USBGUARD-DAEMON(8)

✨ USBGUARD-DAEMON(8) — the manual page, but make it cute ✨

okay so bestie, you opened the manual page for usbguard-daemon (that's the man page, section 8, the big-girl system administration section 💅) and honestly? you're in the right place. let's get into it.

---

🌸 NAME 🌸

usbguard-daemon — the USBGuard daemon. she's the main character and she knows it 👑

---

🦋 SYNOPSIS 🦋

usbguard-daemon [OPTIONS]

literally that's it. options only. no positional args, no drama.

---

💖 DESCRIPTION 💖

so usbguard-daemon is THE main component of the USBGuard software framework, no cap. she runs as a service in the background and enforces the USB device authorization policy for all USB devices. every single one. she's watching 👀

the policy itself is defined by a set of rules, and those rules use a rule language that's described over in usbguard-rules.conf(5) — go read that one, it's giving very much required reading.

and here's the fun part: the policy AND the authorization state of USB devices can both be modified during runtime using the usbguard(1) tool. so you're not locked in, you can change your mind mid-vibe. we love flexibility 🫶

---

✨ OPTIONS ✨

every single one, babes. no skipping. this is the whole menu 🎀

• -d — turns on debugging messages in the log. she's telling you everything. oversharing era 💀
• -f — enables classical daemon behavior (fork at start, sysV compliant). old-school, but make it iconic.
• -s — log to syslog.
• -k — log to console. this one's the default, so if you didn't pick anything, congrats, you picked this 🎉
• -K — disables logging to console. the opposite of -k. yes, capital-K vs lowercase-k. don't mix them up bestie, they are two different girls 😭
• -l path — log to a file at path.
• -p path — write PID to a file at path. default is /var/run/usbguard.pid.
• -c path — load configuration from a file at path. default is /etc/usbguard/usbguard-daemon.conf.
• -P — disable permissions check on conf and policy files. (default is /etc/usbguard/usbguard-daemon.conf) ⚠️
• -C — drop capabilities to limit privileges of the process. security girlie behavior, we stan 🔒
• -W — use a seccomp allowlist to limit available syscalls to the process. very locked-down, very demure.
• -h — show the help/usage screen. the "wait what were the flags again" button 🙈

---

👑 SECURITY CONSIDERATIONS 👑

okay this is the serious section and I need you to actually pay attention, bestie. no scrolling past.

the daemon provides the USBGuard public IPC interface. depending on your distribution defaults, access to this interface is limited to a certain group or a specific user only. so like, check your defaults, they might not be what you think.

please refer to the usbguard-daemon.conf(5) man page for more info on how to configure the ACL correctly. and I mean correctly correctly.

🚨 DO NOT leave the ACL unconfigured. that will expose the IPC interface to all local users. and then those local users can manipulate the authorization state of USB devices AND modify the USBGuard policy. that's not a vibe. that's a whole security incident. don't do it. periodt. 💀

---

🔥 SEE ALSO 🔥

the extended universe, if you will:

• usbguard-daemon.conf(5)
• usbguard-rules.conf(5)
• usbguard(1)

---

🐛 BUGS 🐛

if you find a bug in this software, or if you'd like to request a feature to be implemented, please file a ticket at:

https://github.com/USBGuard/usbguard/issues/new

they want to hear from you fr fr. go tell them. 🫶

---

💜 AUTHOR 💜

USBGuard was originally written by Daniel Kopeček. Many people have contributed to it. group project that actually got finished, respect ✨

---

🌈 RESOURCES 🌈

Main web site: https://usbguard.github.io/

go click it. it's giving documentation hub.

---

📜 COPYING 📜

License GPLv2+: GNU GPL version 2 or later http://gnu.org/licenses/gpl.html.

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.

read that last line again. no warranty. none. zero. okay love you bye 🎀

---

and that's the whole page bestie, thanks for reading all the way down here, you're a real one 💖 this was usbguard-daemon(8) from the 04/15/2026 dated version of the man page — see you in the group chat 🦋✨