Hello
I’ve just installed Qubes OS on my old laptop and overall its a great experience 
There’s one thing that I suspect didn’t work right during installation. I think the built-in laptop keyboard (its the only keyboard I use) got misidentified as being connected via USB.
As a result in Qubes OS Global Config I have a red box:
Unexpected policy file contents:
qubes.InputMouse * sys-usb dom0 ask default_target=dom0
qubes.InputKeyboard * sys-usb dom0 allow
qubes.InputTablet * sys-usb dom0 deny
The device in question:
MSI steel series rgb keyboard
is visible as a keyboard in Qubes Devices tray menu, it is present in sys-usb.
As I understand if this really was the keyboard then everything I type would first be received in sys-usb and then sent to dom0, which is very bad for security.
I have done following checks:
- Executing “qvm-pause sys-usb” in dom0 terminal. If keyboard input was going through sys-usb it should make keyboard unusable until reset. However all it did is stop the USB mouse from functioning. The trackpad and keyboard still worked and I could execute “qvm-unpause sys-usb”.
- At boot I used the GRUB option to edit kernel command line and replaced “usbcore.authorized_default=0” with “rd.qubes.hide_all_usb”. If I understand correctly with keyboard connected via USB it would be impossible to enter LUKS password with this option but it didn’t change anything.
- Quick search on “MSI steel series rgb keyboard” shows that it may be related to keyboard backlight rather than the keyboard itself.
- In dom0 log I have this entry:
dom0 kernel: input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input3
which suggest a conventionally connected keyboard. But there are similar entries in sys-net and sys-usb logs so I don’t now how valid this is. IMO the conventional keyboard should be present only in dom0 (?)
In order to improve security I’m going to remove the policies that are shown as unexpected. But this could make my system unbootable (due to LUKS password prompt).
Is there any other test I should run to make sure the keyboard is not connected via USB ?
Also does anyone understand why “AT Translated Set 2 keyboard” appears in sys-net and sys-usb logs (and not only in dom0 log) ?
Regards