Not sure how should I do this in the right way.
When plugged in, do I attach it first to sys-usb? If not and I should attach it to desired VM(vault?), then doesn’t it mean it could infect it?
All your PCI USB controllers should be attached to your sys-usb so when you plug in the USB device it’ll appear in sys-usb.
After plugging in the USB device you can attach it from sys-usb to other qubes.
You can attach it to vault qube but it can infect it:
If you need to e.g. copy some files from USB disk to your vault qube then you can attach it to a new offline disposable qube, mount the USB disk there and then move the files from the mounted directory to your vault qube using qvm-copy/qvm-move CLI tools or using GUI with file manager integration:
Also note that it’s better to attach your USB disk as block device instead of a USB device:
I’ve re-read the usb-docs you mentioned again and it’s more clear now for me after your explanation, thank you.
Another related question though: when attaching potentially malicious usb device to sys-usb while having usb-keyboard attached to sys-usb as well, doesn’t it mean it could affect my keyboard? If not, can you(or maybe someone else) explain how this works, please?