877eddc184
- /home/.chezmoiscripts/qubes/run_onchange_after_11-set-wallpaper.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_12-update-dom0.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_13-install-official-templates.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_14-ensure-minimal-vms-passwordless.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_15-install-unofficial-templates.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_16-update-template-vms.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_17-install-mirage-firewall.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_18-configure-sys-usb.sh.tmpl - /home/.chezmoiscripts/qubes/run_onchange_before_19-setup-sys-gui.sh.tmpl - /home/.chezmoiscripts/_universal/run_before_01-add-temporary-includes.sh.tmpl - /home/.chezmoiscripts/_universal/run_onchange_before_05-install-homebrew.sh.tmpl - /home/.chezmoiscripts/universal/run_before_01-decrypt-age-key.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_11-set-wallpaper.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_12-update-dom0.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_13-install-official-templates.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_14-ensure-minimal-vms-passwordless.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_15-install-unofficial-templates.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_16-update-template-vms.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_17-install-mirage-firewall.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_18-configure-sys-usb.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_before_19-setup-sys-gui.sh.tmpl - /home/.chezmoiscripts/universal/run_before_01-add-temporary-includes.sh.tmpl - /home/.chezmoiscripts/universal/run_before_01-install-homebrew.sh.tmpl - /home/.chezmoiscripts/universal/run_before_02-decrypt-age-key.sh.tmpl - /scripts/cloudflared-ssh.sh - /scripts/src/cloudflared-ssh.sh.tmpl
31 lines
1.5 KiB
Cheetah
31 lines
1.5 KiB
Cheetah
{{- if (eq .host.distro.id "qubes") -}}
|
|
#!/usr/bin/env bash
|
|
# @file Qubes `sys-usb`
|
|
# @brief Enables `sys-usb` and configures it with ideal security settings
|
|
# @description
|
|
# This script ensures that Qubes uses `sys-usb` for USB connections. It also optimizes the configuration
|
|
# by applying security configurations that the Qubes documentation recommends.
|
|
|
|
### Enable sys-usb
|
|
logg info 'Modifying Salt configuration to be able to enable sys-usb'
|
|
qubesctl top.enabled pillar=True || EXIT_CODE=$?
|
|
qubesctl state.highstate || EXIT_CODE=$?
|
|
logg info 'Ensuring sys-net-as-usbvm is removed'
|
|
qubesctl top.disable qvm.sys-net-as-usbvm pillar=True || EXIT_CODE=$?
|
|
logg info 'Ensuring sys-usb is setup and that it is properly configured with the keyboard'
|
|
qubesctl state.sls qvm.usb-keyboard
|
|
|
|
### Configure USB keyboard settings
|
|
if [ "{{ .qubes.promptKeyboards }}" = 'true' ]; then
|
|
logg info 'Ensure USB keyboards are only allows to connect after prompt is answered'
|
|
logg warn 'This can potentially lock you out if all you have are USB keyboards'
|
|
echo "sys-usb dom0 ask,user=root,default_target=dom0" | sudo tee /etc/qubes-rpc/policy/qubes.InputKeyboard
|
|
else
|
|
logg info 'Ensuring USB keyboards can connect without a prompt'
|
|
echo "sys-usb dom0 allow,user=root" | sudo tee /etc/qubes-rpc/policy/qubes.InputKeyboard
|
|
fi
|
|
|
|
### Configure USB mouse settings
|
|
logg info 'Ensuring newly connected USB mouse devices are only allowed to connect after a prompt is accepted'
|
|
echo "sys-usb dom0 ask,default_target=dom0" | sudo tee /etc/qubes-rpc/policy/qubes.InputMouse
|
|
{{ end -}}
|