I’m using an USB keyboard. I created sys-usb after install using the salt script and gave the keyboard permission to enter the LUKS passphrase during boot. This has been fine for months.
During the latest Dom0 update (4.1-rc3) a lot of errors rolled over the screen, too fast to read. The update ended normally, but I no longer had access to the system, probably because of a sys-usb problem.
So I rebooted by switching the machine off and on again, all seems to work again, except now I got this new warning during boot:
dracut: warning USB in Dom0 is not restricted
This sounds ominous, what to do?
(FWIW journalctl reports a lot of qrexec-client errors, for example: “qubes.InputKeyboard: sys-usb > dom0: error while executing: qrexec-client failed”)