From ca389b9dcd7c7c64d8db90eb9ad9b6550b0fd3cd Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Mon, 26 Sep 2022 13:51:02 +0200 Subject: [PATCH 01/22] selinux: Update based on latest packaging guide https://fedoraproject.org/wiki/SELinux/IndependentPolicy Add dependency on selinux-policy-targeted Exclude installed policy module file from RPM verification Signed-off-by: Nikola Knazekova --- usbguard.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 7eb0353..e74cfcb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -88,7 +88,8 @@ a D-Bus interface to the USBGuard daemon component. Summary: USBGuard selinux Group: Applications/System Requires: %{name} = %{version}-%{release} -BuildRequires: selinux-policy +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} BuildRequires: selinux-policy-devel BuildArch: noarch %{?selinux_requires} @@ -213,7 +214,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if %post selinux From a7b34bb53f5498e72ebd4cf26ccab9b5e26eb13c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 05:57:42 +0000 Subject: [PATCH 02/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e74cfcb..d26b3bd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -230,6 +230,9 @@ fi %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 6763ed0496d9e12cf0071f9dec2e40b01bfda8dd Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 24 Jan 2023 15:01:59 -0500 Subject: [PATCH 03/22] Fix build with GCC 13 --- usbguard-gcc13.patch | 12 ++++++++++++ usbguard.spec | 3 +++ 2 files changed, 15 insertions(+) create mode 100644 usbguard-gcc13.patch diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch new file mode 100644 index 0000000..2229079 --- /dev/null +++ b/usbguard-gcc13.patch @@ -0,0 +1,12 @@ +diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp +index 0947f21..aa76311 100644 +--- a/src/Library/Base64.hpp ++++ b/src/Library/Base64.hpp +@@ -24,6 +24,7 @@ + + #include + #include ++#include + + namespace usbguard + { diff --git a/usbguard.spec b/usbguard.spec index d26b3bd..50552b0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -43,6 +43,8 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch Patch3: usbguard-restore-support-access-control-names.patch +# https://github.com/USBGuard/usbguard/pull/582 +Patch4: usbguard-gcc13.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,6 +110,7 @@ daemon. %patch1 -p1 -b .catch %patch2 -p1 -b .policykit %patch3 -p1 -b .access-contol-names +%patch4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 301862791baeeb84463d0d59998517d6d9959692 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 20 Feb 2023 14:14:12 +0100 Subject: [PATCH 04/22] Rebuild Resolves: rhbz#2171749 --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 50552b0..2adf917 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -233,6 +233,10 @@ fi %changelog +* Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 +- Rebuild +Resolves: rhbz#2171749 + * Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 97ffebda9664433933e976da02f06cf9b4d8c97c Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Wed, 10 May 2023 15:11:04 +0200 Subject: [PATCH 05/22] Drop BR on dbus-glib as the requirement was dropped in 0.7.7 --- usbguard.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 2adf917..12ce1c1 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -73,7 +73,6 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} -BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel @@ -233,6 +232,9 @@ fi %changelog +* Wed May 10 2023 Tomas Popela - 1.1.0-7 +- Drop BR on dbus-glib as the requirement was dropped in 0.7.7 + * Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 - Rebuild Resolves: rhbz#2171749 From b38cc691dbb5f07b75e40739ccd73407953621d1 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 31 May 2023 10:32:34 +0200 Subject: [PATCH 06/22] Update License tag for SPDX and fix deprecated %patchN --- usbguard.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 12ce1c1..9ccacb7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -6,7 +6,7 @@ Name: usbguard Version: 1.1.0 Release: 7%{?dist} Summary: A tool for implementing USB device usage policy -License: GPLv2+ +License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ @@ -106,10 +106,10 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .catch -%patch2 -p1 -b .policykit -%patch3 -p1 -b .access-contol-names -%patch4 -p1 -b .gcc13 +%patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .policykit +%patch -P 3 -p1 -b .access-contol-names +%patch -P 4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 5aa21e5bdcd82588be6dd790086bccf277182a34 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 17:15:47 +0000 Subject: [PATCH 07/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9ccacb7..c602254 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 10 2023 Tomas Popela - 1.1.0-7 - Drop BR on dbus-glib as the requirement was dropped in 0.7.7 From b0c20efcc06c5f8ad94389b64e7ae576cdf46a96 Mon Sep 17 00:00:00 2001 From: alakatos Date: Thu, 27 Jul 2023 10:56:48 +0200 Subject: [PATCH 08/22] Rebase to 1.1.2 Resolves: rhbz#2064543 --- .gitignore | 1 + sources | 2 +- ...restore-support-access-control-names.patch | 44 ------------------- usbguard-selinux-audit-write.patch | 12 +++++ usbguard.spec | 16 ++++--- 5 files changed, 24 insertions(+), 51 deletions(-) delete mode 100644 usbguard-restore-support-access-control-names.patch create mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 0bb9727..37047d1 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz +/usbguard-1.1.2.tar.gz diff --git a/sources b/sources index f4811e8..c5d8006 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 +SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch deleted file mode 100644 index 5f4bed2..0000000 --- a/usbguard-restore-support-access-control-names.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Sat, 5 Mar 2022 17:22:05 +0100 -Subject: [PATCH] Restore support for access control filenames without a group - -Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 -of release 1.1.0, detailed analysis online at -https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 ---- - src/Daemon/Daemon.cpp | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index 45ddb76d..4ec2d934 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -446,12 +446,25 @@ namespace usbguard - void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, - std::string* const ptr_group) - { -+ // There are five supported forms: -+ // - ":" -+ // - ":" -+ // - "" -+ // - ":" -+ // - ":" - const auto ug_separator = basename.find_first_of(":"); - const bool has_group = ug_separator != std::string::npos; - const std::string user = basename.substr(0, ug_separator); - const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); -- checkIPCAccessControlName(user); -- checkIPCAccessControlName(group); -+ -+ if (! user.empty()) { -+ checkIPCAccessControlName(user); -+ } -+ -+ if (! group.empty()) { -+ checkIPCAccessControlName(group); -+ } -+ - *ptr_user = user; - *ptr_group = group; - } diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch new file mode 100644 index 0000000..4d8b376 --- /dev/null +++ b/usbguard-selinux-audit-write.patch @@ -0,0 +1,12 @@ +diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te +--- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 ++++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 +@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) + # Local policy + # + +-allow usbguard_t self:capability { chown fowner }; ++allow usbguard_t self:capability { chown fowner audit_write }; + allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; + allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; + diff --git a/usbguard.spec b/usbguard.spec index c602254..9c13cf0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 1.1.0 -Release: 8%{?dist} +Version: 1.1.2 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -42,9 +42,9 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch -Patch3: usbguard-restore-support-access-control-names.patch # https://github.com/USBGuard/usbguard/pull/582 -Patch4: usbguard-gcc13.patch +Patch3: usbguard-gcc13.patch +Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,8 +108,8 @@ daemon. %patch -P 1 -p1 -b .catch %patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .access-contol-names -%patch -P 4 -p1 -b .gcc13 +%patch -P 3 -p1 -b .gcc13 +%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +232,10 @@ fi %changelog +* Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 +- Rebase to 1.1.2 +Resolves: rhbz#2064543 + * Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 5015f2bbcb4b0ee3847683f8a79b901640740d27 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 07:16:53 +0000 Subject: [PATCH 09/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9c13cf0..09bae0b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 - Rebase to 1.1.2 Resolves: rhbz#2064543 From 13ea59fa5a3488307c30075ed79ede40726a2aa5 Mon Sep 17 00:00:00 2001 From: alakatos Date: Fri, 7 Jun 2024 09:00:59 +0200 Subject: [PATCH 10/22] Rebase to 1.1.3 Resolves: rhbz#2290724 selinux package policy update Resolves: rhbz#2271330 --- .gitignore | 2 ++ policykit-dbus-chat-selinux.patch | 22 ---------------------- sources | 4 ++-- usbguard-gcc13.patch | 12 ------------ usbguard-selinux-audit-write.patch | 12 ------------ usbguard.spec | 21 ++++++++++----------- 6 files changed, 14 insertions(+), 59 deletions(-) delete mode 100644 policykit-dbus-chat-selinux.patch delete mode 100644 usbguard-gcc13.patch delete mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 37047d1..884279b 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz /usbguard-1.1.2.tar.gz +/usbguard-1.1.3.tar.gz +/usbguard-selinux-0.0.5.tar.gz diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch deleted file mode 100644 index 8f0200e..0000000 --- a/policykit-dbus-chat-selinux.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te ---- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 -+++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 -@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua - - logging_send_syslog_msg(usbguard_t) - --dbus_system_domain(usbguard_t, usbguard_exec_t) - usbguard_ipc_access(usbguard_t) - -+optional_policy(` -+ dbus_system_domain(usbguard_t, usbguard_exec_t) -+ -+ optional_policy(` -+ policykit_dbus_chat(usbguard_t) -+ ') -+') -+ -+ - tunable_policy(`usbguard_daemon_write_rules',` - rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) - ') diff --git a/sources b/sources index c5d8006..6fead78 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 -SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 +SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch deleted file mode 100644 index 2229079..0000000 --- a/usbguard-gcc13.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp -index 0947f21..aa76311 100644 ---- a/src/Library/Base64.hpp -+++ b/src/Library/Base64.hpp -@@ -24,6 +24,7 @@ - - #include - #include -+#include - - namespace usbguard - { diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch deleted file mode 100644 index 4d8b376..0000000 --- a/usbguard-selinux-audit-write.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te ---- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 -+++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 -@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) - # Local policy - # - --allow usbguard_t self:capability { chown fowner }; -+allow usbguard_t self:capability { chown fowner audit_write }; - allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; - allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; - diff --git a/usbguard.spec b/usbguard.spec index 09bae0b..e1fb9bb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,17 +1,17 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.4 +%define semodule_version 0.0.5 Name: usbguard -Version: 1.1.2 -Release: 2%{?dist} +Version: 1.1.3 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz Source2: usbguard-daemon.conf Requires: systemd @@ -41,10 +41,6 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch -Patch2: policykit-dbus-chat-selinux.patch -# https://github.com/USBGuard/usbguard/pull/582 -Patch3: usbguard-gcc13.patch -Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -107,9 +103,6 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .gcc13 -%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +225,12 @@ fi %changelog +* Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 +- Rebase to 1.1.3 +Resolves: rhbz#2290724 +- selinux package policy update +Resolves: rhbz#2271330 + * Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 5fe2cc1565aa287b660deca31154afc0dc0b4a12 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 08:24:46 +0000 Subject: [PATCH 11/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e1fb9bb..da720a7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 - Rebase to 1.1.3 Resolves: rhbz#2290724 From f1ffa2655608f13954d0b87cda19107e572253d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 13:55:52 +0000 Subject: [PATCH 12/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index da720a7..94ebf10 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 5d01f96eab2bb003f1c35319396205bc43b4971b Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 6 Feb 2025 09:31:12 +0100 Subject: [PATCH 13/22] Add usbguard-tmpfles.conf --- tmpfiles.patch | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ usbguard.spec | 8 ++++++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 tmpfiles.patch diff --git a/tmpfiles.patch b/tmpfiles.patch new file mode 100644 index 0000000..4eb6b0f --- /dev/null +++ b/tmpfiles.patch @@ -0,0 +1,58 @@ +From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Thu, 6 Feb 2025 08:00:59 +0100 +Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= + =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= + =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= + =?UTF-8?q?y.?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +--- + Makefile.am | 13 +++++++++++-- + usbguard-tmpfiles.conf | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + create mode 100644 usbguard-tmpfiles.conf + +diff --git a/Makefile.am b/Makefile.am +index 7dc6849..2a8bfeb 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc + $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ + endif + +-install-data-hook: install-daemon-conf install-systemd-service install-data-dbus +-uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus ++install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles ++uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles + + CLEANFILES+=\ + $(top_builddir)/usbguard-daemon.conf +@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard + + distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print + ++EXTRA_DIST+=usbguard-tmpfiles.conf ++ ++install-tmpfiles: ++ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ ++ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ ++uninstall-tmpfiles: ++ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ + install-daemon-conf: $(top_builddir)/usbguard-daemon.conf + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +new file mode 100644 +index 0000000..e90908f +--- /dev/null ++++ b/usbguard-tmpfiles.conf +@@ -0,0 +1 @@ ++d /var/log/usbguard 0700 root root - - +-- +2.48.1 + diff --git a/usbguard.spec b/usbguard.spec index 94ebf10..aac3acd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -41,6 +41,7 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch +Patch2: tmpfiles.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,6 +104,7 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .tmpfiles # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -180,6 +182,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel %{_includedir}/* @@ -225,6 +228,9 @@ fi %changelog +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + * Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 4125b6a0ad5aefa12690edd2deacb65c36a99a3c Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 24 Apr 2025 10:12:16 +0200 Subject: [PATCH 14/22] Fix usbguard-tmpfiles.conf Remove catch1 dependency Adapt for protobuf api changes Fix regression in specifying IPC privileges using UID selinux subpackage update: unified bin and sbin Resolves: rhbz#2297169 --- catch2-support.patch | 281 ++++++++++++++++++++++++++++ disable-catch.patch | 153 +++++++++++++++ ipc-privileges.patch | 88 +++++++++ protobuf-3.0.patch | 70 +++++++ selinux-bin-sbin.patch | 14 ++ tmpfiles.patch => tmpfiles-v1.patch | 24 +-- tmpfiles-v2.patch | 7 + uninstall-ignore-error.patch | 34 ++++ usbguard-revert-catch.patch | 17 -- usbguard.spec | 40 +++- 10 files changed, 679 insertions(+), 49 deletions(-) create mode 100644 catch2-support.patch create mode 100644 disable-catch.patch create mode 100644 ipc-privileges.patch create mode 100644 protobuf-3.0.patch create mode 100644 selinux-bin-sbin.patch rename tmpfiles.patch => tmpfiles-v1.patch (66%) create mode 100644 tmpfiles-v2.patch create mode 100644 uninstall-ignore-error.patch delete mode 100644 usbguard-revert-catch.patch diff --git a/catch2-support.patch b/catch2-support.patch new file mode 100644 index 0000000..49ae059 --- /dev/null +++ b/catch2-support.patch @@ -0,0 +1,281 @@ +diff --git a/configure.ac b/configure.ac +index 1f5be3a3..617d3bcf 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -396,10 +396,15 @@ else + SAVE_CPPFLAGS=$CPPFLAGS + CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" + AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" + fi +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index e10e8456..2efbb509 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ + + test_unit_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + + test_unit_LDFLAGS=\ +@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ + + test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + +diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp +index 73b536a3..6f6e350c 100644 +--- a/src/Tests/Regression/github-PR209-config-parser.cpp ++++ b/src/Tests/Regression/github-PR209-config-parser.cpp +@@ -18,7 +18,11 @@ + // + + #include "usbguard/ConfigFile.hpp" +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + #include + #include +diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp +index f3d9b82d..24b84935 100644 +--- a/src/Tests/Regression/test_Rule_ghi113.cpp ++++ b/src/Tests/Regression/test_Rule_ghi113.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp +index 2056102d..72483bb1 100644 +--- a/src/Tests/Regression/test_Rule_ghi247.cpp ++++ b/src/Tests/Regression/test_Rule_ghi247.cpp +@@ -19,7 +19,11 @@ + #include "usbguard/Rule.hpp" + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp +index f240c8b5..df2ef637 100644 +--- a/src/Tests/Regression/test_Rule_ghi37.cpp ++++ b/src/Tests/Regression/test_Rule_ghi37.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp +index 3f87093f..113b0633 100644 +--- a/src/Tests/Unit/test_Base64.cpp ++++ b/src/Tests/Unit/test_Base64.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +index 4ed4167b..f85a4ccb 100644 +--- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp ++++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/IPCServer.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp +index cafc8cca..015ce1bc 100644 +--- a/src/Tests/Unit/test_Rule.cpp ++++ b/src/Tests/Unit/test_Rule.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp +index ddb93dec..2aff77b6 100644 +--- a/src/Tests/Unit/test_RuleAttribute_id.cpp ++++ b/src/Tests/Unit/test_RuleAttribute_id.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp +index e9bc21e2..e310de81 100644 +--- a/src/Tests/Unit/test_RuleParser.cpp ++++ b/src/Tests/Unit/test_RuleParser.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp +index 759ee2cd..cbfd554c 100644 +--- a/src/Tests/Unit/test_UEvent.cpp ++++ b/src/Tests/Unit/test_UEvent.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp +index cefbc3bd..205a6885 100644 +--- a/src/Tests/Unit/test_UEventParser.cpp ++++ b/src/Tests/Unit/test_UEventParser.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +index fbe8bbdc..4a2e9612 100644 +--- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp ++++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + #include "test_UMockdevDeviceDefinition.data.hpp" +diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp +index 6d3e188f..a85fa362 100644 +--- a/src/Tests/Unit/test_Utility.cpp ++++ b/src/Tests/Unit/test_Utility.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp +index 4e3e8760..1b001998 100644 +--- a/src/Tests/main.cpp ++++ b/src/Tests/main.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#define CATCH_CONFIG_MAIN +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #define CATCH_CONFIG_MAIN ++ #include ++#endif + + /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch new file mode 100644 index 0000000..3a7219a --- /dev/null +++ b/disable-catch.patch @@ -0,0 +1,153 @@ +diff --git a/configure.ac b/configure.ac +index 617d3bcf..56bbe9e3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -386,27 +386,38 @@ fi + # + # Catch C++ library + # ++AC_ARG_ENABLE([catch], ++ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], ++ [enable_catch=$enableval], [enable_catch=yes]) ++ + AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) +-if test "x$with_bundled_catch" = xyes; then +- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" +- catch_LIBS="" +- AC_MSG_NOTICE([Using bundled Catch library]) +- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ ++if test "x$enable_catch" = xyes; then ++ if test "x$with_bundled_catch" = xyes; then ++ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" ++ catch_LIBS="" ++ AC_MSG_NOTICE([Using bundled Catch library]) ++ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ else ++ SAVE_CPPFLAGS=$CPPFLAGS ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ AC_LANG_PUSH([C++]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) ++ AC_LANG_POP ++ CPPFLAGS=$SAVE_CPPFLAGS ++ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ fi + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch_test_macros.hpp], +- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" +- catch_LIBS="-lCatch2Main -lCatch2"], +- [AC_CHECK_HEADER([catch.hpp], +- [catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS=""], +- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] +- )]) +- AC_LANG_POP +- CPPFLAGS=$SAVE_CPPFLAGS +- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ catch_CFLAGS="" ++ catch_LIBS="" ++ catch_summary="disabled; not checking for Catch2" + fi + AC_SUBST([catch_CFLAGS]) + AC_SUBST([catch_LIBS]) +@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) + AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) + AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) + AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) ++AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) + + CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" + CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index b84d2480..aa504bc9 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -583,7 +583,8 @@ namespace usbguard + return true; + } + +- bool isValidNameOrUID(const std::string& input) { ++ bool isValidNameOrUID(const std::string& input) ++ { + return isValidName(input) || isValidUID(input); + } + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index b75df136..555d113e 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,7 +36,7 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidNameOrUID(name)) { ++ if (!isValidNameOrUID(name)) { + throw Exception("IPC access control", "invalid name or UID format", name); + } + } +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index 2efbb509..435a4264 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ + + + TESTS=\ +- test-unit \ +- test-regression \ + USB/test-descriptor-parser.sh \ + Rules/test-rules.sh + ++if CATCH_ENABLED ++TESTS+=\ ++ test-unit \ ++ test-regression ++endif ++ + if FULL_TEST_SUITE_ENABLED + TESTS+=\ + Source/check-driver.sh \ +@@ -101,10 +105,15 @@ TESTS+=\ + + endif + +-check_PROGRAMS=\ ++check_PROGRAMS= ++ ++if CATCH_ENABLED ++check_PROGRAMS+=\ + test-unit \ + test-regression ++endif + ++if CATCH_ENABLED + test_unit_SOURCES=\ + main.cpp \ + Unit/test_Rule.cpp \ +@@ -128,7 +137,9 @@ test_unit_LDADD=\ + + test_unit_LDFLAGS=\ + -static ++endif + ++if CATCH_ENABLED + test_regression_SOURCES=\ + main.cpp \ + Regression/test_Rule_ghi37.cpp \ +@@ -143,4 +154,4 @@ test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ + $(catch_LIBS) \ + $(PTHREAD_LIBS) +- ++endif +\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch new file mode 100644 index 0000000..bf0f65d --- /dev/null +++ b/ipc-privileges.patch @@ -0,0 +1,88 @@ +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index aee50ce0..b84d2480 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -543,7 +543,22 @@ namespace usbguard + return rulefile_list; + } + +- bool isValidName(const std::string& name) ++ static bool isValidUID(const std::string& uid) ++ { ++ if (uid.empty()) { ++ return false; ++ } ++ ++ for (char c : uid) { ++ if (!std::isdigit(c)) { ++ return false; ++ } ++ } ++ ++ return true; ++ } ++ ++ static bool isValidName(const std::string& name) + { + const char* s = name.data(); + +@@ -568,6 +583,10 @@ namespace usbguard + return true; + } + ++ bool isValidNameOrUID(const std::string& input) { ++ return isValidName(input) || isValidUID(input); ++ } ++ + } /* namespace usbguard */ + + /* vim: set ts=2 sw=2 et */ +diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp +index d49e24dc..ac0bae4f 100644 +--- a/src/Common/Utility.hpp ++++ b/src/Common/Utility.hpp +@@ -319,12 +319,11 @@ namespace usbguard + /** + * @brief Checks whether a given name is a valid group/user name + * +- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] + * + * @param name Name to check + * @return True if given name is valid, false otherwise + */ +- bool isValidName(const std::string& name); ++ bool isValidNameOrUID(const std::string& name); + + } /* namespace usbguard */ + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index 973eb8bd..b75df136 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,8 +36,8 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidName(name)) { +- throw Exception("IPC access control", "invalid name format", name); ++ if (!isValidNameOrUID(name)) { ++ throw Exception("IPC access control", "invalid name or UID format", name); + } + } + +diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp +index ddb1d8a7..0ba6f93d 100644 +--- a/src/Library/public/usbguard/IPCServer.hpp ++++ b/src/Library/public/usbguard/IPCServer.hpp +@@ -50,9 +50,9 @@ namespace usbguard + /** + * @brief Checks whether given name is a valid access control name. + * +- * Name is a valid access control name iff: ++ * Name is a valid access control name if: + * 1. it is not longer then 32 characters +- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] ++ * 2. it is aligned with the syntax of useradd(8) + * + * @param name Name to be verified. + * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch new file mode 100644 index 0000000..ce12d9f --- /dev/null +++ b/protobuf-3.0.patch @@ -0,0 +1,70 @@ +diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp +index 6aa52013..452ecd41 100644 +--- a/src/Library/IPCClientPrivate.cpp ++++ b/src/Library/IPCClientPrivate.cpp +@@ -225,7 +225,7 @@ namespace usbguard + std::string payload; + message.SerializeToString(&payload); + struct qb_ipc_request_header hdr; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + struct iovec iov[2]; + iov[0].iov_base = &hdr; +diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp +index d92a1d47..a33022e2 100644 +--- a/src/Library/IPCClientPrivate.hpp ++++ b/src/Library/IPCClientPrivate.hpp +@@ -84,7 +84,7 @@ namespace usbguard + template + void registerHandler(MessageHandler::HandlerType method) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method)); + } + +diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp +index 548a7261..b976f025 100644 +--- a/src/Library/IPCServerPrivate.cpp ++++ b/src/Library/IPCServerPrivate.cpp +@@ -311,7 +311,7 @@ namespace usbguard + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr; + struct iovec iov[2]; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + iov[0].iov_base = &hdr; +@@ -555,7 +555,7 @@ namespace usbguard + std::string payload; + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr = { }; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + struct iovec iov[2]; +@@ -563,7 +563,7 @@ namespace usbguard + iov[0].iov_len = sizeof hdr; + iov[1].iov_base = (void*)payload.data(); + iov[1].iov_len = payload.size(); +- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); ++ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); + iov[0].iov_base = nullptr; + iov[1].iov_base = nullptr; + } +diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp +index 25f9ac38..3b3dcc51 100644 +--- a/src/Library/IPCServerPrivate.hpp ++++ b/src/Library/IPCServerPrivate.hpp +@@ -134,7 +134,7 @@ namespace usbguard + void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, + IPCServer::AccessControl::Privilege privilege) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); + } + diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/tmpfiles.patch b/tmpfiles-v1.patch similarity index 66% rename from tmpfiles.patch rename to tmpfiles-v1.patch index 4eb6b0f..21e1468 100644 --- a/tmpfiles.patch +++ b/tmpfiles-v1.patch @@ -1,22 +1,5 @@ -From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 -From: Cropi -Date: Thu, 6 Feb 2025 08:00:59 +0100 -Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= - =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= - =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= - =?UTF-8?q?y.?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - ---- - Makefile.am | 13 +++++++++++-- - usbguard-tmpfiles.conf | 1 + - 2 files changed, 12 insertions(+), 2 deletions(-) - create mode 100644 usbguard-tmpfiles.conf - diff --git a/Makefile.am b/Makefile.am -index 7dc6849..2a8bfeb 100644 +index 7dc6849d..2a8bfebd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc @@ -48,11 +31,8 @@ index 7dc6849..2a8bfeb 100644 $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf new file mode 100644 -index 0000000..e90908f +index 00000000..e90908f9 --- /dev/null +++ b/usbguard-tmpfiles.conf @@ -0,0 +1 @@ +d /var/log/usbguard 0700 root root - - --- -2.48.1 - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch new file mode 100644 index 0000000..069ee15 --- /dev/null +++ b/tmpfiles-v2.patch @@ -0,0 +1,7 @@ +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +index e90908f9..aff00c56 100644 +--- a/usbguard-tmpfiles.conf ++++ b/usbguard-tmpfiles.conf +@@ -1 +1 @@ +-d /var/log/usbguard 0700 root root - - ++d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch new file mode 100644 index 0000000..c05d50a --- /dev/null +++ b/uninstall-ignore-error.patch @@ -0,0 +1,34 @@ +diff --git a/Makefile.am b/Makefile.am +index 2a8bfebd..74a08cb7 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit + + uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service + rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service +- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) ++ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) + rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf +- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) ++ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) + + dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml + # +@@ -563,7 +563,7 @@ install-polkit-policy: + + uninstall-polkit-policy: + rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy +- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) ++ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) + + else + install-polkit-policy: +@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service + + uninstall-systemd-dbus-service: + rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service +- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) ++ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) + + else + install-systemd-dbus-service: diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index aac3acd..c65991c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -32,7 +32,6 @@ BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoc @@ -40,8 +39,14 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch -Patch2: tmpfiles.patch +Patch0: tmpfiles-v1.patch +Patch1: tmpfiles-v2.patch +Patch2: uninstall-ignore-error.patch +Patch3: ipc-privileges.patch +Patch4: protobuf-3.0.patch +Patch5: catch2-support.patch +Patch6: disable-catch.patch +Patch7: selinux-bin-sbin.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,8 +108,17 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .tmpfiles +%patch -P 0 -p1 +%patch -P 1 -p1 +%patch -P 2 -p1 +%patch -P 3 -p1 +%patch -P 4 -p1 +%patch -P 5 -p1 +%patch -P 6 -p1 + +pushd %{name}-selinux-%{semodule_version} +%patch -P 7 -p1 +popd # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -119,7 +133,8 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --disable-catch make %{?_smp_mflags} @@ -128,9 +143,6 @@ pushd %{name}-selinux-%{semodule_version} make popd -%check -make check - # selinux %pre selinux %selinux_relabel_pre -s %{selinuxtype} @@ -228,6 +240,14 @@ fi %changelog +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + * Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 - Install usbguard-tmpfles.conf From 1da2d8dacd5f9bb2eb88b34901c8afe0d8b89a51 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 19:52:18 +0000 Subject: [PATCH 15/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c65991c..5b108c2 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 - Fix usbguard-tmpfiles.conf - Remove catch1 dependency From 7f57f2807aee176da5e4c7a030726cde72e5aa0f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 19:41:27 +0000 Subject: [PATCH 16/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 5b108c2..0e68fcd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From f7c30b9e6b99a9f17c77357b056f0c9061a1c834 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 15 Apr 2026 09:53:56 +0200 Subject: [PATCH 17/22] Rebase usbguard to 1.1.4 Rebased from 1.1.3 to 1.1.4. Dropped patches merged upstream: - tmpfiles-v1.patch - tmpfiles-v2.patch - uninstall-ignore-error.patch - ipc-privileges.patch - protobuf-3.0.patch - catch2-support.patch - disable-catch.patch Added selinux-homed.patch for systemd-homed stream connect. Resolves: rhbz#2380396 Resolves: rhbz#2376283 --- .gitignore | 1 + catch2-support.patch | 281 ----------------------------------- disable-catch.patch | 153 ------------------- ipc-privileges.patch | 88 ----------- protobuf-3.0.patch | 70 --------- selinux-homed.patch | 14 ++ sources | 2 +- tmpfiles-v1.patch | 38 ----- tmpfiles-v2.patch | 7 - uninstall-ignore-error.patch | 34 ----- usbguard.spec | 32 ++-- 11 files changed, 30 insertions(+), 690 deletions(-) delete mode 100644 catch2-support.patch delete mode 100644 disable-catch.patch delete mode 100644 ipc-privileges.patch delete mode 100644 protobuf-3.0.patch create mode 100644 selinux-homed.patch delete mode 100644 tmpfiles-v1.patch delete mode 100644 tmpfiles-v2.patch delete mode 100644 uninstall-ignore-error.patch diff --git a/.gitignore b/.gitignore index 884279b..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /usbguard-1.1.2.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch2-support.patch b/catch2-support.patch deleted file mode 100644 index 49ae059..0000000 --- a/catch2-support.patch +++ /dev/null @@ -1,281 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 1f5be3a3..617d3bcf 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -396,10 +396,15 @@ else - SAVE_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" - AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" - fi -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index e10e8456..2efbb509 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ - - test_unit_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - - test_unit_LDFLAGS=\ -@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ - - test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - -diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp -index 73b536a3..6f6e350c 100644 ---- a/src/Tests/Regression/github-PR209-config-parser.cpp -+++ b/src/Tests/Regression/github-PR209-config-parser.cpp -@@ -18,7 +18,11 @@ - // - - #include "usbguard/ConfigFile.hpp" --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - #include - #include -diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp -index f3d9b82d..24b84935 100644 ---- a/src/Tests/Regression/test_Rule_ghi113.cpp -+++ b/src/Tests/Regression/test_Rule_ghi113.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp -index 2056102d..72483bb1 100644 ---- a/src/Tests/Regression/test_Rule_ghi247.cpp -+++ b/src/Tests/Regression/test_Rule_ghi247.cpp -@@ -19,7 +19,11 @@ - #include "usbguard/Rule.hpp" - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp -index f240c8b5..df2ef637 100644 ---- a/src/Tests/Regression/test_Rule_ghi37.cpp -+++ b/src/Tests/Regression/test_Rule_ghi37.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp -index 3f87093f..113b0633 100644 ---- a/src/Tests/Unit/test_Base64.cpp -+++ b/src/Tests/Unit/test_Base64.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -index 4ed4167b..f85a4ccb 100644 ---- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp -+++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/IPCServer.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp -index cafc8cca..015ce1bc 100644 ---- a/src/Tests/Unit/test_Rule.cpp -+++ b/src/Tests/Unit/test_Rule.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp -index ddb93dec..2aff77b6 100644 ---- a/src/Tests/Unit/test_RuleAttribute_id.cpp -+++ b/src/Tests/Unit/test_RuleAttribute_id.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp -index e9bc21e2..e310de81 100644 ---- a/src/Tests/Unit/test_RuleParser.cpp -+++ b/src/Tests/Unit/test_RuleParser.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp -index 759ee2cd..cbfd554c 100644 ---- a/src/Tests/Unit/test_UEvent.cpp -+++ b/src/Tests/Unit/test_UEvent.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp -index cefbc3bd..205a6885 100644 ---- a/src/Tests/Unit/test_UEventParser.cpp -+++ b/src/Tests/Unit/test_UEventParser.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -index fbe8bbdc..4a2e9612 100644 ---- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -+++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - #include "test_UMockdevDeviceDefinition.data.hpp" -diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp -index 6d3e188f..a85fa362 100644 ---- a/src/Tests/Unit/test_Utility.cpp -+++ b/src/Tests/Unit/test_Utility.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp -index 4e3e8760..1b001998 100644 ---- a/src/Tests/main.cpp -+++ b/src/Tests/main.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#define CATCH_CONFIG_MAIN --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #define CATCH_CONFIG_MAIN -+ #include -+#endif - - /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch deleted file mode 100644 index 3a7219a..0000000 --- a/disable-catch.patch +++ /dev/null @@ -1,153 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 617d3bcf..56bbe9e3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -386,27 +386,38 @@ fi - # - # Catch C++ library - # -+AC_ARG_ENABLE([catch], -+ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], -+ [enable_catch=$enableval], [enable_catch=yes]) -+ - AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) --if test "x$with_bundled_catch" = xyes; then -- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -- catch_LIBS="" -- AC_MSG_NOTICE([Using bundled Catch library]) -- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ -+if test "x$enable_catch" = xyes; then -+ if test "x$with_bundled_catch" = xyes; then -+ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -+ catch_LIBS="" -+ AC_MSG_NOTICE([Using bundled Catch library]) -+ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ else -+ SAVE_CPPFLAGS=$CPPFLAGS -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ AC_LANG_PUSH([C++]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) -+ AC_LANG_POP -+ CPPFLAGS=$SAVE_CPPFLAGS -+ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ fi - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch_test_macros.hpp], -- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -- catch_LIBS="-lCatch2Main -lCatch2"], -- [AC_CHECK_HEADER([catch.hpp], -- [catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS=""], -- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -- )]) -- AC_LANG_POP -- CPPFLAGS=$SAVE_CPPFLAGS -- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ catch_CFLAGS="" -+ catch_LIBS="" -+ catch_summary="disabled; not checking for Catch2" - fi - AC_SUBST([catch_CFLAGS]) - AC_SUBST([catch_LIBS]) -@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) - AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) - AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) - AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) -+AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) - - CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" - CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index b84d2480..aa504bc9 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -583,7 +583,8 @@ namespace usbguard - return true; - } - -- bool isValidNameOrUID(const std::string& input) { -+ bool isValidNameOrUID(const std::string& input) -+ { - return isValidName(input) || isValidUID(input); - } - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index b75df136..555d113e 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,7 +36,7 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidNameOrUID(name)) { -+ if (!isValidNameOrUID(name)) { - throw Exception("IPC access control", "invalid name or UID format", name); - } - } -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index 2efbb509..435a4264 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ - - - TESTS=\ -- test-unit \ -- test-regression \ - USB/test-descriptor-parser.sh \ - Rules/test-rules.sh - -+if CATCH_ENABLED -+TESTS+=\ -+ test-unit \ -+ test-regression -+endif -+ - if FULL_TEST_SUITE_ENABLED - TESTS+=\ - Source/check-driver.sh \ -@@ -101,10 +105,15 @@ TESTS+=\ - - endif - --check_PROGRAMS=\ -+check_PROGRAMS= -+ -+if CATCH_ENABLED -+check_PROGRAMS+=\ - test-unit \ - test-regression -+endif - -+if CATCH_ENABLED - test_unit_SOURCES=\ - main.cpp \ - Unit/test_Rule.cpp \ -@@ -128,7 +137,9 @@ test_unit_LDADD=\ - - test_unit_LDFLAGS=\ - -static -+endif - -+if CATCH_ENABLED - test_regression_SOURCES=\ - main.cpp \ - Regression/test_Rule_ghi37.cpp \ -@@ -143,4 +154,4 @@ test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ - $(catch_LIBS) \ - $(PTHREAD_LIBS) -- -+endif -\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch deleted file mode 100644 index bf0f65d..0000000 --- a/ipc-privileges.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index aee50ce0..b84d2480 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -543,7 +543,22 @@ namespace usbguard - return rulefile_list; - } - -- bool isValidName(const std::string& name) -+ static bool isValidUID(const std::string& uid) -+ { -+ if (uid.empty()) { -+ return false; -+ } -+ -+ for (char c : uid) { -+ if (!std::isdigit(c)) { -+ return false; -+ } -+ } -+ -+ return true; -+ } -+ -+ static bool isValidName(const std::string& name) - { - const char* s = name.data(); - -@@ -568,6 +583,10 @@ namespace usbguard - return true; - } - -+ bool isValidNameOrUID(const std::string& input) { -+ return isValidName(input) || isValidUID(input); -+ } -+ - } /* namespace usbguard */ - - /* vim: set ts=2 sw=2 et */ -diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp -index d49e24dc..ac0bae4f 100644 ---- a/src/Common/Utility.hpp -+++ b/src/Common/Utility.hpp -@@ -319,12 +319,11 @@ namespace usbguard - /** - * @brief Checks whether a given name is a valid group/user name - * -- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] - * - * @param name Name to check - * @return True if given name is valid, false otherwise - */ -- bool isValidName(const std::string& name); -+ bool isValidNameOrUID(const std::string& name); - - } /* namespace usbguard */ - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index 973eb8bd..b75df136 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,8 +36,8 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidName(name)) { -- throw Exception("IPC access control", "invalid name format", name); -+ if (!isValidNameOrUID(name)) { -+ throw Exception("IPC access control", "invalid name or UID format", name); - } - } - -diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp -index ddb1d8a7..0ba6f93d 100644 ---- a/src/Library/public/usbguard/IPCServer.hpp -+++ b/src/Library/public/usbguard/IPCServer.hpp -@@ -50,9 +50,9 @@ namespace usbguard - /** - * @brief Checks whether given name is a valid access control name. - * -- * Name is a valid access control name iff: -+ * Name is a valid access control name if: - * 1. it is not longer then 32 characters -- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] -+ * 2. it is aligned with the syntax of useradd(8) - * - * @param name Name to be verified. - * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch deleted file mode 100644 index ce12d9f..0000000 --- a/protobuf-3.0.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp -index 6aa52013..452ecd41 100644 ---- a/src/Library/IPCClientPrivate.cpp -+++ b/src/Library/IPCClientPrivate.cpp -@@ -225,7 +225,7 @@ namespace usbguard - std::string payload; - message.SerializeToString(&payload); - struct qb_ipc_request_header hdr; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - struct iovec iov[2]; - iov[0].iov_base = &hdr; -diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp -index d92a1d47..a33022e2 100644 ---- a/src/Library/IPCClientPrivate.hpp -+++ b/src/Library/IPCClientPrivate.hpp -@@ -84,7 +84,7 @@ namespace usbguard - template - void registerHandler(MessageHandler::HandlerType method) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method)); - } - -diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp -index 548a7261..b976f025 100644 ---- a/src/Library/IPCServerPrivate.cpp -+++ b/src/Library/IPCServerPrivate.cpp -@@ -311,7 +311,7 @@ namespace usbguard - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr; - struct iovec iov[2]; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - iov[0].iov_base = &hdr; -@@ -555,7 +555,7 @@ namespace usbguard - std::string payload; - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr = { }; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - struct iovec iov[2]; -@@ -563,7 +563,7 @@ namespace usbguard - iov[0].iov_len = sizeof hdr; - iov[1].iov_base = (void*)payload.data(); - iov[1].iov_len = payload.size(); -- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); -+ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); - iov[0].iov_base = nullptr; - iov[1].iov_base = nullptr; - } -diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp -index 25f9ac38..3b3dcc51 100644 ---- a/src/Library/IPCServerPrivate.hpp -+++ b/src/Library/IPCServerPrivate.hpp -@@ -134,7 +134,7 @@ namespace usbguard - void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, - IPCServer::AccessControl::Privilege privilege) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); - } - diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 6fead78..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tmpfiles-v1.patch b/tmpfiles-v1.patch deleted file mode 100644 index 21e1468..0000000 --- a/tmpfiles-v1.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 7dc6849d..2a8bfebd 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 00000000..e90908f9 ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch deleted file mode 100644 index 069ee15..0000000 --- a/tmpfiles-v2.patch +++ /dev/null @@ -1,7 +0,0 @@ -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -index e90908f9..aff00c56 100644 ---- a/usbguard-tmpfiles.conf -+++ b/usbguard-tmpfiles.conf -@@ -1 +1 @@ --d /var/log/usbguard 0700 root root - - -+d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch deleted file mode 100644 index c05d50a..0000000 --- a/uninstall-ignore-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 2a8bfebd..74a08cb7 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit - - uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service - rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service -- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) -+ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) - rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf -- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) -+ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) - - dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml - # -@@ -563,7 +563,7 @@ install-polkit-policy: - - uninstall-polkit-policy: - rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy -- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) -+ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) - - else - install-polkit-policy: -@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service - - uninstall-systemd-dbus-service: - rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service -- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) -+ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) - - else - install-systemd-dbus-service: diff --git a/usbguard.spec b/usbguard.spec index 0e68fcd..e31109c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.5 Name: usbguard -Version: 1.1.3 -Release: 7%{?dist} +Version: 1.1.4 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -39,14 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch0: tmpfiles-v1.patch -Patch1: tmpfiles-v2.patch -Patch2: uninstall-ignore-error.patch -Patch3: ipc-privileges.patch -Patch4: protobuf-3.0.patch -Patch5: catch2-support.patch -Patch6: disable-catch.patch -Patch7: selinux-bin-sbin.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,16 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} %patch -P 0 -p1 %patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 - -pushd %{name}-selinux-%{semodule_version} -%patch -P 7 -p1 popd # Remove bundled library sources before build @@ -240,6 +227,15 @@ fi %changelog +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + * Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 4678a493473ffa43f5b513724b7e86fb54fdfd85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 29 May 2026 22:38:59 +0200 Subject: [PATCH 18/22] rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e31109c..d0013cb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + * Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 - Rebase to 1.1.4 - Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, From d8c5d46563d9e227ddeff80ba2b2929e804edb7d Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 10 Jun 2026 17:01:34 -0400 Subject: [PATCH 19/22] Use openssl for crypto openssl is preferred over libgcrypt because the latter does not support FIPS or crypto policies. --- usbguard.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index d0013cb..70d0d0c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -28,7 +28,7 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static @@ -120,7 +120,7 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt \ + --with-crypto-library=openssl \ --disable-catch make %{?_smp_mflags} @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + * Fri May 29 2026 Miroslav Suchy - 1.1.4-2 - rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x From 9dc2db7571bfc681d193e2bacb78b8ce662c4118 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 21 Jun 2026 23:03:27 -0400 Subject: [PATCH 20/22] Rebuilt for openssl 4.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 70d0d0c..408a85b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + * Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 - Use openssl for crypto From d0db16e23688fe489d1b553843cc1f17c604015f Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 24 Jun 2026 06:55:37 +0100 Subject: [PATCH 21/22] Rebuilt for abseil-cpp 20260526.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 408a85b..b5c21c6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + * Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 - Rebuilt for openssl 4.0 From c3a58aca9edcba6676dcdc785129c099be1d0b08 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 08:16:04 +0000 Subject: [PATCH 22/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b5c21c6..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 - Rebuilt for abseil-cpp 20260526.0