documentation_complete: true


title: 'Generate USBGuard Policy'

description: |-
    By default USBGuard when enabled prevents access to all USB devices and this lead
    to inaccessible system if they use USB mouse/keyboard. To prevent this scenario,
    the initial policy configuration must be generated based on current connected USB
    devices.

rationale: |-
    The <tt>usbguard</tt> must be configured to allow connected USB devices to work
    properly, avoiding the system to become inaccessible.

severity: medium

identifiers:
    cce@rhel8: CCE-83774-0
    cce@rhel9: CCE-88882-6
    cce@rhel10: CCE-88632-5

references:
    nist: CM-8(3)(a),IA-3
    srg: SRG-OS-000378-GPOS-00163
    stigid@ol8: OL08-00-040140

ocil_clause: 'there is no evidence that unauthorized peripherals are being blocked before establishing a connection'

ocil: |-
    Verify the USBGuard has a policy configured with the following command:

    $ usbguard list-rules

    allow id 1d6b:0001 serial

    If the command does not return results or an error is returned, ask the SA to indicate how unauthorized peripherals are being blocked.

fixtext: |-
    Configure the operating system to enable the blocking of unauthorized peripherals with the following command:

    Note: This command must be run from a root shell and will create an allow list for any usb devices currently connect to the system.

    # usbguard generate-policy --no-hash > /etc/usbguard/rules.conf

    Note: Enabling and starting usbguard without properly configuring it for an individual system will immediately prevent any access over a usb device such as a keyboard or mouse.

srg_requirement: '{{{ full_name }}} must block unauthorized peripherals before establishing a connection.'
