usbguard icon indicating copy to clipboard operation
usbguard copied to clipboard

AppendRule - temporary rules are written to the policy file

Open mikro64 opened this issue 1 year ago • 0 comments

If I add some temporary rules and then one permanent, all these rules will be written into the policy file.

Steps to reproduce:

usbguard append-rule -t "allow id AACC:0011"
usbguard append-rule -t "allow id AACC:0012"
usbguard append-rule -t "allow id AACC:0013"
usbguard append-rule "allow id AACC:0014"

cat /etc/usbguard/rules.conf:

...
allow id AACC:0011
allow id AACC:0012
allow id AACC:0013
allow id AACC:0014

API doc:

<!--
  appendRule:
   @rule: The rule that should be appended to the policy.
   @parent_id: Rule id of the parent rule.
   @temporary: A boolean to avoid adding this rule to the policy file.
   @id: The rule id assigned to the succesfully appended rule.

  Append a new rule to the current policy. Using the parent_id
  parameter, the rule can be inserted anywhere in the policy,
  not only at the end. 4294967293 (UINT32_MAX-2) is the last possible
  ID and thus, when using this as parent id, the rule is effectively
  appended to the list of rules. When the rule is successfully appended,
  the id assigned to the new rule is returned.
 -->
<method name="appendRule">
  <arg name="rule" direction="in" type="s"/>
  <arg name="parent_id" direction="in" type="u"/>
  <arg name="temporary" direction="in" type="b"/>
  <arg name="id" direction="out" type="u"/>
</method>

Information if rule is temporary or not is also missing in ListRules ouput.

usbguard: 1.1.2+ds-6build2 OS: Ubuntu 24.04 LTS

mikro64 avatar Sep 23 '24 12:09 mikro64