Skip to content

udev: mark optical drives UDISKS_IGNORE (quiet + harden) #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
assisted-by-ai wants to merge 1 commit into
base: master
Choose a base branch
from
+17 −0
Open

udev: mark optical drives UDISKS_IGNORE (quiet + harden) #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions debian/security-misc-shared.install
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ usr/lib/systemd/system/usbguard.service.d/30_security-misc.conf#security-misc-sh
usr/lib/systemd/system/user@.service.d/sysfs.conf#security-misc-shared => /usr/lib/systemd/system/user@.service.d/sysfs.conf
usr/lib/systemd/user/fm-shim.service#security-misc-shared => /usr/lib/systemd/user/fm-shim.service
usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf#security-misc-shared => /usr/lib/systemd/user/usbguard-notifier.service.d/30_security-misc.conf
usr/lib/udev/rules.d/70-udisks-ignore-optical.rules#security-misc-shared => /usr/lib/udev/rules.d/70-udisks-ignore-optical.rules
usr/lib/udev/rules.d/95-emerg-shutdown.rules#security-misc-shared => /usr/lib/udev/rules.d/95-emerg-shutdown.rules
usr/libexec/security-misc/askpass#security-misc-shared => /usr/libexec/security-misc/askpass
usr/libexec/security-misc/block-unsafe-logins#security-misc-shared => /usr/libexec/security-misc/block-unsafe-logins
Expand Down
16 changes: 16 additions & 0 deletions usr/lib/udev/rules.d/70-udisks-ignore-optical.rules#security-misc-shared
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
# Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
# See the file COPYING for copying conditions.

# Do not let udisks auto-probe optical drives.
#
# udisks probing removable optical media (sr*) is noisy and unnecessary: on a drive with no or
# inert media -- e.g. a VM's emulated CD-ROM -- it errors repeatedly ("udisksd: Error probing
# device: Error sending ATA command IDENTIFY PACKET DEVICE to /dev/sr0"). More importantly,
# auto-probing inserted removable media is avoidable attack surface: media should not be
# auto-processed without user action. Mark optical drives UDISKS_IGNORE so udisks leaves them
# alone.
#
# This does NOT affect booting the live ISO from an optical drive: the live medium is mounted by
# the initramfs (rd.live.*) in early boot, not by userspace udisks, so ignoring optical drives in
# udisks has no bearing on rd.live. It also does not block a user from mounting media manually.
KERNEL=="sr[0-9]*", ENV{UDISKS_IGNORE}="1"
Loading