"Allow a keyboard-only USB device only if there isn’t already a USB device with a keyboard interface allowed" may cause harm

https://usbguard.github.io/documentation/rule-language

Allow a keyboard-only USB device only if there isn’t already a USB device with a keyboard interface allowed
allow with-interface one-of { 03:00:01 03:01:01 } if !allowed-matches(with-interface one-of { 03:00:01 03:01:01 })

My device example:

#1 id xxxx:xxxx serial "" name "Input Receiver" hash "xxxx" parent-hash "xxxx" via-port "X" with-interface { 03:01:01 03:01:02 } <---

#2 id xxxx:xxxx serial "" name "Mouse" hash "xxxx" parent-hash "xxxx" via-port "X" with-interface { 03:01:02 03:00:01 03:01:01 }
usb mouse

#3 id xxxx:xxxx serial "" name "Keyboard" hash "xxxx" parent-hash "xxxx" via-port "X with-interface 03:01:01
usb keyboard

The first one is actually a PC's power switch button. Your USBguard rule will allow 1 and will reject 2 or 3!
Either removing such example, or at least add a warning like "check 'usbguard list-devices' before applying"

---

#349

[ArrayBolt3]

@wakesend I'm not sure how much more can be done in concrete terms to keep this from potentially causing problems while still having a chance of defending against the intended threat model. The primary point of using USBGuard is to prevent malicious keyboard-like devices like the Hak5 rubber ducky from being able to compromise a machine. The device looks like a keyboard to the system, so the only way to prevent it from attacking the system is to restrict plugging keyboards into a machine. Even now the policy is lenient enough to be dangerous (all USB devices present on bootup are allowed, and you can hot-swap keyboards as long as you unplug one before plugging in the other, both of which could allow a rubber ducky or similar device to launch a successful attack if a user isn't attentive). If we start allowing multiple keyboards to be attached at the same time after bootup, there's almost no point in using USBGuard at all. Based on the info shared above, it looks like it may be impossible to tell if a "keyboard" is actually a power button, and even if we could tell that, dynamically modifying USBGuard's configuration to allow an extra keyboard in that scenario could be difficult, if USBGuard's rule language allows that at all.

Probably the best way to work with a computer that uses a USB-connected power button is to ensure the keyboard is always attached at boot. That will ensure that USBGuard allows it. Alternatively, you can turn USBGuard off as documented at https://www.kicksecure.com/wiki/USBGuard, or you might be able to change the ruleset on your system so that it will allow any two keyboards to be connected at once.