USBGUARD-DAEMON.C(5)

🎀 usbguard-daemon.conf 🎀

this is the page for USBGUARD-DAEMON.C(5), bestie — section 5 of the manual, the daemon config file 💖

---

🌸 NAME 🌸

usbguard-daemon.conf — the USBGuard daemon configuration file. yeah. that's the whole vibe. ✨

---

🦋 DESCRIPTION 🦋

okay so. the usbguard-daemon.conf file gets loaded by the USBGuard daemon after it finishes parsing its command-line options. it's literally the thing that configures the daemon's runtime parameters. no cap.

the default search path is:

/etc/usbguard/usbguard-daemon.conf

and you can override that with the -c command-line option — go read usbguard-daemon(8) for the full tea on that. 🫶

---

✨ OPTIONS ✨

• RuleFile=path — the daemon will use this file to load the policy rule set from, and also to write new rules it receives via the IPC interface. default: %sysconfdir%/usbguard/rules.conf
• RuleFolder=path — the daemon will use this folder to load the policy rule set from and to write new rules it gets via the IPC interface. usually you'd set this to /etc/usbguard/rules.d/. the USBGuard daemon is supposed to behave like every other standard Linux daemon, so it loads rule files in alpha-numeric order. file names inside the RuleFolder directory should start with a two-digit number prefix indicating the position in which the rules get scanned by the daemon. using RuleFile and RuleFolder at the same time is permitted. however, modification of the permanent policy is not possible if one of these conditions is met:
  • neither RuleFile nor RuleFolder are specified.
  • RuleFile is not specified, RuleFolder is, but it does not contain any files where we could save permanent rules.
• ImplicitPolicyTarget=target — how to treat USB devices that don't match any rule in the policy. target should be one of allow, block or reject (that last one logically removes the device node from the system). default: block
• PresentDevicePolicy=policy — how to treat USB devices that are already connected when the daemon starts. policy should be one of allow, block, reject, keep (keep whatever state the device is currently in) or apply-policy (evaluate the rule set for every present device). default: apply-policy
• PresentControllerPolicy=policy — how to treat USB controller devices that are already connected when the daemon starts. one of allow, block, reject, keep or apply-policy. default: keep
• InsertedDevicePolicy=policy — how to treat USB devices that are already connected after the daemon starts. one of block, reject, apply-policy. default: apply-policy
• AuthorizedDefault=authorizedDefault — the daemon modifies some of the default authorization state attributes of controller devices, and this setting lets you define what value the default authorization is set to. authorized default should be one of keep (do not change authorization state), none (every new device starts out deauthorized), all (every new device starts out authorized) or internal (internal devices start out authorized, external do not). default: none
• RestoreControllerDeviceState=boolean — the daemon modifies some attributes of controller devices, like the default authorization state of new child device instances. using this setting you can control whether the daemon will try to restore the attribute values to the state they were in before the modification, on shutdown. default: false
• DeviceManagerBackend=backend — which device manager backend implementation to use. backend should be one of uevent (default) or umockdev (useful for testing). the UEvent backend is a netlink based implementation which uses sysfs to scan for present devices and a uevent socket for receiving USB device related events. the UMockDev based device manager is capable of simulating devices based on umockdev-record files. default: uevent
• IPCAllowedUsers=username [username ...] — a space delimited list of usernames that the daemon will accept IPC connections from. default: root
• IPCAllowedGroups=groupname [groupname ...] — a space delimited list of groupnames that the daemon will accept IPC connections from.
• IPCAccessControlFiles=path — the files at this location will be interpreted by the daemon as IPC access control definition files. see the IPC ACCESS CONTROL section below for the details, bestie. 👀
• DeviceRulesWithPort=boolean — generate device specific rules including the "via-port" attribute. default: false
• AuditBackend=backend — USBGuard audit events log backend. the backend value should be one of FileAudit or LinuxAudit. default: FileAudit
• AuditFilePath=filepath — USBGuard audit events log file path. required if AuditBackend is set to FileAudit. default: %localstatedir%/log/usbguard/usbguard-audit.log
• HidePII=boolean — hides personally identifiable information such as device serial numbers and hashes of descriptors (which include the serial number) from audit entries. default: false

---

🔥 SECURITY CONSIDERATIONS 🔥

🚨 IPC

the daemon provides the USBGuard public IPC interface. depending on your distribution defaults, access to this interface is limited to a certain group or a specific user only. please set either the IPCAllowedUsers, IPCAllowedGroups or IPCAccessControlFiles options to limit access to the IPC interface.

do NOT leave the ACL unconfigured — that will expose the IPC interface to all local users and will let them manipulate the authorization state of USB devices and modify the USBGuard policy. 💀 absolutely not. configure your ACL, periodt.

🚨 RestoreControllerDeviceState configuration option

if set to true, the USB authorization policy could be bypassed by performing some sort of attack on the daemon (via a local exploit or via a USB device) to make it shut down and restore to the operating-system default state (which is known to be permissive).

so like… be aware. 🙈

---

👑 IPC ACCESS CONTROL 👑

access to the USBGuard IPC interface can be limited per user or per group. and furthermore, by using the IPC Access Control files, it's possible to limit the access all the way down to the level of Sections and Privileges, as explained below. slay. 💅

⭐ Recommended: IPCAccessControlFiles

when you set the IPCAccessControlFiles option, the daemon will look for IPC access control files in the directory specified by the value you set. each file in the directory is processed like this:

1. the basename of the file is interpreted as a username, UID, groupname or GID. if the name starts with : (colon), it is assumed that the rest of the name represents a group identifier (groupname, or GID in the case of a numeric-only string). otherwise, it's interpreted as a user identifier (username, or UID in the case of a numeric-only string).
2. the contents of the file are parsed as Section=[privilege1][,privilege2] ... formatted lines which specify the section privileges. if a section is omitted, it's assumed that no privileges are given for that section.

available sections and privileges:

• Devices
  • modify: change authorization state of devices including permanent changes (i.e. modification of device specific rules in the policy).
  • list: ability to get a list of recognized devices and their attributes.
  • listen: listen to device presence and device policy changes.
• Policy
  • modify: append rules to or remove any rules from the policy.
  • list: ability to view the currently enforced policy.
• Exceptions
  • listen: receive exception messages.
• Parameters
  • modify: set values of run-time parameters.
  • list: get values of run-time parameters.
  • listen: listen to property parameter changes.

the following is a generally usable and reasonably safe example of an access control file. it allows one to modify USB device authorization state (Devices=modify), list USB devices (Devices=list), listen to USB device related events (Devices=listen), list USB authorization policy rules (Policy=list) and listen to exception events (Exceptions=listen):

Devices=modify,list,listen
Policy=list
Exceptions=listen

you can create or remove the IPC access control files using the usbguard add-user and usbguard remove-user CLI commands. see usbguard(1) for more details. and if you want to create the IPC access control files manually, you need to set the files permissions to 0600. 🔐

🕰️ Legacy: IPCAllowedUsers and IPCAllowedGroups

example configuration allowing full IPC access to users root, joe and members of the group wheel:

IPCAllowedUsers=root joe
IPCAllowedGroups=wheel

---

🌈 SEE ALSO 🌈

usbguard-daemon(8), usbguard-rules.conf(5)

---

💀 BUGS 💀

if you find a bug in this software, or if you'd like to request a feature to be implemented, please file a ticket at https://github.com/USBGuard/usbguard/issues/new. they wanna hear from you fr fr 🫶

---

🧚 AUTHOR 🧚

USBGuard was originally written by Daniel Kopeček. many people have contributed to it. iconic behavior honestly. 👑

---

🌸 RESOURCES 🌸

main web site: https://usbguard.github.io/

---

💜 COPYING 💜

license GPLv2+: GNU GPL version 2 or later — http://gnu.org/licenses/gpl.html. this is free software: you are free to change and redistribute it. there is NO WARRANTY, to the extent permitted by law.

---

and that's the whole page, bestie!! ✨ this was USBGUARD-DAEMON.C(5), dated 04/15/2026 — go configure your daemon responsibly and don't leave the ACL wide open 💖🎀🦋