diff --git a/.gitignore b/.gitignore index 884279b..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /usbguard-1.1.2.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch2-support.patch b/catch2-support.patch deleted file mode 100644 index 49ae059..0000000 --- a/catch2-support.patch +++ /dev/null @@ -1,281 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 1f5be3a3..617d3bcf 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -396,10 +396,15 @@ else - SAVE_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" - AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" - fi -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index e10e8456..2efbb509 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ - - test_unit_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - - test_unit_LDFLAGS=\ -@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ - - test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - -diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp -index 73b536a3..6f6e350c 100644 ---- a/src/Tests/Regression/github-PR209-config-parser.cpp -+++ b/src/Tests/Regression/github-PR209-config-parser.cpp -@@ -18,7 +18,11 @@ - // - - #include "usbguard/ConfigFile.hpp" --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - #include - #include -diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp -index f3d9b82d..24b84935 100644 ---- a/src/Tests/Regression/test_Rule_ghi113.cpp -+++ b/src/Tests/Regression/test_Rule_ghi113.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp -index 2056102d..72483bb1 100644 ---- a/src/Tests/Regression/test_Rule_ghi247.cpp -+++ b/src/Tests/Regression/test_Rule_ghi247.cpp -@@ -19,7 +19,11 @@ - #include "usbguard/Rule.hpp" - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp -index f240c8b5..df2ef637 100644 ---- a/src/Tests/Regression/test_Rule_ghi37.cpp -+++ b/src/Tests/Regression/test_Rule_ghi37.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp -index 3f87093f..113b0633 100644 ---- a/src/Tests/Unit/test_Base64.cpp -+++ b/src/Tests/Unit/test_Base64.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -index 4ed4167b..f85a4ccb 100644 ---- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp -+++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/IPCServer.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp -index cafc8cca..015ce1bc 100644 ---- a/src/Tests/Unit/test_Rule.cpp -+++ b/src/Tests/Unit/test_Rule.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp -index ddb93dec..2aff77b6 100644 ---- a/src/Tests/Unit/test_RuleAttribute_id.cpp -+++ b/src/Tests/Unit/test_RuleAttribute_id.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp -index e9bc21e2..e310de81 100644 ---- a/src/Tests/Unit/test_RuleParser.cpp -+++ b/src/Tests/Unit/test_RuleParser.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp -index 759ee2cd..cbfd554c 100644 ---- a/src/Tests/Unit/test_UEvent.cpp -+++ b/src/Tests/Unit/test_UEvent.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp -index cefbc3bd..205a6885 100644 ---- a/src/Tests/Unit/test_UEventParser.cpp -+++ b/src/Tests/Unit/test_UEventParser.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -index fbe8bbdc..4a2e9612 100644 ---- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -+++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - #include "test_UMockdevDeviceDefinition.data.hpp" -diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp -index 6d3e188f..a85fa362 100644 ---- a/src/Tests/Unit/test_Utility.cpp -+++ b/src/Tests/Unit/test_Utility.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp -index 4e3e8760..1b001998 100644 ---- a/src/Tests/main.cpp -+++ b/src/Tests/main.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#define CATCH_CONFIG_MAIN --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #define CATCH_CONFIG_MAIN -+ #include -+#endif - - /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch deleted file mode 100644 index 3a7219a..0000000 --- a/disable-catch.patch +++ /dev/null @@ -1,153 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 617d3bcf..56bbe9e3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -386,27 +386,38 @@ fi - # - # Catch C++ library - # -+AC_ARG_ENABLE([catch], -+ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], -+ [enable_catch=$enableval], [enable_catch=yes]) -+ - AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) --if test "x$with_bundled_catch" = xyes; then -- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -- catch_LIBS="" -- AC_MSG_NOTICE([Using bundled Catch library]) -- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ -+if test "x$enable_catch" = xyes; then -+ if test "x$with_bundled_catch" = xyes; then -+ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -+ catch_LIBS="" -+ AC_MSG_NOTICE([Using bundled Catch library]) -+ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ else -+ SAVE_CPPFLAGS=$CPPFLAGS -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ AC_LANG_PUSH([C++]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) -+ AC_LANG_POP -+ CPPFLAGS=$SAVE_CPPFLAGS -+ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ fi - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch_test_macros.hpp], -- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -- catch_LIBS="-lCatch2Main -lCatch2"], -- [AC_CHECK_HEADER([catch.hpp], -- [catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS=""], -- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -- )]) -- AC_LANG_POP -- CPPFLAGS=$SAVE_CPPFLAGS -- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ catch_CFLAGS="" -+ catch_LIBS="" -+ catch_summary="disabled; not checking for Catch2" - fi - AC_SUBST([catch_CFLAGS]) - AC_SUBST([catch_LIBS]) -@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) - AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) - AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) - AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) -+AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) - - CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" - CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index b84d2480..aa504bc9 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -583,7 +583,8 @@ namespace usbguard - return true; - } - -- bool isValidNameOrUID(const std::string& input) { -+ bool isValidNameOrUID(const std::string& input) -+ { - return isValidName(input) || isValidUID(input); - } - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index b75df136..555d113e 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,7 +36,7 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidNameOrUID(name)) { -+ if (!isValidNameOrUID(name)) { - throw Exception("IPC access control", "invalid name or UID format", name); - } - } -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index 2efbb509..435a4264 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ - - - TESTS=\ -- test-unit \ -- test-regression \ - USB/test-descriptor-parser.sh \ - Rules/test-rules.sh - -+if CATCH_ENABLED -+TESTS+=\ -+ test-unit \ -+ test-regression -+endif -+ - if FULL_TEST_SUITE_ENABLED - TESTS+=\ - Source/check-driver.sh \ -@@ -101,10 +105,15 @@ TESTS+=\ - - endif - --check_PROGRAMS=\ -+check_PROGRAMS= -+ -+if CATCH_ENABLED -+check_PROGRAMS+=\ - test-unit \ - test-regression -+endif - -+if CATCH_ENABLED - test_unit_SOURCES=\ - main.cpp \ - Unit/test_Rule.cpp \ -@@ -128,7 +137,9 @@ test_unit_LDADD=\ - - test_unit_LDFLAGS=\ - -static -+endif - -+if CATCH_ENABLED - test_regression_SOURCES=\ - main.cpp \ - Regression/test_Rule_ghi37.cpp \ -@@ -143,4 +154,4 @@ test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ - $(catch_LIBS) \ - $(PTHREAD_LIBS) -- -+endif -\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch deleted file mode 100644 index bf0f65d..0000000 --- a/ipc-privileges.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index aee50ce0..b84d2480 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -543,7 +543,22 @@ namespace usbguard - return rulefile_list; - } - -- bool isValidName(const std::string& name) -+ static bool isValidUID(const std::string& uid) -+ { -+ if (uid.empty()) { -+ return false; -+ } -+ -+ for (char c : uid) { -+ if (!std::isdigit(c)) { -+ return false; -+ } -+ } -+ -+ return true; -+ } -+ -+ static bool isValidName(const std::string& name) - { - const char* s = name.data(); - -@@ -568,6 +583,10 @@ namespace usbguard - return true; - } - -+ bool isValidNameOrUID(const std::string& input) { -+ return isValidName(input) || isValidUID(input); -+ } -+ - } /* namespace usbguard */ - - /* vim: set ts=2 sw=2 et */ -diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp -index d49e24dc..ac0bae4f 100644 ---- a/src/Common/Utility.hpp -+++ b/src/Common/Utility.hpp -@@ -319,12 +319,11 @@ namespace usbguard - /** - * @brief Checks whether a given name is a valid group/user name - * -- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] - * - * @param name Name to check - * @return True if given name is valid, false otherwise - */ -- bool isValidName(const std::string& name); -+ bool isValidNameOrUID(const std::string& name); - - } /* namespace usbguard */ - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index 973eb8bd..b75df136 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,8 +36,8 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidName(name)) { -- throw Exception("IPC access control", "invalid name format", name); -+ if (!isValidNameOrUID(name)) { -+ throw Exception("IPC access control", "invalid name or UID format", name); - } - } - -diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp -index ddb1d8a7..0ba6f93d 100644 ---- a/src/Library/public/usbguard/IPCServer.hpp -+++ b/src/Library/public/usbguard/IPCServer.hpp -@@ -50,9 +50,9 @@ namespace usbguard - /** - * @brief Checks whether given name is a valid access control name. - * -- * Name is a valid access control name iff: -+ * Name is a valid access control name if: - * 1. it is not longer then 32 characters -- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] -+ * 2. it is aligned with the syntax of useradd(8) - * - * @param name Name to be verified. - * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch deleted file mode 100644 index ce12d9f..0000000 --- a/protobuf-3.0.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp -index 6aa52013..452ecd41 100644 ---- a/src/Library/IPCClientPrivate.cpp -+++ b/src/Library/IPCClientPrivate.cpp -@@ -225,7 +225,7 @@ namespace usbguard - std::string payload; - message.SerializeToString(&payload); - struct qb_ipc_request_header hdr; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - struct iovec iov[2]; - iov[0].iov_base = &hdr; -diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp -index d92a1d47..a33022e2 100644 ---- a/src/Library/IPCClientPrivate.hpp -+++ b/src/Library/IPCClientPrivate.hpp -@@ -84,7 +84,7 @@ namespace usbguard - template - void registerHandler(MessageHandler::HandlerType method) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method)); - } - -diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp -index 548a7261..b976f025 100644 ---- a/src/Library/IPCServerPrivate.cpp -+++ b/src/Library/IPCServerPrivate.cpp -@@ -311,7 +311,7 @@ namespace usbguard - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr; - struct iovec iov[2]; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - iov[0].iov_base = &hdr; -@@ -555,7 +555,7 @@ namespace usbguard - std::string payload; - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr = { }; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - struct iovec iov[2]; -@@ -563,7 +563,7 @@ namespace usbguard - iov[0].iov_len = sizeof hdr; - iov[1].iov_base = (void*)payload.data(); - iov[1].iov_len = payload.size(); -- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); -+ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); - iov[0].iov_base = nullptr; - iov[1].iov_base = nullptr; - } -diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp -index 25f9ac38..3b3dcc51 100644 ---- a/src/Library/IPCServerPrivate.hpp -+++ b/src/Library/IPCServerPrivate.hpp -@@ -134,7 +134,7 @@ namespace usbguard - void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, - IPCServer::AccessControl::Privilege privilege) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); - } - diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 6fead78..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tmpfiles-v1.patch b/tmpfiles-v1.patch deleted file mode 100644 index 21e1468..0000000 --- a/tmpfiles-v1.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 7dc6849d..2a8bfebd 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 00000000..e90908f9 ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch deleted file mode 100644 index 069ee15..0000000 --- a/tmpfiles-v2.patch +++ /dev/null @@ -1,7 +0,0 @@ -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -index e90908f9..aff00c56 100644 ---- a/usbguard-tmpfiles.conf -+++ b/usbguard-tmpfiles.conf -@@ -1 +1 @@ --d /var/log/usbguard 0700 root root - - -+d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch deleted file mode 100644 index c05d50a..0000000 --- a/uninstall-ignore-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 2a8bfebd..74a08cb7 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit - - uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service - rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service -- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) -+ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) - rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf -- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) -+ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) - - dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml - # -@@ -563,7 +563,7 @@ install-polkit-policy: - - uninstall-polkit-policy: - rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy -- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) -+ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) - - else - install-polkit-policy: -@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service - - uninstall-systemd-dbus-service: - rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service -- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) -+ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) - - else - install-systemd-dbus-service: diff --git a/usbguard.spec b/usbguard.spec index 5b108c2..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,7 +3,7 @@ %define semodule_version 0.0.5 Name: usbguard -Version: 1.1.3 +Version: 1.1.4 Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later @@ -28,7 +28,7 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static @@ -39,14 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch0: tmpfiles-v1.patch -Patch1: tmpfiles-v2.patch -Patch2: uninstall-ignore-error.patch -Patch3: ipc-privileges.patch -Patch4: protobuf-3.0.patch -Patch5: catch2-support.patch -Patch6: disable-catch.patch -Patch7: selinux-bin-sbin.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,16 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} %patch -P 0 -p1 %patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 - -pushd %{name}-selinux-%{semodule_version} -%patch -P 7 -p1 popd # Remove bundled library sources before build @@ -133,7 +120,7 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt \ + --with-crypto-library=openssl \ --disable-catch make %{?_smp_mflags} @@ -240,6 +227,33 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild