documentation_complete: true


title: 'Authorize Human Interface Devices in USBGuard daemon'

description: |-
    To allow authorization of Human Interface Devices (keyboard, mouse)
    by USBGuard daemon,
    add the line
    <tt>allow with-interface match-all { 03:*:* }</tt>
    to <tt>/etc/usbguard/rules.conf</tt>.

rationale: |-
    Without allowing Human Interface Devices, it might not be possible
    to interact with the system.

warnings:
    - general: |-
        This rule should be understood primarily as a convenience administration feature. This rule ensures that if the USBGuard default rules.conf file is present, it will alter it so that USB human interface devices are allowed. However, if the rules.conf file is altered by system administrator, the rule does not check if USB human interface devices are allowed. This assumes that an administrator modified the file with some purpose in mind.

severity: medium

identifiers:
    cce@rhel8: CCE-82274-2
    cce@rhel9: CCE-85990-0
    cce@rhel10: CCE-88872-7

references:
    srg: SRG-OS-000114-GPOS-00059

ocil_clause: 'USB devices of class 3 are not authorized'

ocil: |-
    To verify that USB Human Interface Devices will be authorized by the USBGuard daemon,
    run the following command:
    <pre>$ sudo grep allow /etc/usbguard/rules.conf</pre>
    The output lines should include
    <pre>allow with-interface match-all { 03:*:* }</pre>

fixtext: |-
    Configure the USBGuard daemon to allow USB Human Interface Devices.

    Add or edit the following line in "/etc/usbguard/rules.conf":

    allow with-interface match-all { 03:*:* }
