How to Make USB Storage Read-Only with a udev Rule (and Block USB with USBGuard)

Updated: 28 September 2026 · Applies to: systemd-udev on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10, Ubuntu 24.04 and 26.04, Debian 13; USBGuard 1.1

On machines where data must not leave on a USB stick, you can make every USB storage device read-only as soon as it is plugged in: people can still read files from it, but cannot copy anything onto it. A small udev rule does this. To block USB devices completely, use USBGuard, described at the end. We validated the rule with udevadm verify on Ubuntu 24.04.

Make USB storage read-only

1. Create /etc/udev/rules.d/80-usb-readonly.rules with this single line:

   ACTION=="add", SUBSYSTEM=="block", SUBSYSTEMS=="usb", RUN+="/usr/sbin/blockdev --setro /dev/%k"

   It matches every disk and partition that sits on a USB bus and marks it read-only in the kernel before anything mounts it. %k is the device name, for example sdb1.
2. Check the file (systemd 253 and later, for example Ubuntu 24.04 and AlmaLinux 10):

   udevadm verify /etc/udev/rules.d/80-usb-readonly.rules

3. Load the rule:

   udevadm control --reload

4. Plug in a USB stick and test:

   lsblk -o NAME,RO,TRAN,MOUNTPOINTS

   The RO column shows 1 for the USB disk and its partitions. Writing to it fails with "Read-only file system".

Devices that were already plugged in keep their state until they are reconnected.

Limits of this method

• Root can undo it with blockdev --setrw. It stops ordinary users and accidents, not an administrator.
• It covers USB storage only; phones connected with MTP and network shares are not affected.

Block USB devices completely: USBGuard

USBGuard allows only the USB devices you approve and blocks everything else, including storage:

dnf install usbguard          # AlmaLinux, Rocky Linux, RHEL
apt install usbguard          # Ubuntu, Debian
usbguard generate-policy > /etc/usbguard/rules.conf
chmod 600 /etc/usbguard/rules.conf
systemctl enable --now usbguard

The generated policy allows the devices connected right now (keyboard, mouse) and blocks new ones. List devices with usbguard list-devices and allow one with usbguard allow-device ID (add -p to make it permanent). Generate the policy while your keyboard is connected, or you may lock yourself out of a machine that has no other input.

Official documentation: udev manual page and USBGuard.