Sys-usb dom0 / mouse

I have 2 problems that all started with trying to connect Bluetooth and wireless mice.

First being that sys-usb is connecting to dom0. In global settings I have it set to ask before connecting a mouse. When prompted upon login I can only select dom0. How do I get an option other than dom0?

Second problem is that once sys-usb is connected, it connects 5 usb devices, one being the mouse and the other 4 that should certainly not be given any permissions (webcam etc…). How might I limit the usb connections to just the mouse? Im guessing this means they’re all using the same PCI. Is there anything I can do about this?

At the end of the day I just want my mouse working, not a ton of usb devices connected to dom0. I also have a Bluetooth mouse (not wireless+dongle) and running that in sys-usb requires all the other usb devices to be enabled, so it seems like even the Bluetooth is connected to the same USB controller.

Please bear with me, fairly new to Linux but solving most problems up until this one. Any help is appreciated.

Thanks.

Edit: Using a laptop and booting from a live usb so things like usbcore.authorized_default=0 and rd.qubes.hide_pci would cause problems no? I know that having either in boot parameters prevents booting.

What other option do you expect there?
If you want to use USB mouse input in dom0 then you need to pass in to dom0.
Or do you want to use you USB mouse in just one specific qube that don’t have Qubes OS GUI integration (e.g. full desktop instead of seamless app windows)?

qubes.InputMouse is not attaching the USB mouse to dom0 as USB device, it’s only passing the input from the USB mouse in sys-usb to the virtual input device created in dom0.
So it’s not passing any actual USB device to dom0.
Also read this:

Yes, it’ll cause problems.
Read this topic:

Thanks for the reply. Maybe I was misunderstanding some things then. When prompted for connecting the mouse, and it displays Dom0 as the option, that doesn’t that mean all the USB devices are being connected directly to Dom0? They are being routed through Sys-Usb first, which is considered safe? I was thinking when I saw Dom0 that was going to expose Dom0 to my usb devices.

Please let me know if that’s correct, and if this looks like the proper way. Here is how my usb connections are showing in the gui.

Ideally I would like to be able to remove some of these entirely, removing the possibility for connecting my webcam and fingerprint scanner etc… I’ve tried editing the boot parameters to hide the specific device, a deny rule in policies, and even blocking the device drivers, all to no avail, everything I do is disabling the entire USB controller rather than individual devices.

Appreciate the help

Yes, that’s correct.

You can install and configure usbguard in sys-usb for this: