Skip to main content

max / alloy

2.2 KB · 52 lines History Blame Raw
1 # Watch usbguard for refused devices, so a person is told rather than left
2 # holding something that does not work.
3 #
4 # The reasoning is in usr/bin/alloy-usb-notify; this file is only what keeps it
5 # listening. `usbguard watch` is a long-lived IPC client that runs the program
6 # once per event, which is why this is a service rather than something the
7 # console starts.
8 #
9 # ## Why it is not tied to usbguard.service the obvious ways
10 #
11 # BindsTo= and Requires= both PULL THE DAEMON IN, and this must never be a
12 # reason for enforcement to start. Same rule as the seeder and the gate: the
13 # only thing allowed to arm this machine is the preset line and a person.
14 #
15 # Requisite= would avoid that but fails the unit when the daemon is not running,
16 # which on a machine with no policy is the normal state and would leave a failed
17 # unit sitting in `systemctl --failed` saying nothing useful. So the condition is
18 # the same one usbguard itself carries: no policy, no enforcement, nothing to
19 # watch, and both units are skipped quietly for the same reason on the same
20 # machines.
21 #
22 # ## Why it survives the daemon going away
23 #
24 # The keyboard gate stops usbguard whenever the machine loses its keyboard, and
25 # starts it again when one comes back. A watcher that exited on disconnect would
26 # be gone for good after the first such episode, on exactly the machine that has
27 # already had one problem. `usbguard watch --wait` reconnects rather than
28 # exiting. `--once` is the flag that would make it exit, and it is deliberately
29 # not passed. Restart=always covers the rest.
30 #
31 # Measured: with the daemon stopped and started underneath it, the watcher stays
32 # up and keeps delivering.
33
34 [Unit]
35 Description=Tell someone when a USB device is refused
36 Documentation=https://makenot.work/git/max/alloy
37 After=usbguard.service
38 ConditionPathExists=/usr/bin/usbguard
39 # The same condition usbguard.service carries. A machine with no policy is not
40 # enforcing, so there is nothing to report and this is skipped rather than
41 # failed. See etc/systemd/system/usbguard.service.d/.
42 ConditionFileNotEmpty=/etc/usbguard/rules.conf
43
44 [Service]
45 Type=simple
46 ExecStart=/usr/bin/usbguard watch --wait --exec /usr/bin/alloy-usb-notify
47 Restart=always
48 RestartSec=2
49
50 [Install]
51 WantedBy=multi-user.target
52