USBGUARD(1) USBGUARD(1) (NAME) usbguard - USBGuard (SYNOPSIS) usbguard [OPTIONS] [SUBCOMMAND-OPTIONS] ... usbguard get-parameter name usbguard set-parameter name value usbguard list-devices usbguard allow-device id | rule | partial-rule usbguard block-device id | rule | partial-rule usbguard reject-device id | rule | partial-rule usbguard list-rules usbguard append-rule rule usbguard remove-rule id usbguard generate-policy usbguard watch usbguard read-descriptor file usbguard add-user name usbguard remove-user name (DESCRIPTION) usbguard (CLI) usbguard-daemon(8) . USBGuard USB . (SUBCOMMANDS) get-parameter [OPTIONS] name . name InsertedDevicePolicy ImplicitPolicyTarget . : -h, --help . set-parameter [OPTIONS] name value . name InsertedDevicePolicy ImplicitPolicyTarget . : -v, --verbose . -h, --help . list-devices [OPTIONS] USB USBGuard. : -a, --allowed . -b, --blocked . -t, --tree . -h, --help . allow-device [OPTIONS] < id | rule | partial-rule > . id rule partial-rule ( ) . rule partial-rule . id device-rule ( list-devices) ID . : -p, --permanent . allow . -h, --help . . id rule partial-rule ( ) . rule partial-rule . id ( list-devices) . : -p, --permanent . . -h, --help . reject-device [OPTIONS] < id | rule | partial-rule > . id rule partial-rule ( ) . rule partial-rule . id ( list-devices) . : -p, --permanent . . -h, --help . list-rules [OPTIONS] () USBGuard. : -d, --show-devices . -l, --label label . -h, --help . append-rule [OPTIONS] rule rule . : -a, --after id id . -t, --temporary . . -h, --help . remove-rule [OPTIONS] id id . : -h, --help . generate-policy [OPTIONS] () USB . : -p, --with-ports . iSerial . -P, --no-ports-sn iSerial. via-port . . USB . -d, --devpath devpath /sys . -t, --target target <<>> (catch all) . : allow block reject -X, --no-hashes hash . -H, --hash-only (hash-only) . -L, --ldif ldif LDAP . -b, --usbguardbase base ldif LDAP base . --ldif . -o, --objectclass objectclass ldif LDAP objectClass . -n, --name-prefix prefix ldif LDAP . -h, --help . IPC stdout . : -w, --wait IPC. -o, --once . . -e, --exec path path . . -h, --help . read-descriptor [OPTIONS] file USB . : -h, --help . add-user name [OPTIONS] IPC / name IPC USBGuard . usbguard-daemon(8) . : -u, --user name UID (). -g, --group name GID . -p, --policy privileges . -d, --devices privileges . -e, --exceptions privileges . -P, --parameters privileges . -h, --help . : privileges : $ sudo usbguard add-user joe --devices=listen,modify usbguard-daemon.conf(5) . privileges ALL . remove-user name [OPTIONS] IPC / name. usbguard-daemon(8) . : -u, --user name UID (). -g, --group name GID . -h, --help . : $ sudo usbguard generate-policy > rules.conf $ vi rules.conf (review/modify the rule set) $ sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf $ sudo systemctl restart usbguard (): # Allow a device by ID(it is the very first number from the list-devices command output) $ sudo usbguard allow-device 10 # Allow all devices named "Dell Wired Multimedia Keyboard" $ sudo usbguard allow-device name \"Dell Wired Multimedia Keyboard\" (SEE ALSO) usbguard-daemon(8), usbguard-daemon.conf(5), usbguard-rules.conf(5) (BUGS) https://github.com/USBGuard/usbguard/issues/new . (AUTHORS) USBGuard Daniel Kopecek . . (RESOURCES) : https://usbguard.github.io (COPYRIGHT) GPLv2+: GPL http://gnu.org/licenses/gpl.html. : . . 09/05/2026 USBGUARD(1)