Hi, I'm currently working on packaging the 0.7.5 release of usbguard, which was released a little more than a week ago. I have looked at the various options we have to tackle the default configuration.
I agree that the prompts at installation time should be minimized, so I'm not convinced of my initial idea of asking the user for the value of ImplicitPolicyTarget et al anymore. Setting ImplicitPolicyTarget to allow by default seems wrong to me- it would mean users would have to manually configure the service to actually do what it is intended to do. I was torn between the solution to generate a policy and setting PresentDevicePolicy to `keep`. For now, I have configured the package to generate a rules file using `usbguard generate-policy` if no rules file exists - and I will also reenable the service. Thats also what upstream suggests in the bug report mentioned by Thiébaud. But I am open to change that to the PresentDevicePolicy solution if there happen to come up problems with that default configuration. Thanks Antoine also for the information about the `plugdev` group, I'll add a patch adding that group to the IPCAllowedGroups setting. cheers, Birger
