50-usb-deauthorize.rules

ACTION!="add", GOTO="deauthorize_end"
SUBSYSTEM!="usb", GOTO="deauthorize_end"
TEST!="authorized", GOTO="deauthorize_end"

## make hubs deauthorize all devices by default
TEST=="authorized_default", ATTR{authorized_default}="0", GOTO="deauthorize_end"

## whitelist specific devices
ENV{ID_VENDOR}=="Yubico", ENV{ID_MODEL}=="Yubikey_NEO*", ATTR{authorized}="1", GOTO="deauthorize_end"
ENV{ID_VENDOR}=="Zubico", ENV{ID_MODEL}=="Zubikey_GEO*", ATTR{authorized}="1", GOTO="deauthorize_end"

LABEL="deauthorize_end"

README.md

This is written as a complement for https://usbguard.github.io/blog/2015/USBGuard-vs-UDev (because I had deleted the original gist linked from that page).

The most common question about it was: "Where is the usb-unauthorized script?"

The script is probably lost in history. You don't need it anyway. The only thing it did was send a push notification to my phone (via Pushover). It has nothing to do with actual authorization of devices.

Because there is no script anymore, this 2nd revision was somewhat simplified (there is no need for the ENV{valid} indirection either).