Add --nousb option

7 files changed, 35 insertions, 1 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 55f8e6081..565983341 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -383,6 +383,7 @@ extern int arg_noprofile;	// use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
 extern int arg_notv;    // --notv
 extern int arg_nodvd;   // --nodvd
+extern int arg_nousb;   // --nousb
 extern int arg_nodbus; // -nodbus
 
 extern int login_shell;
@@ -557,6 +558,7 @@ void fs_dev_disable_3d(void);
 void fs_dev_disable_video(void);
 void fs_dev_disable_tv(void);
 void fs_dev_disable_dvd(void);
+void fs_dev_disable_usb(void);
 
 // fs_home.c
 // private mode (--private)
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index b2eeac9c8..f58ebe399 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -102,7 +102,7 @@ static void deventry_mount(void) {
                             (dev[i].type == DEV_VIDEO && arg_novideo == 0) ||
                             (dev[i].type == DEV_TV && arg_notv == 0) ||
                             (dev[i].type == DEV_DVD && arg_nodvd == 0) ||
-                            (dev[i].type == DEV_USB)) {
+                            (dev[i].type == DEV_USB && arg_nousb == 0)) {
 
                                 int dir = is_dir(dev[i].run_fname);
                                 if (arg_debug)
@@ -370,3 +370,12 @@ void fs_dev_disable_dvd(void) {
                 i++;
         }
 }
+
+void fs_dev_disable_usb(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_USB)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 072c4b0ee..51f875e91 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -123,6 +123,7 @@ int arg_memory_deny_write_execute = 0;		// block writable and executable memory
 int arg_notv = 0;       // --notv
 int arg_nodvd = 0; // --nodvd
 int arg_nodbus = 0; // -nodbus
+int arg_nousb = 0; // --nousb
 int login_shell = 0;
 
 
@@ -1722,6 +1723,8 @@ int main(int argc, char **argv) {
                         arg_notv = 1;
                 else if (strcmp(argv[i], "--nodvd") == 0)
                         arg_nodvd = 1;
+                else if (strcmp(argv[i], "--nousb") == 0)
+                        arg_nousb = 1;
                 else if (strcmp(argv[i], "--nodbus") == 0)
                         arg_nodbus = 1;
 
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 7b59cd48c..8c393cab5 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -257,6 +257,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_nodbus = 1;
                 return 0;
         }
+        else if (strcmp(ptr, "nousb") == 0) {
+                arg_nousb = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "netfilter") == 0) {
 #ifdef HAVE_NETWORK
                 if (checkcfg(CFG_NETWORK))
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5c129fead..c22d65122 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -908,6 +908,9 @@ int sandbox(void* sandbox_arg) {
         if (arg_nodvd)
                 fs_dev_disable_dvd();
 
+        if (arg_nousb)
+                fs_dev_disable_usb();
+
         if (arg_novideo)
                 fs_dev_disable_video();
 
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 7bfa3a019..76a13c7cc 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -468,6 +468,9 @@ pulse servers or non-standard socket paths.
 \fBnotv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .TP
+\fBnousb
+Disable USB devices.
+.TP
 \fBnovideo
 Disable video devices.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index aad678aa4..2ea39aed4 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1174,6 +1174,16 @@ Example:
 $ firejail \-\-notv vlc
 
 .TP
+\fB\-\-nousb
+Disable USB devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-nousb
+
+.TP
 \fB\-\-novideo
 Disable video devices.
 .br