V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4400_hardening/4480_hardening_usb.sh

@@ -16,8 +16,6 @@ guard_sourcing
 # Hardening 'usb-guard'.
 # Globals:
 #   TARGET
-#   VAR_SSH_PORT
-#   VAR_UFW_OUT
 # Arguments:
 #   None
 # Returns:
@@ -29,6 +27,30 @@ hardening_usb() {
 
   chroot_logger "${TARGET}${var_logfile}"
 
+  ### Preparing USBGuard: see https://www.privacy-handbuch.de/handbuch_91a.htm
+  chroot_script "${TARGET}" "
+    export INITRD=No
+    apt-get install -y --no-install-recommends --no-install-suggests usb-guard 2>&1 | tee -a ${var_logfile}
+    echo ExitCode: \$? >> ${var_logfile}
+
+    touch /tmp/rules.conf
+    usbguard generate-policy >| /tmp/rules.conf
+
+    if [[ -f /etc/usbguard/rules.conf && -s /etc/usbguard/rules.conf ]]; then
+      mkdir -p /root/.ciss/cdi/backup/etc/usbguard
+      mv /etc/usbguard/rules.conf /root/.ciss/cdi/backup/etc/usbguard/usbguard_rules.conf
+      mv /tmp/rules.conf /etc/usbguard/rules.conf
+      chmod 0600 /etc/usbguard/rules.conf
+    else
+      rm -f /etc/usbguard/rules.conf
+      mv /tmp/rules.conf /etc/usbguard/rules.conf
+      chmod 0600 /etc/usbguard/rules.conf
+    fi
+
+    cp -a /etc/usbguard/usbguard-daemon.conf /root/.ciss/cdi/backup/etc/usbguard/usbguard-daemon.conf
+    sed -i 's/PresentDevicePolicy=apply-policy/PresentDevicePolicy=allow/' /etc/usbguard/usbguard-daemon.conf
+  "
+
   guard_dir && return 0
 }
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh