From a1667bf4ba9d22b9becfc02add7cdfc557e33ee8 Mon Sep 17 00:00:00 2001
From: Johannes Leupolz <dev@leupolz.eu>
Date: Thu, 15 Jan 2026 22:39:57 +0000
Subject: [PATCH] Improve device policies: Block more keys in sanitized mode
 and introduce MuteSysRq mode that only mutes sysrq

---
 vuinputd/src/cuse_device/device_policy.rs | 30 +++++++++++++++++------
 vuinputd/src/global_config.rs             |  4 ++-
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/vuinputd/src/cuse_device/device_policy.rs b/vuinputd/src/cuse_device/device_policy.rs
index 9a622c2..15b540f 100644
--- a/vuinputd/src/cuse_device/device_policy.rs
+++ b/vuinputd/src/cuse_device/device_policy.rs
@@ -35,6 +35,12 @@ const KEY_KPDOT: u16 = 83;
 const KEY_POWER: u16 = 116;
 const KEY_SLEEP: u16 = 142;
 const KEY_WAKEUP: u16 = 143;
+const KEY_BREAK: u16 = 0x19b;
+const KEY_PAUSE: u16 = 119;
+const KEY_RESTART: u16 = 0x198;
+
+const KEY_FN: u16 = 0x1d0;
+// TODO: Should we block range until KEY_FN_RIGHT_SHIFT?
 
 // Gamepad keys from https://github.com/torvalds/linux/blob/master/Documentation/input/gamepad.rst
 // First range
@@ -49,11 +55,19 @@ use crate::{cuse_device::state::KeyTracker, global_config::DevicePolicy};
 pub fn is_allowed(keytracker: &mut KeyTracker, policy: &DevicePolicy, event: &input_event) -> bool {
     match policy {
         DevicePolicy::None => true,
+        DevicePolicy::MuteSysRq => is_allowed_in_mute_sysrq(keytracker, event),
         DevicePolicy::Sanitized => is_allowed_in_sanitized_mode(keytracker, event),
         DevicePolicy::StrictGamepad => is_allowed_in_strict_gamepad_mode(keytracker, event),
     }
 }
 
+fn is_allowed_in_mute_sysrq(keytracker: &mut KeyTracker, event: &input_event) -> bool {
+    if event.type_ == EV_KEY && event.code == KEY_SYSRQ {
+        return false;
+    } 
+    true
+}
+
 fn is_allowed_in_sanitized_mode(keytracker: &mut KeyTracker, event: &input_event) -> bool {
     let type_ = event.type_;
     let code = event.code;
@@ -93,6 +107,11 @@ fn is_allowed_in_sanitized_mode(keytracker: &mut KeyTracker, event: &input_event
             return false;
         }
 
+        // TODO:
+        // keycode  84 = Last_Console
+        // alt keycode 105 = Decr_Console
+        // alt keycode 106 = Incr_Console
+
         // 3. Block CAD (Ctrl + Alt + Del).
         // Block basically all Boot from defkeymap.map
         if alt_down && ctrl_down && (code == KEY_DELETE || code == KEY_KPDOT) {
@@ -105,20 +124,18 @@ fn is_allowed_in_sanitized_mode(keytracker: &mut KeyTracker, event: &input_event
         // It seems not to be mapped by default, but close the potential hole if a
         // distro follows the ancient https://www.kernel.org/doc/Documentation/SAK.txt
 
-        
         // 5. Block standalone dangerous keys
         match code {
-            KEY_POWER | KEY_SLEEP | KEY_WAKEUP => return false,
+            KEY_POWER | KEY_SLEEP | KEY_WAKEUP | KEY_FN | KEY_BREAK | KEY_PAUSE | KEY_RESTART => {
+                return false
+            }
             _ => {}
         }
     }
     true
 }
 
-fn is_allowed_in_strict_gamepad_mode(
-    _keytracker: &mut KeyTracker,
-    event: &input_event,
-) -> bool {
+fn is_allowed_in_strict_gamepad_mode(_keytracker: &mut KeyTracker, event: &input_event) -> bool {
     match event.type_ {
         EV_SYN => true,
 
@@ -144,4 +161,3 @@ fn is_allowed_in_strict_gamepad_mode(
         _ => false,
     }
 }
-
diff --git a/vuinputd/src/global_config.rs b/vuinputd/src/global_config.rs
index 8330753..93f6368 100644
--- a/vuinputd/src/global_config.rs
+++ b/vuinputd/src/global_config.rs
@@ -20,8 +20,10 @@ pub static CONFIG: OnceLock<GlobalConfig> = OnceLock::new();
 #[clap(rename_all = "kebab-case")] // This ensures StrictGamepad becomes "strict-gamepad"
 pub enum DevicePolicy {
     /// Allow all device capabilities
-    #[default]
     None,
+    #[default]
+    /// Default: Block SysRq
+    MuteSysRq,
     /// Default: Allow keyboards/mice but block dangerous keys (SysRq, VT switching)
     Sanitized,
     /// Only allow Gamepad-like devices. Block mice and keyboards.