Hello,

Curently, the postinstall script of the package is generating a default
policy that allows all USB devices conntected at the time of the
installation.

The problem is that there is no guarantee that the user has all the
needed USB devices connected and even that the package will be installed
on the final machine that will be used (VM cloned or chroot)

Looking at the other distributions (ie. Fedora) they are not doing that.

Not sure what should be done here, as no policy might also cause more
issues. Maybe playing with the AuthorizedDefault= option and set it to
internal or wired?

Kind regards,
Laurent Bigonville

retitle 978405 use debconf to ask to create initial policy
thanks

Hi Laurent,

thank you for your report - I agree, usbguard should by default not
create an initial policy.

However, in order to make it nice for users, I'll add a debconf question
asking to create one (and defaulting to 'no'). I think that's the best
compromise we can do here.

Regards,
Daniel

retitle 978405 use debconf to ask to create initial policy
thanks

Hi Laurent,

thank you for your report - I agree, usbguard should by default not
create an initial policy.

However, in order to make it nice for users, I'll add a debconf question
asking to create one (and defaulting to 'no'). I think that's the best
compromise we can do here.

Regards,
Daniel

We believe that the bug you reported is fixed in the latest version of
usbguard, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 978405@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Daniel Baumann <daniel@debian.org> (supplier of updated usbguard package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 02:20:52 +0200
Source: usbguard
Architecture: source
Version: 1.1.4+ds-8
Distribution: sid
Urgency: medium
Maintainer: Daniel Baumann <daniel@debian.org>
Changed-By: Daniel Baumann <daniel@debian.org>
Closes: 978405
Changes:
 usbguard (1.1.4+ds-8) sid; urgency=medium
 .
   * Correcting wrong and unneeded message output when cleaning up empty
     directories in postrm.
   * Adding debconf question defaulting to no whether a initial policy
     should be generated (Closes: #978405).
   * Adding patch to systemd unit to start usbguard only if rules.conf is
     present and usbguard hasn't been disabled via kernel cmdline.
   * Rewriting README.Debian file.
   * Adding NEWS file.
   * Adding myself to debian copyright.
Checksums-Sha1:
 750384149f11d1bef1c1dcdd35576ef6f80b4dfd 1741 usbguard_1.1.4+ds-8.dsc
 dd5acf8592c731ada9e4a33f319a54e32413dfad 11372 usbguard_1.1.4+ds-8.debian.tar.xz
 e7321d28d7ed1216e4d1433b3be04b33a16b63d0 9040 usbguard_1.1.4+ds-8_amd64.buildinfo
Checksums-Sha256:
 7d98250145782e20c93f4c89d157cb168e8d2218032571554d594255eb10399c 1741 usbguard_1.1.4+ds-8.dsc
 fbd035f90251e451ef76036ddaac4b79ad13567eab8683cc4b0b894a608aef52 11372 usbguard_1.1.4+ds-8.debian.tar.xz
 3dec15dbc1ce9891ecae70d2ff9a589f05d520acffc17d1609b651bd2f2eb9df 9040 usbguard_1.1.4+ds-8_amd64.buildinfo
Files:
 aa8e663e8da19f1bdd474c609d2b0bc3 1741 utils optional usbguard_1.1.4+ds-8.dsc
 435344ca6e32eefdf577c20fa2824301 11372 utils optional usbguard_1.1.4+ds-8.debian.tar.xz
 7aa27be1b40eefc9d9ccf59a1b082850 9040 utils optional usbguard_1.1.4+ds-8_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQmmGg4gLaoSj0ERgL7tPDoCoAiLwUCarhiOAAKCRD7tPDoCoAi
LzfZAP0e8Bh7FGGqqFzN+ZZdW6nUHOlr9B+p5IIhX3DecpJd7wEArMuKq306Ls+J
yl50W/zKTbHl9raWwkYJX1lERHUgrw4=
=BesI
-----END PGP SIGNATURE-----