diff --git a/.gitignore b/.gitignore index 0bb9727..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,7 @@ /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz +/usbguard-1.1.2.tar.gz +/usbguard-1.1.3.tar.gz +/usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch deleted file mode 100644 index 8f0200e..0000000 --- a/policykit-dbus-chat-selinux.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te ---- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 -+++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 -@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua - - logging_send_syslog_msg(usbguard_t) - --dbus_system_domain(usbguard_t, usbguard_exec_t) - usbguard_ipc_access(usbguard_t) - -+optional_policy(` -+ dbus_system_domain(usbguard_t, usbguard_exec_t) -+ -+ optional_policy(` -+ policykit_dbus_chat(usbguard_t) -+ ') -+') -+ -+ - tunable_policy(`usbguard_daemon_write_rules',` - rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) - ') diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index f4811e8..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 -SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 +SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch deleted file mode 100644 index 5f4bed2..0000000 --- a/usbguard-restore-support-access-control-names.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Sat, 5 Mar 2022 17:22:05 +0100 -Subject: [PATCH] Restore support for access control filenames without a group - -Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 -of release 1.1.0, detailed analysis online at -https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 ---- - src/Daemon/Daemon.cpp | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index 45ddb76d..4ec2d934 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -446,12 +446,25 @@ namespace usbguard - void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, - std::string* const ptr_group) - { -+ // There are five supported forms: -+ // - ":" -+ // - ":" -+ // - "" -+ // - ":" -+ // - ":" - const auto ug_separator = basename.find_first_of(":"); - const bool has_group = ug_separator != std::string::npos; - const std::string user = basename.substr(0, ug_separator); - const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); -- checkIPCAccessControlName(user); -- checkIPCAccessControlName(group); -+ -+ if (! user.empty()) { -+ checkIPCAccessControlName(user); -+ } -+ -+ if (! group.empty()) { -+ checkIPCAccessControlName(group); -+ } -+ - *ptr_user = user; - *ptr_group = group; - } diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index 7eb0353..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,17 +1,17 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.4 +%define semodule_version 0.0.5 Name: usbguard -Version: 1.1.0 -Release: 4%{?dist} +Version: 1.1.4 +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy -License: GPLv2+ +License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz Source2: usbguard-daemon.conf Requires: systemd @@ -28,11 +28,10 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoc @@ -40,9 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch -Patch2: policykit-dbus-chat-selinux.patch -Patch3: usbguard-restore-support-access-control-names.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -71,7 +69,6 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} -BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel @@ -88,7 +85,8 @@ a D-Bus interface to the USBGuard daemon component. Summary: USBGuard selinux Group: Applications/System Requires: %{name} = %{version}-%{release} -BuildRequires: selinux-policy +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} BuildRequires: selinux-policy-devel BuildArch: noarch %{?selinux_requires} @@ -104,9 +102,10 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .catch -%patch2 -p1 -b .policykit -%patch3 -p1 -b .access-contol-names +pushd %{name}-selinux-%{semodule_version} +%patch -P 0 -p1 +%patch -P 1 -p1 +popd # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -121,7 +120,8 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=openssl \ + --disable-catch make %{?_smp_mflags} @@ -130,9 +130,6 @@ pushd %{name}-selinux-%{semodule_version} make popd -%check -make check - # selinux %pre selinux %selinux_relabel_pre -s %{selinuxtype} @@ -184,6 +181,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel %{_includedir}/* @@ -213,7 +211,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if %post selinux @@ -229,6 +227,79 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 +- Rebase to 1.1.3 +Resolves: rhbz#2290724 +- selinux package policy update +Resolves: rhbz#2271330 + +* Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 +- Rebase to 1.1.2 +Resolves: rhbz#2064543 + +* Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed May 10 2023 Tomas Popela - 1.1.0-7 +- Drop BR on dbus-glib as the requirement was dropped in 0.7.7 + +* Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 +- Rebuild +Resolves: rhbz#2171749 + +* Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild