Add UsbGuard support

[fcsonline]

I think it would be great to add support for UsbGuard in Omarchy.

Right now any USB device just gets accepted, and UsbGuard gives us the tooling to lock this down. With a small helper on top, Omarchy could even show an allow/deny prompt when a new device appears.

What this would bring:

• Block-by-default for unknown devices
• Auto-generated rules for existing hardware
• Straightforward rule management (vendor/product IDs, serials, classes)
• Room for a lightweight notifier to approve or deny new devices

It could be a great addition, increase the default security of Omarchy and avoid common HID/BadUSB attacks.

Package: UsbGuard

[dimitrieh]

Agreed here. I have this implemented locally atm

Got a branch at the ready for contribution: https://github.com/dimitrieh/omarchy/tree/feature/usbguard-support (AI aided in development)

includes:

• omarchy-setup-usbguard — setup wizard (install, generate policy, enable services, configure hypridle hooks)
• omarchy-usbguard-notify — listens for blocked devices, sends mako notifications
• omarchy-usbguard-allow — click-to-allow handler (allows device permanently)
• Systemd user service for the listener
• Mako notification rule + menu integration (Setup > Security + Remove)
• Lock/unlock: blocks new USB devices while screen is locked via hypridle
• Clean removal with --remove flag

Tested on a T2 MacBook where all internal devices are USB behind the T2 chip

[Skymebr]

Hey everyone! :)

Building on this discussion and @dimitrieh's prototype, I’ve put together a
complete, working implementation tailored for modern Quickshell / Omarchy Shell:

Repository: https://github.com/Skymebr/omarchy-usbguard

Highlights:

• Native Quickshell Menu (omarchy-menu-select): 3-way modal selector (Allow for
session, Trust permanently, Keep blocked).
• Real Hardware Names: Resolves vendor and model via the lsusb database (e.g., Alcor
Micro Corp. Flash Drive · Storage instead of generic Mass Storage).
• Anti-BadUSB Classification: Detects Keyboards (⌨️), Mice (🖱️), Storage (💾), Audio
(🎧), and Network (🌐) with dedicated icons.
• Smart Debouncing & Disconnect Alerts: Single clean toast per event + auto-
dismissing unplug notifications.
• 1-Command Setup & Rollback: ./omarchy-setup-usbguard (includes --remove support).

Tested locally on Omarchy and working smoothly with zero friction. Happy to
collaborate or submit this as an upstream PR!

[fcsonline]

Lol, I also was working on this:

omacom/omarchy-plugin-marketplace#2575

[fcsonline]

@Skymebr and @dimitrieh, what do you think is we join forces and design a common solution, with the best ideas from all of us?

[fcsonline]

So, how do you want to organize ourselves?

[dimitrieh]

@fcsonline Heya, for me no active involvement for now. I left my code in case it would be useful to others. I'd say put forward a PR if that is in alignment with the contribution guidelines. Then the maintainers will help you get it merged if good enough. Feel free to use the code.