diff --git a/.gitignore b/.gitignore index 4c6ae5f..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,16 @@ /usbguard-0.7.0.tar.gz /usbguard-0.7.1.tar.gz /usbguard-0.7.2.tar.gz +/usbguard-0.7.6.tar.gz +/usbguard-selinux-0.0.1.tar.gz +/usbguard-selinux-0.0.2.tar.gz +/usbguard-0.7.7.tar.gz +/usbguard-selinux-0.0.3.tar.gz +/usbguard-0.7.8.tar.gz +/usbguard-selinux-0.0.4.tar.gz +/usbguard-1.0.0.tar.gz +/usbguard-1.1.0.tar.gz +/usbguard-1.1.2.tar.gz +/usbguard-1.1.3.tar.gz +/usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 1f06437..7f52001 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 +SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..294bc61 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,13 @@ +--- +# Test to run in classic context +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + repositories: + - repo: "https://github.com/RedHat-SP-Security/tests" + dest: "tests" + fmf_filter: "component: usbguard" + required_packages: + - beakerlib-libraries diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index e9800b2..d8806a1 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -9,6 +9,19 @@ # RuleFile=/etc/usbguard/rules.conf +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFolder=/path/to/rulesfolder/ +# + +RuleFolder=/etc/usbguard/rules.d/ + + # # Implicit policy target. # @@ -171,3 +184,8 @@ AuditBackend=FileAudit # AuditFilePath=/var/log/usbguard/usbguard-audit.log +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false diff --git a/usbguard.spec b/usbguard.spec index 0b91e7d..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,19 +1,18 @@ -%global _hardened_build 1 - -%define with_gui_qt5 1 -%define with_dbus 1 +%global selinuxtype targeted +%global moduletype contrib +%define semodule_version 0.0.5 Name: usbguard -Version: 0.7.2 -Release: 3%{?dist} +Version: 1.1.4 +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy -Group: System Environment/Daemons -License: GPLv2+ +License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: usbguard-daemon.conf +Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz +Source2: usbguard-daemon.conf Requires: systemd Requires(post): systemd @@ -22,31 +21,26 @@ Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) +Obsoletes: %{name}-applet-qt < 0.7.6 + +BuildRequires: make +BuildRequires: gcc +BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion -BuildRequires: asciidoctor +BuildRequires: asciidoc BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -%if 0%{with_gui_qt5} -BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist -%endif - -%if 0%{with_dbus} -BuildRequires: dbus-glib-devel -BuildRequires: dbus-devel -BuildRequires: glib2-devel -BuildRequires: polkit-devel -BuildRequires: libxslt -BuildRequires: libxml2 -%endif +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -55,7 +49,6 @@ USB device attributes. %package devel Summary: Development files for %{name} -Group: Development/Libraries Requires: %{name} = %{version}-%{release} Requires: pkgconfig Requires: libstdc++-devel @@ -66,44 +59,54 @@ developing applications that use %{name}. %package tools Summary: USBGuard Tools -Group: Applications/System Requires: %{name} = %{version}-%{release} %description tools The %{name}-tools package contains optional tools from the USBGuard software framework. -%if 0%{with_gui_qt5} -### -%package applet-qt -Summary: USBGuard Qt 5.x Applet -Group: Applications/System -Requires: %{name} = %{version}-%{release} -Obsoletes: usbguard-applet-qt <= 0.3 - -%description applet-qt -The %{name}-applet-qt package contains an optional Qt 5.x desktop applet -for interacting with the USBGuard daemon component. -### -%endif - -%if 0%{with_dbus} -### +# dbus %package dbus Summary: USBGuard D-Bus Service -Group: Applications/System Requires: %{name} = %{version}-%{release} +BuildRequires: dbus-devel +BuildRequires: glib2-devel +BuildRequires: polkit-devel +BuildRequires: libxslt +BuildRequires: libxml2 Requires: dbus Requires: polkit %description dbus The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. -### -%endif +%package selinux +Summary: USBGuard selinux +Group: Applications/System +Requires: %{name} = %{version}-%{release} +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} +BuildRequires: selinux-policy-devel +BuildArch: noarch +%{?selinux_requires} + +%description selinux +The %{name}-selinux package contains selinux policy for the USBGuard +daemon. + +# usbguard %prep %setup -q + +# selinux +%setup -q -D -T -a 1 + +pushd %{name}-selinux-%{semodule_version} +%patch -P 0 -p1 +%patch -P 1 -p1 +popd + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -115,30 +118,36 @@ autoreconf -i -v --no-recursive ./ --without-bundled-catch \ --without-bundled-pegtl \ --enable-systemd \ -%if 0%{with_gui_qt5} - --with-gui-qt=qt5 \ -%endif -%if 0%{with_dbus} --with-dbus \ --with-polkit \ -%else - --without-dbus \ - --without-polkit \ -%endif - --with-crypto-library=gcrypt + --with-crypto-library=openssl \ + --disable-catch make %{?_smp_mflags} -%check -make check +# selinux +pushd %{name}-selinux-%{semodule_version} +make +popd + +# selinux +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} %install make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d -install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf + +# selinux +install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if # Cleanup find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' @@ -147,15 +156,14 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %systemd_preun usbguard.service %post -/sbin/ldconfig +%{?ldconfig} %systemd_post usbguard.service %postun -/sbin/ldconfig +%{?ldconfig} %systemd_postun usbguard.service %files -%defattr(-,root,root,-) %doc README.adoc CHANGELOG.md %license LICENSE %{_libdir}/*.so.* @@ -163,6 +171,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_bindir}/usbguard %dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard +%dir %{_sysconfdir}/usbguard/rules.d/ %dir %{_sysconfdir}/usbguard/IPCAccessControl.d %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf @@ -172,36 +181,22 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel -%defattr(-,root,root,-) %{_includedir}/* %{_libdir}/*.so %{_libdir}/pkgconfig/*.pc %files tools -%defattr(-,root,root,-) %{_bindir}/usbguard-rule-parser -%if 0%{with_gui_qt5} -### -%files applet-qt -%defattr(-,root,root,-) -%{_bindir}/usbguard-applet-qt -%{_mandir}/man1/usbguard-applet-qt.1.gz -%{_datadir}/applications/usbguard-applet-qt.desktop -%{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg -### -%endif - -%if 0%{with_dbus} -### +# dbus %files dbus -%defattr(-,root,root,-) %{_sbindir}/usbguard-dbus -%{_datadir}/dbus-1/system-services/org.usbguard.service -%{_datadir}/dbus-1/system.d/org.usbguard.conf -%{_datadir}/polkit-1/actions/org.usbguard.policy +%{_datadir}/dbus-1/system-services/org.usbguard1.service +%{_datadir}/dbus-1/system.d/org.usbguard1.conf +%{_datadir}/polkit-1/actions/org.usbguard1.policy %{_unitdir}/usbguard-dbus.service %{_mandir}/man8/usbguard-dbus.8.gz @@ -213,10 +208,220 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service -### -%endif + +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} +fi + +%posttrans selinux +%selinux_relabel_post -s %{selinuxtype} + %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 +- Rebase to 1.1.3 +Resolves: rhbz#2290724 +- selinux package policy update +Resolves: rhbz#2271330 + +* Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 +- Rebase to 1.1.2 +Resolves: rhbz#2064543 + +* Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed May 10 2023 Tomas Popela - 1.1.0-7 +- Drop BR on dbus-glib as the requirement was dropped in 0.7.7 + +* Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 +- Rebuild +Resolves: rhbz#2171749 + +* Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Mar 29 2022 Radovan Sroka - 1.1.0-3 +- usbguard requires selinux subpackage +- this ensures that the selinux package and all its dependencies are + not pulled into containers and other systems that do not use SELinux + +* Tue Mar 15 2022 Radovan Sroka - 1.1.0-2 +- selinux: allow policykit dbus comunnication +- restore support for access control filenames without a group + +* Thu Mar 03 2022 Radovan Sroka - 1.1.0-1 +- rebase to 1.1.0 +Resolves: rhbz#2058450 +- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus +Resolves: rhbz#2058466 + +* Sat Jan 22 2022 Fedora Release Engineering - 1.0.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sat Nov 06 2021 Adrian Reber - 1.0.0-8 +- Rebuilt for protobuf 3.19.0 + +* Mon Oct 25 2021 Adrian Reber - 1.0.0-7 +- Rebuilt for protobuf 3.18.1 + +* Fri Jul 23 2021 Fedora Release Engineering - 1.0.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Wed Mar 31 2021 Jonathan Wakely - 1.0.0-5 +- Rebuilt for removed libstdc++ symbols (#1937698) + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.0-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Wed Jan 27 2021 Fedora Release Engineering - 1.0.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Sat Jan 16 12:49:32 CET 2021 Adrian Reber - 1.0.0-2 +- Rebuilt for protobuf 3.14 + +* Thu Jan 14 2021 Zoltan Fridrich - 1.0.0-1 +- rebase usbguard to 1.0.0 +- added support for rules covering combination of classes +- fix usbguard being killed +Resolves: rhbz#1916039 +Resolves: rhbz#1861330 +Resolves: rhbz#1905257 + +* Wed Jan 13 14:43:57 CET 2021 Adrian Reber - 0.7.8-6 +- Rebuilt for protobuf 3.14 + +* Thu Sep 24 2020 Adrian Reber - 0.7.8-5 +- Rebuilt for protobuf 3.13 + +* Wed Jul 29 2020 Fedora Release Engineering - 0.7.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jun 24 2020 Radovan Sroka - 0.7.8-3 +- rebase selinux tarball to v0.0.4 +- enable forking style in unit file +- set DevicePolicy to closed in unit file +- usbguard prevented from writing conf via dontaudit rule +Resolves: rhbz#1804713 +Resolves: rhbz#1789923 + +* Sun Jun 14 2020 Adrian Reber - 0.7.8-2 +- Rebuilt for protobuf 3.12 + +* Tue May 19 2020 Radovan Sroka - 0.7.8-1 +- rebase usbguard to 0.7.8 +- rebase usbguard-selinux to 0.0.3 +- added rules.d/ directory +Resolves: rhbz#1808527 + +* Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Thu Dec 19 2019 Orion Poplawski - 0.7.6-7 +- Rebuild for protobuf 3.11 + +* Wed Dec 18 2019 Radovan Sroka - 0.7.6-6 +- fix selinux problems + +* Mon Dec 02 2019 Radovan Sroka - 0.7.6-5 +- obsolete applet-qt subpackage + +* Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 +- added patch for libqb related permission issues + resolves: rhbz#1776357 +- added patch to ensure that usbguard-daemons is still running after locked screen + resolves: rhbz#1751861 +- added patch to fix permanent device policy changes + +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-3 +- fixed typo in specfile +- usbguard.conf was generated incorrectly + +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-2 +- added selinux subpackage + +* Mon Nov 11 2019 Radovan Sroka - 0.7.6-1 +- rebase to 0.7.6 +- removed usbguard-applet subpackage which is not in upstream anymore + +* Sat Jul 27 2019 Fedora Release Engineering - 0.7.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Feb 03 2019 Fedora Release Engineering - 0.7.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Wed Nov 21 2018 Igor Gnatenko - 0.7.2-6 +- Rebuild for protobuf 3.6 + +* Sat Jul 14 2018 Fedora Release Engineering - 0.7.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Thu Apr 05 2018 Daniel Kopeček - 0.7.2-4 +- Update to latest PEGTL API + * Fri Feb 09 2018 Fedora Release Engineering - 0.7.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild