Looks like they don't, but they turn off usbhid on that particular port: https://github.com/CIRCL/Circlean/blob/master/circlean_fs/root_partition/etc/udev/rules

Looks like they don't, but they turn off usbhid on that particular port: https://github.com/CIRCL/Circlean/blob/master/circlean_fs/root_partition/etc/udev/rules.d/50-blockhid.rules https://github.com/CIRCL/Circlean/blob/master/circlean_fs/ro... However, that could be bypassed if the USB key acted like a USB hub with a keyboard attached. If you do get a keyboard working, it looks like you can just log in with raspberry / raspberry and then full privileged access since sudo from the raspberry user, and /dev/kmem from root is enabled. That would allow arbitrary content to be copied on to the user supplied USB, and depending on the device, possibly firmware reprogramming.