USB Device Authorization in the Linux Kernel: A Security Deep Dive

amu · May 24, 2025, 3:36am

Introduction

USB devices are ubiquitous, but they can also pose significant security risks. Malicious USB devices can act as keyboards, network interfaces, or storage devices with hidden payloads. To mitigate these risks, the Linux kernel includes a USB authorization mechanism that allows administrators to control which USB devices can interact with the system.

In this blog post, we’ll explore how USB device authorization works in the Linux kernel, its security implications, and best practices for system administrators.

Understanding USB Authorization

The Linux kernel provides a USB authorization framework to restrict unauthorized USB devices from being used. By default, most Linux distributions allow all USB devices to connect, but in high-security environments, it’s crucial to enforce strict USB device policies.

How USB Authorization Works

The authorization mechanism is exposed via sysfs at:

/sys/bus/usb/devices/-/authorized

0: The device is not authorized and cannot be used.
1: The device is authorized and can communicate with the system.

When a USB device is connected, the kernel initially assigns it a default authorization state based on system configuration. Administrators can then manually authorize or deauthorize the device.

Default Authorization Policies

The default behavior is controlled via the usbcore.authorized_default kernel parameter:

0: Deny all – No USB devices are authorized by default.
1: Allow all (default) – All devices are authorized.
-1: Deny new devices while keeping already-connected devices authorized.

This setting can be adjusted at boot by modifying the kernel command line (e.g., in GRUB):

usbcore.authorized_default=0

Security Risks of Unauthorized USB Devices

USB devices can be weaponized in several ways:

BadUSB Attacks: Malicious firmware in USB devices can emulate keyboards to execute commands or inject malware.
USB Storage Exploits: Malicious files or auto-run scripts can compromise a system.
Network Devices: USB Ethernet adapters or Wi-Fi dongles could bridge an internal network to an attacker-controlled one.
HID Spoofing: Devices posing as mice or keyboards could send malicious input sequences.

By enforcing USB authorization, organizations can prevent unauthorized devices from being recognized by the system.

Implementing USB Authorization

Step 1: Check Current USB Devices

List connected USB devices:

lsusb

Or inspect sysfs:

ls /sys/bus/usb/devices/

Step 2: Manually Authorize/Deauthorize a Device

Find the device’s authorized file and toggle its state:

echo 0 > /sys/bus/usb/devices/-/authorized # Block echo 1 > /sys/bus/usb/devices/-/authorized # Allow

Step 3: Automate Authorization with Udev Rules

To automatically authorize only specific devices, use udev rules. For example, to allow only a specific USB keyboard:

/etc/udev/rules.d/99-usb-auth.rules ACTION==“add”, SUBSYSTEM==“usb”, ATTR{idVendor}==“1234”, ATTR{idProduct}==“5678”, ATTR{authorized}=“1”

Reload udev rules:

sudo udevadm control --reload-rules

Step 4: Restrict Default Authorization

To deny all USB devices by default, modify the kernel boot parameters:

GRUB_CMDLINE_LINUX=“usbcore.authorized_default=0”

Then update GRUB:

sudo update-grub

Limitations and Considerations

Hotplugging Risks: If a device is authorized once, it may remain active even if deauthorized later.
USB-C and Thunderbolt: Some modern interfaces may bypass traditional USB authorization.
Driver Binding: Some drivers may claim a device before authorization checks.

Best Practices for USB Security

Use usbguard: For finer-grained policies, consider usbguard, which provides dynamic USB device filtering.
Physical Security: Disable USB ports in BIOS or physically restrict access in high-security environments.
Logging & Monitoring: Log USB device connections (journalctl or auditd).
Combine with MAC Systems: Use SELinux or AppArmor to restrict USB device access further.

Conclusion

USB device authorization in the Linux kernel is a powerful security feature that helps prevent unauthorized and potentially malicious devices from interacting with the system. By configuring usbcore.authorized_default, using udev rules, and monitoring USB activity, administrators can significantly reduce the attack surface posed by rogue USB devices.

For high-security environments, combining kernel-level USB authorization with tools like usbguard and mandatory access controls provides a robust defense against USB-based threats.