Related to
Whats safest way to attach a USB HDD to a Kicksecure KVM guest while protecting Debian host ensuring the host kernel cannot access the drive’s file system before redirected to guest
Also adde pci host device and adde usb host device is not possible under kvm user session.
The KVM guest requirement is a bit problematic here. Qubes OS is designed to deal with this using its sys-usb system, which is particularly effective if you have a non-USB keyboard and mouse (or have a separate USB controller for the keyboard and mouse vs. everything else).
If you need to use KVM, you can use the Kicksecure ISO to install Kicksecure into a root KVM virtual machine, then use VFIO passthrough to give a spare USB controller to the guest. Then you can attach the disk to that USB controller and it shouldn’t (to my awareness) be able to do anything to the host. Obviously, that controller will be inaccessible to the host, so if you only have one USB controller, and your mouse and keyboard attach via USB, you will probably (hopefully temporarily) lock yourself out of the host doing this, so proceed with caution.
That makes sense. I hadn’t considered using a separate USB controller with VFIO passthrough.
There are enough USB controllers on the device.
I’ll consider Qubes later after HW upgrade, as KVM provides better performance on my current HW.
Thanks for explanation!