Unplugging external drive should trigger a shutdown

Patrick · August 6, 2025, 7:23am

init38 · August 8, 2025, 10:10pm

Will it work in LIVE ISO and LIVE Mode in general?

arraybolt3 · August 8, 2025, 10:33pm

Almost certainly yes. If it doesn’t, that would be a bug.

Quiksilver · August 16, 2025, 6:03pm

Very nice work arraybolt3

Patrick · August 23, 2025, 10:08am

github.com/QubesOS/qubes-issues

Consider the impact of USBGuard in sys-usb

opened 06:22PM - 22 Aug 25 UTC

closed 12:42AM - 23 Aug 25 UTC

ArrayBolt3

R: not applicable P: default

[How to file a helpful issue](https://www.qubes-os.org/doc/issue-tracking/) I a…pologize in advance if this isn't really the right spot for this, I couldn't find a "development" category on the forums so this is the closest I could figure out. ### The problem you're addressing (if any) In Kicksecure 18 and higher, we're going to be shipping USBGuard, enabled by default, with a configuration that allows all devices that are present in the system on bootup, and blocks all non-whitelisted devices that are plugged in after bootup. By default, the whitelist in Kicksecure will allow USB mass storage devices, and will allow a single mouse and keyboard at a time (additional keyboards are rejected). All other devices are rejected, including devices that combine a USB mass storage interface with anything else, and devices that combine a keyboard or mouse interface with anything (except for "unified" keyboard/mouse devices like are common with some wireless receivers). The goal is to allow a limited subset of common USB devices to work out of the box, while also thwarting devices like the USB "rubber ducky". This feature set makes good sense for Kicksecure on the desktop, but we're unsure if it makes sense in Qubes OS, if a user chooses to use Kicksecure on sys-usb. On the one hand, USBGuard in sys-usb could substantially increase the security of users who have to pass through USB keyboards and mice to dom0 (only one keyboard and mouse would be allowed, a keystroke injection device would be rejected so long as it was not present when sys-usb booted and a legitimate USB keyboard was already plugged in). On the other hand, USBGuard could frustrate users who need to work with things such as USB headsets, webcams, touchscreens, and other "advanced" devices. In theory a user could reboot sys-usb to get these devices to work (assuming our configuration actually does trust everything present on bootup), but maybe that's too much hassle? The USBGuard configuration we intend to ship in Kicksecure 18 can be seen [here](https://github.com/Kicksecure/security-misc/blob/master/etc/usbguard/rules.d/30_security-misc.conf). ### The solution you'd like Determine if USBGuard in a Kicksecure-based sys-usb makes sense, and if any configuration changes are needed in the event it is useful in Qubes OS. ### The value to a user and who that user might be If we choose to leave it enabled, users will be able to pass through input devices to dom0 with less risk of malicious devices being able to take over the system. If we choose to disable it, users won't end up facing new issues with USB device passthrough. ### Completion criteria checklist (This section is for developer use only. Please do not modify it.)

Quiksilver · August 27, 2025, 6:16pm

Should it be added to disro morphs now when you go to upgrade?

Patrick · August 27, 2025, 6:35pm

The status is still the same:

Distribution morphing won’t be special in this regard. Will be the same the “regular” version.

NTH9R6 · September 9, 2025, 8:28pm

@arraybolt3 Does the same thing you said in USBGuard post apply to emergency shutdown feature added? No new rules added to /etc/udev/rules.d/ after upgrade.

Patrick · September 10, 2025, 2:27pm

We’ll notify once this feature becomes available.

NTH9R6 · November 6, 2025, 5:12pm

@Patrick @arraybolt3 I just want to say thank so much for this distro and the work you and any other devs do on this project.

Tx ID:

3691866a833547ccbe7fb165c0e81384e7eda20daeec9e87917eb53f9dcbf38d

Also @maltfield thanks for the Buskill project. It’s things like your project that also inspire ideas and innovation

Tx ID:

d85179a8c628d0308447f674bae0dccb877643e9a584685732023f35472e0af2

*Both are private donations to each to show some respect

arraybolt3 · December 17, 2025, 3:00am

Kicksecure 18 has been released and declared stable. emerg-shutdown is provided and is enabled by default. Documentation:

In short, to trigger an emergency shutdown:

Unplug the boot drive from the system (if using a USB boot drive), or
Press a “panic shortcut” on the keyboard. By default, the panic shortcut is Ctrl + Alt + End.

Tengu · December 20, 2025, 2:20am

Would rd.live.ram=1 work with emerg-shutdown?

arraybolt3 · December 21, 2025, 12:51am

Assuming it works at all, it will almost certainly work with the panic keyboard shortcut. Unsure if it will work with drive unplug, feel free to try it.

Patrick · December 22, 2025, 10:33am

Primary forum thread on that topic: