v0.4.1 - Human-readable CLI output

What's new

• Human-readable output — Client commands (--status, --arm, --disarm, --learn, --enforce, --reload) now display clean, formatted output by default instead of raw JSON
• --json flag — Preserves the previous raw JSON output for scripting and automation
• Version banner — --help now shows an nmap-style header: Plugkill 0.4.1 ( https://github.com/AcidDemon/plugkill )

Example: --status output

Status:     armed (enforce mode)
Uptime:     1h 30m 5s
Devices:    5 USB, 0 Thunderbolt, 0 SD card
Watching:   USB, Thunderbolt, SD card
Violations: 0
Last poll:  150ms ago

Example: --disarm 60 output

disarmed for 60 seconds

Use --json to get the previous JSON output for scripting:

plugkill --status --json

Full Changelog: v0.4.0...v0.4.1

v0.4.0

v0.4.0 — Network & Lid Monitoring, Rust Edition 2024

New Features

Network link monitoring — detect Ethernet cable removal on physical NICs via /sys/class/net/*/operstate. Configurable
interface filter, two policies (kill / monitor), and grace period. CLI flag --no-network.

Lid close monitoring — detect laptop lid close via D-Bus logind (procfs fallback). Acquires a sleep inhibitor to act before
suspend. Two policies (kill / monitor), grace period. CLI flag --no-lid.

Configuration

• New [network] section: policy, grace_secs, interfaces
• New [lid] section: policy, grace_secs
• New [general] flags: watch_network, watch_lid (opt-in, disabled by default)
• Input validation for interface names; grace period clamping (max 300s)

Build & Language

• Rust edition updated from 2021 to 2024 (requires rustc 1.85+)
• 16 nested if blocks refactored into let-chains (edition 2024 idiom)
• gen variable renamed to generation in thunderbolt.rs (reserved keyword)

NixOS Module

• Added network and lid config sections to default settings
• Added /sys/class/net and /proc/acpi to systemd ReadOnlyPaths

Tests

• 2 new integration tests for network/lid CLI flags and config sections
• Total: 89 unit + 17 integration tests passing

Files Changed

16 files, +1118 −154 lines

Full Changelog: v0.3.1...v0.4.0

Full Changelog: v0.3.1...v0.4.0

v0.3.1

v0.3.1 — Power Supply Monitoring

New Features

Power supply monitoring (src/power.rs — 272 lines, new module)

• Detect AC power removal via /sys/class/power_supply with three policies:
  • trigger-once — first AC unplug is a violation; re-arm accepts new state
  • ac-required — any transition to battery is always a violation
  • monitor — log power changes without triggering (default)
• Configurable grace period (0–300s) before triggering
• Session lock awareness via D-Bus logind (require_locked — only trigger when user walked away)
• CLI flag --no-power to disable at runtime

Configuration

• New [power] section: policy, grace_secs, require_locked
• New [general] flag: watch_power = false (opt-in, disabled by default)
• Grace period validation with clamping (max 300s)

NixOS Module

• Added power config section to default settings
• Added /sys/class/power_supply to systemd ReadOnlyPaths
• Added zbus dependency for D-Bus logind session lock queries
• Fixed destructionWritePaths — module no longer fails to build when destruction config is empty

Files Changed

10 files, +1192 −18 lines

v0.3.0

v0.3.0 — Enriched Violation Logging

New Features

Human-readable violation messages — violation logs now include device product names alongside raw IDs (e.g. USB VIOLATION: added 1234:5678 [Logitech Keyboard])

• Detailed device enumeration at baseline capture time builds name lookup maps
• USB: vendor_id:product_id → product name
• Thunderbolt: unique_id → device name
• SD card: serial → card name

Device ID extraction — added device_id() method to DeviceChange, ThunderboltChange, and SdCardChange enums for
uniform ID access from any change variant

NixOS Module

• New options: learnMode, dryRun for the NixOS module
• Fixed destructionWritePaths — empty destruction config no longer breaks the module build

Files Changed

11 files, +170 −39 lines

v0.2.3

Full Changelog: v0.2.2...v0.2.3

v0.2.2

Fixed some CI/CD related issues. Build succeeded but some smaller formatting issues had to be corrected.
Functionality hasn't changed between v0.2.0 and v0.2.2

v0.2.1

Full Changelog: v0.2.0...v0.2.1

v0.2.0

plugkill v0.2.0

A hardware kill-switch daemon that shuts down the system when device changes are detected on USB, Thunderbolt, or SD
card buses. Successor to usbkill-rs, now with multi-bus monitoring and runtime control.

What's new in v0.2.0

• Thunderbolt/USB4 monitoring — detects new physical connections by unique ID before DMA authorization
• SD/MMC card monitoring — watches for card insertion and removal by serial number
• Unix socket control interface — disarm, arm, reload config, switch modes, and query status at runtime
• Learning mode — log violations without triggering the kill sequence (--learn-mode)
• Per-bus toggle — selectively disable monitoring with --no-usb, --no-thunderbolt, --no-sdcard (config and CLI)
• Hot config reload — reload configuration without restarting the daemon (--reload)
• Daemon state management — timed disarm with automatic re-arm and baseline recapture

Features

• USB device monitoring — polls sysfs for connected USB devices and detects additions, removals, and count changes
• Thunderbolt device monitoring — polls /sys/bus/thunderbolt/devices for new or removed devices by UUID
• SD card monitoring — polls /sys/bus/mmc/devices for card changes by serial number
• Whitelist support — configure allowed devices per bus (vendor/product ID, UUID, or serial) with per-device count
  limits
• Kill sequence — on violation, executes configurable commands, securely shreds files/directories, wipes swap, and
  powers off
• File shredding — multi-pass random overwrite via /dev/urandom with symlink and hardlink awareness
• Self-destruct — optional melt_self mode removes the binary and config after triggering
• Dry-run mode — test your configuration without destructive actions (--dry-run)
• NixOS module — declarative systemd service with filesystem and syscall hardening

CLI

Daemon

plugkill --config /etc/plugkill/config.toml # run the daemon
plugkill --dry-run # test without destruction
plugkill --learn-mode # log violations only
plugkill --no-thunderbolt --no-sdcard # USB only

Device inspection

plugkill --list-devices # show all connected devices
plugkill --list-devices --config config.toml # annotate with whitelist status
plugkill --generate-whitelist # output ready-to-paste TOML
plugkill --default-config # print default config template

Runtime control (connects to running daemon)

plugkill --disarm 60 # disarm for 60 seconds
plugkill --arm # re-arm and recapture baselines
plugkill --status # query daemon status
plugkill --learn # switch to learning mode
plugkill --enforce # switch to enforce mode
plugkill --reload # reload configuration

Security

• Config file must be root-owned and not group/world-writable
• Kill commands must use absolute paths (no shell interpolation)
• Path traversal (..) rejected in all file operations
• Signals masked during kill sequence to prevent interruption
• Control socket permissions restricted to owner/group (0660)

v0.1.0 - Initial release

usbkill-rs v0.1.0

A Rust rewrite of usbkill — a kill-switch daemon that shuts down the system when USB device
changes are detected.

Features

• USB device monitoring — polls sysfs for connected USB devices and detects additions, removals, and count changes
• Whitelist support — configure allowed devices by vendor/product ID with per-device count limits
• Kill sequence — on violation, executes configurable commands, securely shreds files/directories, wipes swap, and powers off
• File shredding — multi-pass random overwrite via /dev/urandom with symlink and hardlink awareness
• Self-destruct — optional melt_self mode removes the binary and config after triggering
• Dry-run mode — test your configuration without destructive actions (--dry-run)
• NixOS module — declarative systemd service with filesystem and syscall hardening

CLI

usbkill --config /etc/usbkill/config.toml # run the daemon
usbkill --dry-run # test without destruction
usbkill --list-devices # show connected USB devices
usbkill --list-devices --config config.toml # annotate with whitelist status
usbkill --generate-whitelist # output ready-to-paste TOML whitelist
usbkill --default-config # print default config template

Security

• Config file must be root-owned and not group/world-writable
• Kill commands must use absolute paths (no shell interpolation)
• Path traversal (..) rejected in all file operations
• Signals masked during kill sequence to prevent interruption

Full Changelog: https://github.com/AcidDemon/usbkill-rs/commits/v0.1.0