Ghaf Kill Switch

Overview

ghaf-killswitch is a command-line utility in Ghaf that enables runtime toggling of certain hardware devices. It supports listing known devices, disabling (blocking) them, and re-enabling (unblocking) them. This capability is useful for privacy control, resource isolation or dynamic hardware management within the Ghaf host/VM architecture.

It currently supports three device types:

Keyword	Description
mic	Internal Audio & microphone PCI devices (used by the audio-vm)
net	WLAN / network PCI device (used by the net-vm)
cam	Internal camera device (used by the business-vm)
bluetooth	Bluetooth device (used by the audio-vm)

Note: Some hardware platforms may already include a physical camera kill switch (e.g. via Fn-key) which overrides software control.

---

Usage & Commands

Run ghaf-killswitch to control devices. General usage:

[ghaf@ghaf-host:~]$ sudo ghaf-killswitch <command> [device]

Where <command> is:

• list — show all supported devices for kill switch functionality
• block <device> — disable / remove the specified device
• unblock <device> — enable / add the specified device
• block --all - disable / remove all supported devices
• unblock --all - enable / add all supported devices
• status - Show block/unblock status of devices
• help — show usage instructions

Examples

List devices

[ghaf@gui-vm:~]$ ghaf-killswitch list

Disable internal microphone

[ghaf@gui-vm:~]$ ghaf-killswitch block mic

Run the below command to confirm:

[ghaf@gui-vm:~]$ nix-shell -p pulseaudio --run "pactl list sources short"

Disable Wi-Fi

[ghaf@gui-vm:~]$ ghaf-killswitch block net

Check inside net-vm or GUI to confirm:

[ghaf@net-vm:~]$ nmcli device status

Disable internal camera

[ghaf@gui-vm:~]$ ghaf-killswitch block cam

Check inside business-vm to confirm:

[ghaf@business-vm:~]$ lsusb

Disable Bluetooth

[ghaf@gui-vm:~]$ ghaf-killswitch block bluetooth

Check inside audio-vm to confirm:

[ghaf@business-vm:~]$ lsusb

Check status of devices

[ghaf@gui-vm:~]$ ghaf-killswitch status
mic: unblocked
net: unblocked
cam: blocked
bluetooth: blocked

Disable all devices

[ghaf@gui-vm:~]$ ghaf-killswitch block --all

Re-enable all devices

[ghaf@gui-vm:~]$ ghaf-killswitch unblock --all

Limitations & Known Issues

• GUI anomalies — audio UI elements may misbehave when mic is disabled.
• Disabling the microphone will stop only internal audio playback and audio recording functionality.
• Support for blocking external USB devices like camera, microphone is currently unavailable.