From f1ffa2655608f13954d0b87cda19107e572253d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 13:55:52 +0000 Subject: [PATCH 01/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index da720a7..94ebf10 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 5d01f96eab2bb003f1c35319396205bc43b4971b Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 6 Feb 2025 09:31:12 +0100 Subject: [PATCH 02/11] Add usbguard-tmpfles.conf --- tmpfiles.patch | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ usbguard.spec | 8 ++++++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 tmpfiles.patch diff --git a/tmpfiles.patch b/tmpfiles.patch new file mode 100644 index 0000000..4eb6b0f --- /dev/null +++ b/tmpfiles.patch @@ -0,0 +1,58 @@ +From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Thu, 6 Feb 2025 08:00:59 +0100 +Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= + =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= + =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= + =?UTF-8?q?y.?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +--- + Makefile.am | 13 +++++++++++-- + usbguard-tmpfiles.conf | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + create mode 100644 usbguard-tmpfiles.conf + +diff --git a/Makefile.am b/Makefile.am +index 7dc6849..2a8bfeb 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc + $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ + endif + +-install-data-hook: install-daemon-conf install-systemd-service install-data-dbus +-uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus ++install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles ++uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles + + CLEANFILES+=\ + $(top_builddir)/usbguard-daemon.conf +@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard + + distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print + ++EXTRA_DIST+=usbguard-tmpfiles.conf ++ ++install-tmpfiles: ++ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ ++ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ ++uninstall-tmpfiles: ++ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ + install-daemon-conf: $(top_builddir)/usbguard-daemon.conf + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +new file mode 100644 +index 0000000..e90908f +--- /dev/null ++++ b/usbguard-tmpfiles.conf +@@ -0,0 +1 @@ ++d /var/log/usbguard 0700 root root - - +-- +2.48.1 + diff --git a/usbguard.spec b/usbguard.spec index 94ebf10..aac3acd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -41,6 +41,7 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch +Patch2: tmpfiles.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,6 +104,7 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .tmpfiles # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -180,6 +182,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel %{_includedir}/* @@ -225,6 +228,9 @@ fi %changelog +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + * Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 4125b6a0ad5aefa12690edd2deacb65c36a99a3c Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 24 Apr 2025 10:12:16 +0200 Subject: [PATCH 03/11] Fix usbguard-tmpfiles.conf Remove catch1 dependency Adapt for protobuf api changes Fix regression in specifying IPC privileges using UID selinux subpackage update: unified bin and sbin Resolves: rhbz#2297169 --- catch2-support.patch | 281 ++++++++++++++++++++++++++++ disable-catch.patch | 153 +++++++++++++++ ipc-privileges.patch | 88 +++++++++ protobuf-3.0.patch | 70 +++++++ selinux-bin-sbin.patch | 14 ++ tmpfiles.patch => tmpfiles-v1.patch | 24 +-- tmpfiles-v2.patch | 7 + uninstall-ignore-error.patch | 34 ++++ usbguard-revert-catch.patch | 17 -- usbguard.spec | 40 +++- 10 files changed, 679 insertions(+), 49 deletions(-) create mode 100644 catch2-support.patch create mode 100644 disable-catch.patch create mode 100644 ipc-privileges.patch create mode 100644 protobuf-3.0.patch create mode 100644 selinux-bin-sbin.patch rename tmpfiles.patch => tmpfiles-v1.patch (66%) create mode 100644 tmpfiles-v2.patch create mode 100644 uninstall-ignore-error.patch delete mode 100644 usbguard-revert-catch.patch diff --git a/catch2-support.patch b/catch2-support.patch new file mode 100644 index 0000000..49ae059 --- /dev/null +++ b/catch2-support.patch @@ -0,0 +1,281 @@ +diff --git a/configure.ac b/configure.ac +index 1f5be3a3..617d3bcf 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -396,10 +396,15 @@ else + SAVE_CPPFLAGS=$CPPFLAGS + CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" + AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" + fi +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index e10e8456..2efbb509 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ + + test_unit_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + + test_unit_LDFLAGS=\ +@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ + + test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + +diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp +index 73b536a3..6f6e350c 100644 +--- a/src/Tests/Regression/github-PR209-config-parser.cpp ++++ b/src/Tests/Regression/github-PR209-config-parser.cpp +@@ -18,7 +18,11 @@ + // + + #include "usbguard/ConfigFile.hpp" +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + #include + #include +diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp +index f3d9b82d..24b84935 100644 +--- a/src/Tests/Regression/test_Rule_ghi113.cpp ++++ b/src/Tests/Regression/test_Rule_ghi113.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp +index 2056102d..72483bb1 100644 +--- a/src/Tests/Regression/test_Rule_ghi247.cpp ++++ b/src/Tests/Regression/test_Rule_ghi247.cpp +@@ -19,7 +19,11 @@ + #include "usbguard/Rule.hpp" + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp +index f240c8b5..df2ef637 100644 +--- a/src/Tests/Regression/test_Rule_ghi37.cpp ++++ b/src/Tests/Regression/test_Rule_ghi37.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp +index 3f87093f..113b0633 100644 +--- a/src/Tests/Unit/test_Base64.cpp ++++ b/src/Tests/Unit/test_Base64.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +index 4ed4167b..f85a4ccb 100644 +--- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp ++++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/IPCServer.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp +index cafc8cca..015ce1bc 100644 +--- a/src/Tests/Unit/test_Rule.cpp ++++ b/src/Tests/Unit/test_Rule.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp +index ddb93dec..2aff77b6 100644 +--- a/src/Tests/Unit/test_RuleAttribute_id.cpp ++++ b/src/Tests/Unit/test_RuleAttribute_id.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp +index e9bc21e2..e310de81 100644 +--- a/src/Tests/Unit/test_RuleParser.cpp ++++ b/src/Tests/Unit/test_RuleParser.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp +index 759ee2cd..cbfd554c 100644 +--- a/src/Tests/Unit/test_UEvent.cpp ++++ b/src/Tests/Unit/test_UEvent.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp +index cefbc3bd..205a6885 100644 +--- a/src/Tests/Unit/test_UEventParser.cpp ++++ b/src/Tests/Unit/test_UEventParser.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +index fbe8bbdc..4a2e9612 100644 +--- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp ++++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + #include "test_UMockdevDeviceDefinition.data.hpp" +diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp +index 6d3e188f..a85fa362 100644 +--- a/src/Tests/Unit/test_Utility.cpp ++++ b/src/Tests/Unit/test_Utility.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp +index 4e3e8760..1b001998 100644 +--- a/src/Tests/main.cpp ++++ b/src/Tests/main.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#define CATCH_CONFIG_MAIN +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #define CATCH_CONFIG_MAIN ++ #include ++#endif + + /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch new file mode 100644 index 0000000..3a7219a --- /dev/null +++ b/disable-catch.patch @@ -0,0 +1,153 @@ +diff --git a/configure.ac b/configure.ac +index 617d3bcf..56bbe9e3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -386,27 +386,38 @@ fi + # + # Catch C++ library + # ++AC_ARG_ENABLE([catch], ++ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], ++ [enable_catch=$enableval], [enable_catch=yes]) ++ + AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) +-if test "x$with_bundled_catch" = xyes; then +- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" +- catch_LIBS="" +- AC_MSG_NOTICE([Using bundled Catch library]) +- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ ++if test "x$enable_catch" = xyes; then ++ if test "x$with_bundled_catch" = xyes; then ++ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" ++ catch_LIBS="" ++ AC_MSG_NOTICE([Using bundled Catch library]) ++ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ else ++ SAVE_CPPFLAGS=$CPPFLAGS ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ AC_LANG_PUSH([C++]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) ++ AC_LANG_POP ++ CPPFLAGS=$SAVE_CPPFLAGS ++ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ fi + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch_test_macros.hpp], +- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" +- catch_LIBS="-lCatch2Main -lCatch2"], +- [AC_CHECK_HEADER([catch.hpp], +- [catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS=""], +- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] +- )]) +- AC_LANG_POP +- CPPFLAGS=$SAVE_CPPFLAGS +- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ catch_CFLAGS="" ++ catch_LIBS="" ++ catch_summary="disabled; not checking for Catch2" + fi + AC_SUBST([catch_CFLAGS]) + AC_SUBST([catch_LIBS]) +@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) + AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) + AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) + AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) ++AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) + + CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" + CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index b84d2480..aa504bc9 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -583,7 +583,8 @@ namespace usbguard + return true; + } + +- bool isValidNameOrUID(const std::string& input) { ++ bool isValidNameOrUID(const std::string& input) ++ { + return isValidName(input) || isValidUID(input); + } + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index b75df136..555d113e 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,7 +36,7 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidNameOrUID(name)) { ++ if (!isValidNameOrUID(name)) { + throw Exception("IPC access control", "invalid name or UID format", name); + } + } +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index 2efbb509..435a4264 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ + + + TESTS=\ +- test-unit \ +- test-regression \ + USB/test-descriptor-parser.sh \ + Rules/test-rules.sh + ++if CATCH_ENABLED ++TESTS+=\ ++ test-unit \ ++ test-regression ++endif ++ + if FULL_TEST_SUITE_ENABLED + TESTS+=\ + Source/check-driver.sh \ +@@ -101,10 +105,15 @@ TESTS+=\ + + endif + +-check_PROGRAMS=\ ++check_PROGRAMS= ++ ++if CATCH_ENABLED ++check_PROGRAMS+=\ + test-unit \ + test-regression ++endif + ++if CATCH_ENABLED + test_unit_SOURCES=\ + main.cpp \ + Unit/test_Rule.cpp \ +@@ -128,7 +137,9 @@ test_unit_LDADD=\ + + test_unit_LDFLAGS=\ + -static ++endif + ++if CATCH_ENABLED + test_regression_SOURCES=\ + main.cpp \ + Regression/test_Rule_ghi37.cpp \ +@@ -143,4 +154,4 @@ test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ + $(catch_LIBS) \ + $(PTHREAD_LIBS) +- ++endif +\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch new file mode 100644 index 0000000..bf0f65d --- /dev/null +++ b/ipc-privileges.patch @@ -0,0 +1,88 @@ +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index aee50ce0..b84d2480 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -543,7 +543,22 @@ namespace usbguard + return rulefile_list; + } + +- bool isValidName(const std::string& name) ++ static bool isValidUID(const std::string& uid) ++ { ++ if (uid.empty()) { ++ return false; ++ } ++ ++ for (char c : uid) { ++ if (!std::isdigit(c)) { ++ return false; ++ } ++ } ++ ++ return true; ++ } ++ ++ static bool isValidName(const std::string& name) + { + const char* s = name.data(); + +@@ -568,6 +583,10 @@ namespace usbguard + return true; + } + ++ bool isValidNameOrUID(const std::string& input) { ++ return isValidName(input) || isValidUID(input); ++ } ++ + } /* namespace usbguard */ + + /* vim: set ts=2 sw=2 et */ +diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp +index d49e24dc..ac0bae4f 100644 +--- a/src/Common/Utility.hpp ++++ b/src/Common/Utility.hpp +@@ -319,12 +319,11 @@ namespace usbguard + /** + * @brief Checks whether a given name is a valid group/user name + * +- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] + * + * @param name Name to check + * @return True if given name is valid, false otherwise + */ +- bool isValidName(const std::string& name); ++ bool isValidNameOrUID(const std::string& name); + + } /* namespace usbguard */ + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index 973eb8bd..b75df136 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,8 +36,8 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidName(name)) { +- throw Exception("IPC access control", "invalid name format", name); ++ if (!isValidNameOrUID(name)) { ++ throw Exception("IPC access control", "invalid name or UID format", name); + } + } + +diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp +index ddb1d8a7..0ba6f93d 100644 +--- a/src/Library/public/usbguard/IPCServer.hpp ++++ b/src/Library/public/usbguard/IPCServer.hpp +@@ -50,9 +50,9 @@ namespace usbguard + /** + * @brief Checks whether given name is a valid access control name. + * +- * Name is a valid access control name iff: ++ * Name is a valid access control name if: + * 1. it is not longer then 32 characters +- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] ++ * 2. it is aligned with the syntax of useradd(8) + * + * @param name Name to be verified. + * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch new file mode 100644 index 0000000..ce12d9f --- /dev/null +++ b/protobuf-3.0.patch @@ -0,0 +1,70 @@ +diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp +index 6aa52013..452ecd41 100644 +--- a/src/Library/IPCClientPrivate.cpp ++++ b/src/Library/IPCClientPrivate.cpp +@@ -225,7 +225,7 @@ namespace usbguard + std::string payload; + message.SerializeToString(&payload); + struct qb_ipc_request_header hdr; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + struct iovec iov[2]; + iov[0].iov_base = &hdr; +diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp +index d92a1d47..a33022e2 100644 +--- a/src/Library/IPCClientPrivate.hpp ++++ b/src/Library/IPCClientPrivate.hpp +@@ -84,7 +84,7 @@ namespace usbguard + template + void registerHandler(MessageHandler::HandlerType method) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method)); + } + +diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp +index 548a7261..b976f025 100644 +--- a/src/Library/IPCServerPrivate.cpp ++++ b/src/Library/IPCServerPrivate.cpp +@@ -311,7 +311,7 @@ namespace usbguard + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr; + struct iovec iov[2]; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + iov[0].iov_base = &hdr; +@@ -555,7 +555,7 @@ namespace usbguard + std::string payload; + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr = { }; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + struct iovec iov[2]; +@@ -563,7 +563,7 @@ namespace usbguard + iov[0].iov_len = sizeof hdr; + iov[1].iov_base = (void*)payload.data(); + iov[1].iov_len = payload.size(); +- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); ++ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); + iov[0].iov_base = nullptr; + iov[1].iov_base = nullptr; + } +diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp +index 25f9ac38..3b3dcc51 100644 +--- a/src/Library/IPCServerPrivate.hpp ++++ b/src/Library/IPCServerPrivate.hpp +@@ -134,7 +134,7 @@ namespace usbguard + void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, + IPCServer::AccessControl::Privilege privilege) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); + } + diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/tmpfiles.patch b/tmpfiles-v1.patch similarity index 66% rename from tmpfiles.patch rename to tmpfiles-v1.patch index 4eb6b0f..21e1468 100644 --- a/tmpfiles.patch +++ b/tmpfiles-v1.patch @@ -1,22 +1,5 @@ -From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 -From: Cropi -Date: Thu, 6 Feb 2025 08:00:59 +0100 -Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= - =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= - =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= - =?UTF-8?q?y.?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - ---- - Makefile.am | 13 +++++++++++-- - usbguard-tmpfiles.conf | 1 + - 2 files changed, 12 insertions(+), 2 deletions(-) - create mode 100644 usbguard-tmpfiles.conf - diff --git a/Makefile.am b/Makefile.am -index 7dc6849..2a8bfeb 100644 +index 7dc6849d..2a8bfebd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc @@ -48,11 +31,8 @@ index 7dc6849..2a8bfeb 100644 $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf new file mode 100644 -index 0000000..e90908f +index 00000000..e90908f9 --- /dev/null +++ b/usbguard-tmpfiles.conf @@ -0,0 +1 @@ +d /var/log/usbguard 0700 root root - - --- -2.48.1 - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch new file mode 100644 index 0000000..069ee15 --- /dev/null +++ b/tmpfiles-v2.patch @@ -0,0 +1,7 @@ +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +index e90908f9..aff00c56 100644 +--- a/usbguard-tmpfiles.conf ++++ b/usbguard-tmpfiles.conf +@@ -1 +1 @@ +-d /var/log/usbguard 0700 root root - - ++d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch new file mode 100644 index 0000000..c05d50a --- /dev/null +++ b/uninstall-ignore-error.patch @@ -0,0 +1,34 @@ +diff --git a/Makefile.am b/Makefile.am +index 2a8bfebd..74a08cb7 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit + + uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service + rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service +- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) ++ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) + rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf +- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) ++ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) + + dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml + # +@@ -563,7 +563,7 @@ install-polkit-policy: + + uninstall-polkit-policy: + rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy +- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) ++ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) + + else + install-polkit-policy: +@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service + + uninstall-systemd-dbus-service: + rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service +- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) ++ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) + + else + install-systemd-dbus-service: diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index aac3acd..c65991c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -32,7 +32,6 @@ BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoc @@ -40,8 +39,14 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch -Patch2: tmpfiles.patch +Patch0: tmpfiles-v1.patch +Patch1: tmpfiles-v2.patch +Patch2: uninstall-ignore-error.patch +Patch3: ipc-privileges.patch +Patch4: protobuf-3.0.patch +Patch5: catch2-support.patch +Patch6: disable-catch.patch +Patch7: selinux-bin-sbin.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,8 +108,17 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .tmpfiles +%patch -P 0 -p1 +%patch -P 1 -p1 +%patch -P 2 -p1 +%patch -P 3 -p1 +%patch -P 4 -p1 +%patch -P 5 -p1 +%patch -P 6 -p1 + +pushd %{name}-selinux-%{semodule_version} +%patch -P 7 -p1 +popd # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -119,7 +133,8 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --disable-catch make %{?_smp_mflags} @@ -128,9 +143,6 @@ pushd %{name}-selinux-%{semodule_version} make popd -%check -make check - # selinux %pre selinux %selinux_relabel_pre -s %{selinuxtype} @@ -228,6 +240,14 @@ fi %changelog +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + * Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 - Install usbguard-tmpfles.conf From 1da2d8dacd5f9bb2eb88b34901c8afe0d8b89a51 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 19:52:18 +0000 Subject: [PATCH 04/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c65991c..5b108c2 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 - Fix usbguard-tmpfiles.conf - Remove catch1 dependency From 7f57f2807aee176da5e4c7a030726cde72e5aa0f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 19:41:27 +0000 Subject: [PATCH 05/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 5b108c2..0e68fcd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From f7c30b9e6b99a9f17c77357b056f0c9061a1c834 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 15 Apr 2026 09:53:56 +0200 Subject: [PATCH 06/11] Rebase usbguard to 1.1.4 Rebased from 1.1.3 to 1.1.4. Dropped patches merged upstream: - tmpfiles-v1.patch - tmpfiles-v2.patch - uninstall-ignore-error.patch - ipc-privileges.patch - protobuf-3.0.patch - catch2-support.patch - disable-catch.patch Added selinux-homed.patch for systemd-homed stream connect. Resolves: rhbz#2380396 Resolves: rhbz#2376283 --- .gitignore | 1 + catch2-support.patch | 281 ----------------------------------- disable-catch.patch | 153 ------------------- ipc-privileges.patch | 88 ----------- protobuf-3.0.patch | 70 --------- selinux-homed.patch | 14 ++ sources | 2 +- tmpfiles-v1.patch | 38 ----- tmpfiles-v2.patch | 7 - uninstall-ignore-error.patch | 34 ----- usbguard.spec | 32 ++-- 11 files changed, 30 insertions(+), 690 deletions(-) delete mode 100644 catch2-support.patch delete mode 100644 disable-catch.patch delete mode 100644 ipc-privileges.patch delete mode 100644 protobuf-3.0.patch create mode 100644 selinux-homed.patch delete mode 100644 tmpfiles-v1.patch delete mode 100644 tmpfiles-v2.patch delete mode 100644 uninstall-ignore-error.patch diff --git a/.gitignore b/.gitignore index 884279b..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /usbguard-1.1.2.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch2-support.patch b/catch2-support.patch deleted file mode 100644 index 49ae059..0000000 --- a/catch2-support.patch +++ /dev/null @@ -1,281 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 1f5be3a3..617d3bcf 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -396,10 +396,15 @@ else - SAVE_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" - AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" - fi -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index e10e8456..2efbb509 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ - - test_unit_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - - test_unit_LDFLAGS=\ -@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ - - test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - -diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp -index 73b536a3..6f6e350c 100644 ---- a/src/Tests/Regression/github-PR209-config-parser.cpp -+++ b/src/Tests/Regression/github-PR209-config-parser.cpp -@@ -18,7 +18,11 @@ - // - - #include "usbguard/ConfigFile.hpp" --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - #include - #include -diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp -index f3d9b82d..24b84935 100644 ---- a/src/Tests/Regression/test_Rule_ghi113.cpp -+++ b/src/Tests/Regression/test_Rule_ghi113.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp -index 2056102d..72483bb1 100644 ---- a/src/Tests/Regression/test_Rule_ghi247.cpp -+++ b/src/Tests/Regression/test_Rule_ghi247.cpp -@@ -19,7 +19,11 @@ - #include "usbguard/Rule.hpp" - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp -index f240c8b5..df2ef637 100644 ---- a/src/Tests/Regression/test_Rule_ghi37.cpp -+++ b/src/Tests/Regression/test_Rule_ghi37.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp -index 3f87093f..113b0633 100644 ---- a/src/Tests/Unit/test_Base64.cpp -+++ b/src/Tests/Unit/test_Base64.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -index 4ed4167b..f85a4ccb 100644 ---- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp -+++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/IPCServer.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp -index cafc8cca..015ce1bc 100644 ---- a/src/Tests/Unit/test_Rule.cpp -+++ b/src/Tests/Unit/test_Rule.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp -index ddb93dec..2aff77b6 100644 ---- a/src/Tests/Unit/test_RuleAttribute_id.cpp -+++ b/src/Tests/Unit/test_RuleAttribute_id.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp -index e9bc21e2..e310de81 100644 ---- a/src/Tests/Unit/test_RuleParser.cpp -+++ b/src/Tests/Unit/test_RuleParser.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp -index 759ee2cd..cbfd554c 100644 ---- a/src/Tests/Unit/test_UEvent.cpp -+++ b/src/Tests/Unit/test_UEvent.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp -index cefbc3bd..205a6885 100644 ---- a/src/Tests/Unit/test_UEventParser.cpp -+++ b/src/Tests/Unit/test_UEventParser.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -index fbe8bbdc..4a2e9612 100644 ---- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -+++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - #include "test_UMockdevDeviceDefinition.data.hpp" -diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp -index 6d3e188f..a85fa362 100644 ---- a/src/Tests/Unit/test_Utility.cpp -+++ b/src/Tests/Unit/test_Utility.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp -index 4e3e8760..1b001998 100644 ---- a/src/Tests/main.cpp -+++ b/src/Tests/main.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#define CATCH_CONFIG_MAIN --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #define CATCH_CONFIG_MAIN -+ #include -+#endif - - /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch deleted file mode 100644 index 3a7219a..0000000 --- a/disable-catch.patch +++ /dev/null @@ -1,153 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 617d3bcf..56bbe9e3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -386,27 +386,38 @@ fi - # - # Catch C++ library - # -+AC_ARG_ENABLE([catch], -+ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], -+ [enable_catch=$enableval], [enable_catch=yes]) -+ - AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) --if test "x$with_bundled_catch" = xyes; then -- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -- catch_LIBS="" -- AC_MSG_NOTICE([Using bundled Catch library]) -- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ -+if test "x$enable_catch" = xyes; then -+ if test "x$with_bundled_catch" = xyes; then -+ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -+ catch_LIBS="" -+ AC_MSG_NOTICE([Using bundled Catch library]) -+ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ else -+ SAVE_CPPFLAGS=$CPPFLAGS -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ AC_LANG_PUSH([C++]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) -+ AC_LANG_POP -+ CPPFLAGS=$SAVE_CPPFLAGS -+ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ fi - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch_test_macros.hpp], -- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -- catch_LIBS="-lCatch2Main -lCatch2"], -- [AC_CHECK_HEADER([catch.hpp], -- [catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS=""], -- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -- )]) -- AC_LANG_POP -- CPPFLAGS=$SAVE_CPPFLAGS -- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ catch_CFLAGS="" -+ catch_LIBS="" -+ catch_summary="disabled; not checking for Catch2" - fi - AC_SUBST([catch_CFLAGS]) - AC_SUBST([catch_LIBS]) -@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) - AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) - AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) - AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) -+AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) - - CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" - CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index b84d2480..aa504bc9 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -583,7 +583,8 @@ namespace usbguard - return true; - } - -- bool isValidNameOrUID(const std::string& input) { -+ bool isValidNameOrUID(const std::string& input) -+ { - return isValidName(input) || isValidUID(input); - } - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index b75df136..555d113e 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,7 +36,7 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidNameOrUID(name)) { -+ if (!isValidNameOrUID(name)) { - throw Exception("IPC access control", "invalid name or UID format", name); - } - } -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index 2efbb509..435a4264 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ - - - TESTS=\ -- test-unit \ -- test-regression \ - USB/test-descriptor-parser.sh \ - Rules/test-rules.sh - -+if CATCH_ENABLED -+TESTS+=\ -+ test-unit \ -+ test-regression -+endif -+ - if FULL_TEST_SUITE_ENABLED - TESTS+=\ - Source/check-driver.sh \ -@@ -101,10 +105,15 @@ TESTS+=\ - - endif - --check_PROGRAMS=\ -+check_PROGRAMS= -+ -+if CATCH_ENABLED -+check_PROGRAMS+=\ - test-unit \ - test-regression -+endif - -+if CATCH_ENABLED - test_unit_SOURCES=\ - main.cpp \ - Unit/test_Rule.cpp \ -@@ -128,7 +137,9 @@ test_unit_LDADD=\ - - test_unit_LDFLAGS=\ - -static -+endif - -+if CATCH_ENABLED - test_regression_SOURCES=\ - main.cpp \ - Regression/test_Rule_ghi37.cpp \ -@@ -143,4 +154,4 @@ test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ - $(catch_LIBS) \ - $(PTHREAD_LIBS) -- -+endif -\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch deleted file mode 100644 index bf0f65d..0000000 --- a/ipc-privileges.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index aee50ce0..b84d2480 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -543,7 +543,22 @@ namespace usbguard - return rulefile_list; - } - -- bool isValidName(const std::string& name) -+ static bool isValidUID(const std::string& uid) -+ { -+ if (uid.empty()) { -+ return false; -+ } -+ -+ for (char c : uid) { -+ if (!std::isdigit(c)) { -+ return false; -+ } -+ } -+ -+ return true; -+ } -+ -+ static bool isValidName(const std::string& name) - { - const char* s = name.data(); - -@@ -568,6 +583,10 @@ namespace usbguard - return true; - } - -+ bool isValidNameOrUID(const std::string& input) { -+ return isValidName(input) || isValidUID(input); -+ } -+ - } /* namespace usbguard */ - - /* vim: set ts=2 sw=2 et */ -diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp -index d49e24dc..ac0bae4f 100644 ---- a/src/Common/Utility.hpp -+++ b/src/Common/Utility.hpp -@@ -319,12 +319,11 @@ namespace usbguard - /** - * @brief Checks whether a given name is a valid group/user name - * -- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] - * - * @param name Name to check - * @return True if given name is valid, false otherwise - */ -- bool isValidName(const std::string& name); -+ bool isValidNameOrUID(const std::string& name); - - } /* namespace usbguard */ - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index 973eb8bd..b75df136 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,8 +36,8 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidName(name)) { -- throw Exception("IPC access control", "invalid name format", name); -+ if (!isValidNameOrUID(name)) { -+ throw Exception("IPC access control", "invalid name or UID format", name); - } - } - -diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp -index ddb1d8a7..0ba6f93d 100644 ---- a/src/Library/public/usbguard/IPCServer.hpp -+++ b/src/Library/public/usbguard/IPCServer.hpp -@@ -50,9 +50,9 @@ namespace usbguard - /** - * @brief Checks whether given name is a valid access control name. - * -- * Name is a valid access control name iff: -+ * Name is a valid access control name if: - * 1. it is not longer then 32 characters -- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] -+ * 2. it is aligned with the syntax of useradd(8) - * - * @param name Name to be verified. - * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch deleted file mode 100644 index ce12d9f..0000000 --- a/protobuf-3.0.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp -index 6aa52013..452ecd41 100644 ---- a/src/Library/IPCClientPrivate.cpp -+++ b/src/Library/IPCClientPrivate.cpp -@@ -225,7 +225,7 @@ namespace usbguard - std::string payload; - message.SerializeToString(&payload); - struct qb_ipc_request_header hdr; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - struct iovec iov[2]; - iov[0].iov_base = &hdr; -diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp -index d92a1d47..a33022e2 100644 ---- a/src/Library/IPCClientPrivate.hpp -+++ b/src/Library/IPCClientPrivate.hpp -@@ -84,7 +84,7 @@ namespace usbguard - template - void registerHandler(MessageHandler::HandlerType method) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method)); - } - -diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp -index 548a7261..b976f025 100644 ---- a/src/Library/IPCServerPrivate.cpp -+++ b/src/Library/IPCServerPrivate.cpp -@@ -311,7 +311,7 @@ namespace usbguard - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr; - struct iovec iov[2]; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - iov[0].iov_base = &hdr; -@@ -555,7 +555,7 @@ namespace usbguard - std::string payload; - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr = { }; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - struct iovec iov[2]; -@@ -563,7 +563,7 @@ namespace usbguard - iov[0].iov_len = sizeof hdr; - iov[1].iov_base = (void*)payload.data(); - iov[1].iov_len = payload.size(); -- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); -+ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); - iov[0].iov_base = nullptr; - iov[1].iov_base = nullptr; - } -diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp -index 25f9ac38..3b3dcc51 100644 ---- a/src/Library/IPCServerPrivate.hpp -+++ b/src/Library/IPCServerPrivate.hpp -@@ -134,7 +134,7 @@ namespace usbguard - void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, - IPCServer::AccessControl::Privilege privilege) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); - } - diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 6fead78..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tmpfiles-v1.patch b/tmpfiles-v1.patch deleted file mode 100644 index 21e1468..0000000 --- a/tmpfiles-v1.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 7dc6849d..2a8bfebd 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 00000000..e90908f9 ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch deleted file mode 100644 index 069ee15..0000000 --- a/tmpfiles-v2.patch +++ /dev/null @@ -1,7 +0,0 @@ -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -index e90908f9..aff00c56 100644 ---- a/usbguard-tmpfiles.conf -+++ b/usbguard-tmpfiles.conf -@@ -1 +1 @@ --d /var/log/usbguard 0700 root root - - -+d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch deleted file mode 100644 index c05d50a..0000000 --- a/uninstall-ignore-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 2a8bfebd..74a08cb7 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit - - uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service - rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service -- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) -+ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) - rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf -- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) -+ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) - - dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml - # -@@ -563,7 +563,7 @@ install-polkit-policy: - - uninstall-polkit-policy: - rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy -- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) -+ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) - - else - install-polkit-policy: -@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service - - uninstall-systemd-dbus-service: - rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service -- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) -+ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) - - else - install-systemd-dbus-service: diff --git a/usbguard.spec b/usbguard.spec index 0e68fcd..e31109c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.5 Name: usbguard -Version: 1.1.3 -Release: 7%{?dist} +Version: 1.1.4 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -39,14 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch0: tmpfiles-v1.patch -Patch1: tmpfiles-v2.patch -Patch2: uninstall-ignore-error.patch -Patch3: ipc-privileges.patch -Patch4: protobuf-3.0.patch -Patch5: catch2-support.patch -Patch6: disable-catch.patch -Patch7: selinux-bin-sbin.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,16 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} %patch -P 0 -p1 %patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 - -pushd %{name}-selinux-%{semodule_version} -%patch -P 7 -p1 popd # Remove bundled library sources before build @@ -240,6 +227,15 @@ fi %changelog +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + * Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 4678a493473ffa43f5b513724b7e86fb54fdfd85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 29 May 2026 22:38:59 +0200 Subject: [PATCH 07/11] rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e31109c..d0013cb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + * Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 - Rebase to 1.1.4 - Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, From d8c5d46563d9e227ddeff80ba2b2929e804edb7d Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 10 Jun 2026 17:01:34 -0400 Subject: [PATCH 08/11] Use openssl for crypto openssl is preferred over libgcrypt because the latter does not support FIPS or crypto policies. --- usbguard.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index d0013cb..70d0d0c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -28,7 +28,7 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static @@ -120,7 +120,7 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt \ + --with-crypto-library=openssl \ --disable-catch make %{?_smp_mflags} @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + * Fri May 29 2026 Miroslav Suchy - 1.1.4-2 - rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x From 9dc2db7571bfc681d193e2bacb78b8ce662c4118 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 21 Jun 2026 23:03:27 -0400 Subject: [PATCH 09/11] Rebuilt for openssl 4.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 70d0d0c..408a85b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + * Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 - Use openssl for crypto From d0db16e23688fe489d1b553843cc1f17c604015f Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 24 Jun 2026 06:55:37 +0100 Subject: [PATCH 10/11] Rebuilt for abseil-cpp 20260526.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 408a85b..b5c21c6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + * Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 - Rebuilt for openssl 4.0 From c3a58aca9edcba6676dcdc785129c099be1d0b08 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 08:16:04 +0000 Subject: [PATCH 11/11] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b5c21c6..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 - Rebuilt for abseil-cpp 20260526.0