From b83dbfa2065acf76411c7072b7159481484a1812 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Sat, 31 Jan 2026 06:03:22 +0200
Subject: [PATCH] turn off usbguard

---
 modules/security.nix    | 15 +++++----------
 modules/usb-devices.nix | 14 ++++++++++++++
 2 files changed, 19 insertions(+), 10 deletions(-)
 create mode 100644 modules/usb-devices.nix

diff --git a/modules/security.nix b/modules/security.nix
index 2953030..c3fa3ea 100644
--- a/modules/security.nix
+++ b/modules/security.nix
@@ -1,12 +1,12 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports = [
-    ./usb-devices.nix
-  ];
+  # imports = [
+  #   ./usb-devices.nix
+  # ];
 
   # Use the hardened kernel for better security
-  boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
+  # boot.kernelPackages = lib.mkForce pkgs.linuxPackages_hardened;
 
   # Only allow members of the wheel group to execute sudo
   security.sudo.execWheelOnly = true;
@@ -44,7 +44,7 @@
 
   # USBGuard configuration
   services.usbguard = {
-    enable = true;
+    enable = false;
     dbus.enable = true;
     implicitPolicyTarget = "block";
   };
@@ -56,11 +56,6 @@
     { domain = "*"; item = "core"; type = "-"; value = "0"; }
   ];
 
-  systemd.services.systemd-udevd.serviceConfig = {
-    PrivateNetwork = true;
-    RestrictAddressFamilies = "AF_UNIX AF_NETLINK";
-  };
-
   # Podman socket for all users
   systemd.user.sockets.podman.wantedBy = [ "sockets.target" ];
 
diff --git a/modules/usb-devices.nix b/modules/usb-devices.nix
new file mode 100644
index 0000000..cb3d679
--- /dev/null
+++ b/modules/usb-devices.nix
@@ -0,0 +1,14 @@
+{ ... }:
+
+{
+  services.usbguard.rules = ''
+allow id 1d6b:0002 serial "0000:07:00.3" name "xHCI Host Controller" hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0003 serial "0000:07:00.3" name "xHCI Host Controller" hash "O6iOpcl9StImWT62SrbeXacqbG6N/mTIipTRc0ipCGM=" parent-hash "0ucliRMjldIprxe48uLucRla+MwXWjm3BjOe1IwriL0=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0002 serial "0000:07:00.4" name "xHCI Host Controller" hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0003 serial "0000:07:00.4" name "xHCI Host Controller" hash "rJ3LKdvkCK3SUrCU3lV8qVbmPjA+r9Fe5106x2HlgK4=" parent-hash "yDUn2DiXqqtcIEdDBTvWPAS3N3pEqZ4rLl1feEAXV9U=" with-interface 09:00:00 with-connect-type ""
+allow id 1d6b:0002 serial "0000:02:00.4" name "EHCI Host Controller" hash "g4C+/9Czivl3COs7n5IrgCn8aGKQyA1nbVaXFO674/I=" parent-hash "R/6eYWpJE+6YUXeuG6yQIR13+fLXJHFSlqUyBUoo8So=" with-interface 09:00:00 with-connect-type ""
+allow id 2357:0604 serial "EC750C9EF6C2" name "TP-Link Bluetooth USB Adapter" hash "8yVJfhZNa1ezefblgi5rzbI/GwSPhCMRRHgbUgMtJ1I=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" with-interface { e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 e0:01:01 } with-connect-type "hotplug"
+allow id 058f:9540 serial "" name "EMV Smartcard Reader" hash "j6z/wqFtA1bZWwBIPmIr/g8KfsEQJ63vpgf4cBcNLbU=" parent-hash "pz29Oo0RhQ+5+7LgOZR4v3OlcsVv3m9kCgGsGUnoUjI=" via-port "1-3" with-interface 0b:00:00 with-connect-type "not used"
+allow id 0bda:5411 serial "" name "USB2.1 Hub" hash "0XPemECgDeA5RnHA9bnLxiyh3MJ+tZkFeo0gHHXNZc8=" parent-hash "Hp8B0Enf+ACRT2tyy0EqXj7eNsFDAnTRZadzuh/Iqd4=" via-port "3-1" with-interface { 09:00:01 09:00:02 } with-connect-type "hotplug"
+  '';
+}