| 1 |
# Watch usbguard for refused devices, so a person is told rather than left |
| 2 |
# holding something that does not work. |
| 3 |
# |
| 4 |
# The reasoning is in usr/bin/alloy-usb-notify; this file is only what keeps it |
| 5 |
# listening. `usbguard watch` is a long-lived IPC client that runs the program |
| 6 |
# once per event, which is why this is a service rather than something the |
| 7 |
# console starts. |
| 8 |
# |
| 9 |
# ## Why it is not tied to usbguard.service the obvious ways |
| 10 |
# |
| 11 |
# BindsTo= and Requires= both PULL THE DAEMON IN, and this must never be a |
| 12 |
# reason for enforcement to start. Same rule as the seeder and the gate: the |
| 13 |
# only thing allowed to arm this machine is the preset line and a person. |
| 14 |
# |
| 15 |
# Requisite= would avoid that but fails the unit when the daemon is not running, |
| 16 |
# which on a machine with no policy is the normal state and would leave a failed |
| 17 |
# unit sitting in `systemctl --failed` saying nothing useful. So the condition is |
| 18 |
# the same one usbguard itself carries: no policy, no enforcement, nothing to |
| 19 |
# watch, and both units are skipped quietly for the same reason on the same |
| 20 |
# machines. |
| 21 |
# |
| 22 |
# ## Why it survives the daemon going away |
| 23 |
# |
| 24 |
# The keyboard gate stops usbguard whenever the machine loses its keyboard, and |
| 25 |
# starts it again when one comes back. A watcher that exited on disconnect would |
| 26 |
# be gone for good after the first such episode, on exactly the machine that has |
| 27 |
# already had one problem. `usbguard watch --wait` reconnects rather than |
| 28 |
# exiting. `--once` is the flag that would make it exit, and it is deliberately |
| 29 |
# not passed. Restart=always covers the rest. |
| 30 |
# |
| 31 |
# Measured: with the daemon stopped and started underneath it, the watcher stays |
| 32 |
# up and keeps delivering. |
| 33 |
|
| 34 |
[Unit] |
| 35 |
Description=Tell someone when a USB device is refused |
| 36 |
Documentation=https://makenot.work/git/max/alloy |
| 37 |
After=usbguard.service |
| 38 |
ConditionPathExists=/usr/bin/usbguard |
| 39 |
# The same condition usbguard.service carries. A machine with no policy is not |
| 40 |
# enforcing, so there is nothing to report and this is skipped rather than |
| 41 |
# failed. See etc/systemd/system/usbguard.service.d/. |
| 42 |
ConditionFileNotEmpty=/etc/usbguard/rules.conf |
| 43 |
|
| 44 |
[Service] |
| 45 |
Type=simple |
| 46 |
ExecStart=/usr/bin/usbguard watch --wait --exec /usr/bin/alloy-usb-notify |
| 47 |
Restart=always |
| 48 |
RestartSec=2 |
| 49 |
|
| 50 |
[Install] |
| 51 |
WantedBy=multi-user.target |
| 52 |
|