does this have something to do with the devices being blocked before USBGuard can apply the rules?

May 27 17:31:03 pike usbguard-daemon[1598]: [1779928263.008] (A) uid=0 pid=1598 result='SUCCESS' device.rule='allow id 32ac:0002 serial "11AD1D009612330C240F0B00" name "HDMI Expansion Card" hash "v1ruvm+5NRXKwLpbBrLo1loqESsDVY4jaGcDT+GWEj0=" parent-hash "MQZip+JBePURrFBYD63bneLjoNL8BOCc0suxKX7kWPg=" via-port "3-2" with-interface { 11:00:00 03:00:00 } with-connect-type "hotplug"' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.0/usb3/3-2' type='Device.Remove'
May 27 17:31:05 pike usbguard-daemon[1598]: [1779928265.554] (A) uid=0 pid=1598 result='SUCCESS' device.rule='block id 32ac:0002 serial "11AD1D009612330C240F0B00" name "HDMI Expansion Card" hash "v1ruvm+5NRXKwLpbBrLo1loqESsDVY4jaGcDT+GWEj0=" parent-hash "MQZip+JBePURrFBYD63bneLjoNL8BOCc0suxKX7kWPg=" via-port "3-2" with-interface { 11:00:00 03:00:00 } with-connect-type "hotplug"' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.0/usb3/3-2' type='Device.Insert'
May 27 17:31:05 pike usbguard-daemon[1598]: [1779928265.554] (A) uid=0 pid=1598 result='SUCCESS' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.0/usb3/3-2' target.new='block' device.rule='block id 32ac:0002 serial "11AD1D009612330C240F0B00" name "HDMI Expansion Card" hash "v1ruvm+5NRXKwLpbBrLo1loqESsDVY4jaGcDT+GWEj0=" parent-hash "MQZip+JBePURrFBYD63bneLjoNL8BOCc0suxKX7kWPg=" via-port "3-2" with-interface { 11:00:00 03:00:00 } with-connect-type "hotplug"' target.old='block' type='Policy.Device.Update'
...
May 27 17:31:21 pike usbguard-daemon[1598]: [1779928281.527] (A) uid=0 pid=1598 result='SUCCESS' device.rule='block id 0b95:1790 serial "00000000002D54" name "AX88179A" hash "upreoKfvnqxfoFobGPGThnTzQeMfeYyE2hLPco3DKa4=" parent-hash "xR6PTkjwjSjy35F6CLo1bqKuUk9r7Bqolp55uMSaKAs=" via-port "8-1.3" with-interface { ff:ff:00 02:0d:00 0a:00:01 0a:00:01 02:06:00 0a:00:00 0a:00:00 } with-connect-type "unknown"' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.4/usb8/8-1/8-1.3' type='Device.Insert'
May 27 17:31:21 pike usbguard-daemon[1598]: [1779928281.527] (A) uid=0 pid=1598 result='SUCCESS' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.4/usb8/8-1/8-1.3' target.new='block' device.rule='block id 0b95:1790 serial "00000000002D54" name "AX88179A" hash "upreoKfvnqxfoFobGPGThnTzQeMfeYyE2hLPco3DKa4=" parent-hash "xR6PTkjwjSjy35F6CLo1bqKuUk9r7Bqolp55uMSaKAs=" via-port "8-1.3" with-interface { ff:ff:00 02:0d:00 0a:00:01 0a:00:01 02:06:00 0a:00:00 0a:00:00 } with-connect-type "unknown"' target.old='block' type='Policy.Device.Update'
...
May 27 17:31:45 pike usbguard-daemon[1598]: [1779928305.068] (A) uid=0 pid=1598 result='SUCCESS' device.rule='block id 046d:085b serial "71DCC9DF" name "Logitech Webcam C925e" hash "Vn912biQ0xToqQEK/l13OByxq0eLjMRjpf/7GLCbEJs=" parent-hash "CbRB9LX/JdGjNWCYSOcIwMVXE0UpOR03LCotWrTbuCM=" via-port "7-1.4.3" with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 } with-connect-type "unknown"' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.4/usb7/7-1/7-1.4/7-1.4.3' type='Device.Insert'
May 27 17:31:45 pike usbguard-daemon[1598]: [1779928305.068] (A) uid=0 pid=1598 result='SUCCESS' device.system_name='/devices/pci0000:00/0000:00:08.3/0000:c3:00.4/usb7/7-1/7-1.4/7-1.4.3' target.new='block' device.rule='block id 046d:085b serial "71DCC9DF" name "Logitech Webcam C925e" hash "Vn912biQ0xToqQEK/l13OByxq0eLjMRjpf/7GLCbEJs=" parent-hash "CbRB9LX/JdGjNWCYSOcIwMVXE0UpOR03LCotWrTbuCM=" via-port "7-1.4.3" with-interface { 0e:01:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 0e:02:00 01:01:00 01:02:00 01:02:00 01:02:00 01:02:00 } with-connect-type "unknown"' target.old='block' type='Policy.Device.Update'

I also noticed that if I usbguard allow-device <id> my Ethernet adapter specifically, it fails to allow and remains blocked, plus locks my screen, like the device is being reset.

[muelli]

hm. maybe the GNOME USB protection gets in the way. But you should receive a notification when a device is blocked. Can you check whether this helps? #691 (comment)

[danimalquackers]

Yeah, looks like that was the trick! Turns out I had usb-protection = true and usb-protection-level = always, and it definitely seemed to be interfering. Turning the GNOME protection off makes everything work as expected, although annoyingly I don't get a notification when a device is blocked.

[muelli]

hrm. I wonder why the notification doesn't work, though.
I have vague memories of the notification delivery on the lockscreen having changed.
Do you see any notifications after unlocking?