USB Kill Switch for Qubes OS - Physical Security Enhancement revisions

Go back to topic: USB Kill Switch for Qubes OS - Physical Security Enhancement

  1. v7 anchor; v7 full version
  2. v6 anchor; v6 full version
  3. v5 anchor; v5 full version
  4. v4 anchor; v4 full version
  5. no need to repeat the title v3 anchor; v3 full version
  6. v2 anchor; v2 full version

Revision #7

Edited on
2025-08-16
Edited by user
juicewrld
It’s similar to **BusKill**, but purpose-built for Qubes OS. It’s similar to **BusKill**, but purpose-built for Qubes OS. **ONLY TESTED FOR XFCE ENVIRONMENT WITH THE XFCE SCREENSAVER**

Revision #6

Edited on
2025-08-15
Edited by user
juicewrld
ListUSBDevices() { ListDevices() {
Types=()
Types+=("block")
done < <(qvm-block list 2>/dev/null | tail -n +2) done < <(qvm-block list 2>/dev/null | tail -n +2) echo echo "===== Available Raw USB Devices =====" while IFS= read -r Line; do BackendDevice=$(echo "$Line" | awk '{print $1}') Description=$(echo "$Line" | cut -d' ' -f3-) Devices+=("$BackendDevice") Types+=("usb") echo "$Index) $BackendDevice - $Description" ((Index++)) done < <(qvm-usb list 2>/dev/null | tail -n +2)
ListUSBDevices ListDevices
MonitorType="${Types[$((Choice-1))]}"
echo "Selected: $MonitorDevice from $MonitorVM" echo "Selected: $MonitorDevice from $MonitorVM (type: $MonitorType)"
echo "MonitorVM=$MonitorVM" > "$ConfigDir/USBDevice.conf" echo "MonitorType=$MonitorType" > "$ConfigDir/USBDevice.conf" echo "MonitorVM=$MonitorVM" >> "$ConfigDir/USBDevice.conf"
qvm-block list "$MonitorVM" 2>/dev/null | grep -q "$MonitorDevice" if [[ "$MonitorType" == "block" ]]; then qvm-block list "$MonitorVM" 2>/dev/null | grep -q "$MonitorDevice" else qvm-usb list "$MonitorVM" 2>/dev/null | grep -q "$MonitorDevice" fi
LogMessage "USB Kill Switch started - Monitoring $MonitorDevice on $MonitorVM" LogMessage "USB Kill Switch started - Monitoring $MonitorType device $MonitorDevice on $MonitorVM"

Revision #5

Edited on
2025-08-15
Edited by user
juicewrld
systemctl --user restart monitor-drive-usbkill.service systemctl --user enable monitor-drive-usbkill.service systemctl --user start monitor-drive-usbkill.service

Revision #4

Edited on
2025-08-15
Edited by user
juicewrld
## Introduction

Revision #3

Edited on
2025-08-15
Edited by user
parulin
Edit reason
no need to repeat the title
# \[GUIDE] USB Kill Switch for Qubes OS - Physical Security Enhancement

Revision #2

Edited on
2025-08-15
Edited by user
parulin