From b434466770fa865e796ea63f659e2f9bf164039a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 5 Apr 2018 13:55:14 +0200 Subject: [PATCH 01/59] Update to latest PEGTL API --- 0001-Update-to-latest-PEGTL-API.patch | 567 ++++++++++++++++++++++++++ usbguard.spec | 9 +- 2 files changed, 575 insertions(+), 1 deletion(-) create mode 100644 0001-Update-to-latest-PEGTL-API.patch diff --git a/0001-Update-to-latest-PEGTL-API.patch b/0001-Update-to-latest-PEGTL-API.patch new file mode 100644 index 0000000..1ebfd1e --- /dev/null +++ b/0001-Update-to-latest-PEGTL-API.patch @@ -0,0 +1,567 @@ +diff --git a/configure.ac b/configure.ac +index a135e01..f565b87 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -290,54 +290,28 @@ AC_SUBST([catch_LIBS]) + # + AC_ARG_WITH([bundled-pegtl], AS_HELP_STRING([--with-bundled-pegtl], [Build using the bundled PEGTL library]), [with_bundled_pegtl=$withval], [with_bundled_pegtl=no]) + if test "x$with_bundled_pegtl" = xyes; then +- pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL" +- pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL" ++ pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL/include" ++ pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL/include" + pegtl_LIBS="" + AC_MSG_NOTICE([Using bundled PEGTL library]) + pegtl_summary="bundled; $pegtl_CFLAGS $pegtl_LIBS" + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++11 $CPPFLAGS" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([pegtl.hh], [], [AC_MSG_FAILURE(pegtl.hh not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) +- AC_LANG_POP + pegtl_CFLAGS="" + pegtl_AC_CFLAGS="" + pegtl_LIBS="" +- CPPFLAGS=$SAVE_CPPFLAGS + pegtl_summary="system-wide; $pegtl_CFLAGS $pegtl_LIBS" + fi + AC_SUBST([pegtl_CFLAGS]) + AC_SUBST([pegtl_AC_CFLAGS]) + AC_SUBST([pegtl_LIBS]) + +-# +-# Check whether the available PEGTL library is compatible +-# with version 1.3.1 or older. +-# + SAVE_CPPFLAGS=$CPPFLAGS +-CPPFLAGS="-std=c++11 $pegtl_AC_CFLAGS" ++CPPFLAGS="-std=c++11 $CPPFLAGS $pegtl_AC_CFLAGS" + AC_LANG_PUSH([C++]) +-AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ +-#include +-#include +-int main(void) +-{ +- struct grammar +- : pegtl::one<'g'> {}; +- try { +- pegtl::parse_string(std::string(), std::string()); +- } catch(const pegtl::parse_error& ex) { +- auto b = ex.positions[0].byte_in_line; +- } +- return 0; +-} +-]])], +-[have_pegtl_lte_131=no], [have_pegtl_lte_131=yes]) ++AC_CHECK_HEADER([tao/pegtl.hpp], ++ [AC_DEFINE([HAVE_TAO_PEGTL_HPP], [1], [PEGTL header file with .hpp extension is present])], ++ [AC_MSG_FAILURE(PEGTL header file not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) + AC_LANG_POP +-if test "x$have_pegtl_lte_131" = xyes; then +- AC_DEFINE([HAVE_PEGTL_LTE_1_3_1], [1], [PEGTL version less than or equal to 1.3.1]) +-fi + CPPFLAGS=$SAVE_CPPFLAGS + + # +diff --git a/src/Library/RuleParser/Actions.hpp b/src/Library/RuleParser/Actions.hpp +index 3e185f4..2b21bd2 100644 +--- a/src/Library/RuleParser/Actions.hpp ++++ b/src/Library/RuleParser/Actions.hpp +@@ -24,7 +24,7 @@ + #include "Utility.hpp" + #include "Common/Utility.hpp" + +-#include ++#include + + namespace usbguard + { +@@ -47,7 +47,7 @@ namespace usbguard + struct str_if; + + template +- struct rule_parser_actions : pegtl::nothing {}; ++ struct rule_parser_actions : tao::pegtl::nothing {}; + + template<> + struct rule_parser_actions { +@@ -58,7 +58,7 @@ namespace usbguard + rule.setTarget(Rule::targetFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -75,7 +75,7 @@ namespace usbguard + rule.setDeviceID(device_id); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -87,7 +87,7 @@ namespace usbguard + } + + template +- struct name_actions : pegtl::nothing {}; ++ struct name_actions : tao::pegtl::nothing {}; + + template<> + struct name_actions { +@@ -95,7 +95,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeName().empty()) { +- throw pegtl::parse_error("name attribute already defined", in); ++ throw tao::pegtl::parse_error("name attribute already defined", in); + } + } + }; +@@ -109,7 +109,7 @@ namespace usbguard + rule.attributeName().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -123,13 +123,13 @@ namespace usbguard + rule.attributeName().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct id_actions : pegtl::nothing {}; ++ struct id_actions : tao::pegtl::nothing {}; + + template<> + struct id_actions { +@@ -137,7 +137,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeDeviceID().empty()) { +- throw pegtl::parse_error("id attribute already defined", in); ++ throw tao::pegtl::parse_error("id attribute already defined", in); + } + } + }; +@@ -154,7 +154,7 @@ namespace usbguard + rule.attributeDeviceID().append(device_id); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -168,13 +168,13 @@ namespace usbguard + rule.attributeDeviceID().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct hash_actions : pegtl::nothing {}; ++ struct hash_actions : tao::pegtl::nothing {}; + + template<> + struct hash_actions { +@@ -182,7 +182,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeHash().empty()) { +- throw pegtl::parse_error("hash attribute already defined", in); ++ throw tao::pegtl::parse_error("hash attribute already defined", in); + } + } + }; +@@ -196,7 +196,7 @@ namespace usbguard + rule.attributeHash().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -210,13 +210,13 @@ namespace usbguard + rule.attributeHash().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct parent_hash_actions : pegtl::nothing {}; ++ struct parent_hash_actions : tao::pegtl::nothing {}; + + template<> + struct parent_hash_actions { +@@ -224,7 +224,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeParentHash().empty()) { +- throw pegtl::parse_error("parent-hash attribute already defined", in); ++ throw tao::pegtl::parse_error("parent-hash attribute already defined", in); + } + } + }; +@@ -238,7 +238,7 @@ namespace usbguard + rule.attributeParentHash().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -252,13 +252,13 @@ namespace usbguard + rule.attributeParentHash().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct serial_actions : pegtl::nothing {}; ++ struct serial_actions : tao::pegtl::nothing {}; + + template<> + struct serial_actions { +@@ -266,7 +266,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeSerial().empty()) { +- throw pegtl::parse_error("serial attribute already defined", in); ++ throw tao::pegtl::parse_error("serial attribute already defined", in); + } + } + }; +@@ -280,7 +280,7 @@ namespace usbguard + rule.attributeSerial().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -294,13 +294,13 @@ namespace usbguard + rule.attributeSerial().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct via_port_actions : pegtl::nothing {}; ++ struct via_port_actions : tao::pegtl::nothing {}; + + template<> + struct via_port_actions { +@@ -308,7 +308,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeViaPort().empty()) { +- throw pegtl::parse_error("via-port attribute already defined", in); ++ throw tao::pegtl::parse_error("via-port attribute already defined", in); + } + } + }; +@@ -322,7 +322,7 @@ namespace usbguard + rule.attributeViaPort().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -336,13 +336,13 @@ namespace usbguard + rule.attributeViaPort().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct with_interface_actions : pegtl::nothing {}; ++ struct with_interface_actions : tao::pegtl::nothing {}; + + template<> + struct with_interface_actions { +@@ -350,7 +350,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeWithInterface().empty()) { +- throw pegtl::parse_error("with-interface attribute already defined", in); ++ throw tao::pegtl::parse_error("with-interface attribute already defined", in); + } + } + }; +@@ -365,7 +365,7 @@ namespace usbguard + rule.attributeWithInterface().append(interface_type); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -379,13 +379,13 @@ namespace usbguard + rule.attributeWithInterface().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct condition_actions : pegtl::nothing {}; ++ struct condition_actions : tao::pegtl::nothing {}; + + template<> + struct condition_actions { +@@ -393,7 +393,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeConditions().empty()) { +- throw pegtl::parse_error("conditions already defined", in); ++ throw tao::pegtl::parse_error("conditions already defined", in); + } + } + }; +@@ -407,7 +407,7 @@ namespace usbguard + rule.attributeConditions().append(RuleCondition(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -421,7 +421,7 @@ namespace usbguard + rule.attributeConditions().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +diff --git a/src/Library/RuleParser/Grammar.hpp b/src/Library/RuleParser/Grammar.hpp +index 9bd4a15..4d785c0 100644 +--- a/src/Library/RuleParser/Grammar.hpp ++++ b/src/Library/RuleParser/Grammar.hpp +@@ -22,37 +22,37 @@ + #endif + + #include "Actions.hpp" +-#include + +-using namespace pegtl; ++#include + + namespace usbguard + { + namespace RuleParser + { ++ using namespace tao::pegtl; + /* + * Rule language keywords + */ +- struct str_allow : pegtl_string_t("allow") {}; +- struct str_block : pegtl_string_t("block") {}; +- struct str_reject : pegtl_string_t("reject") {}; +- struct str_match : pegtl_string_t("match") {}; +- struct str_device : pegtl_string_t("device") {}; +- +- struct str_name : pegtl_string_t("name") {}; +- struct str_hash : pegtl_string_t("hash") {}; +- struct str_parent_hash : pegtl_string_t("parent-hash") {}; +- struct str_via_port : pegtl_string_t("via-port") {}; +- struct str_with_interface : pegtl_string_t("with-interface") {}; +- struct str_serial : pegtl_string_t("serial") {}; +- struct str_if : pegtl_string_t("if") {}; +- struct str_id : pegtl_string_t("id") {}; +- +- struct str_all_of : pegtl_string_t("all-of") {}; +- struct str_one_of : pegtl_string_t("one-of") {}; +- struct str_none_of : pegtl_string_t("none-of") {}; +- struct str_equals : pegtl_string_t("equals") {}; +- struct str_equals_ordered : pegtl_string_t("equals-ordered") {}; ++ struct str_allow : TAOCPP_PEGTL_STRING("allow") {}; ++ struct str_block : TAOCPP_PEGTL_STRING("block") {}; ++ struct str_reject : TAOCPP_PEGTL_STRING("reject") {}; ++ struct str_match : TAOCPP_PEGTL_STRING("match") {}; ++ struct str_device : TAOCPP_PEGTL_STRING("device") {}; ++ ++ struct str_name : TAOCPP_PEGTL_STRING("name") {}; ++ struct str_hash : TAOCPP_PEGTL_STRING("hash") {}; ++ struct str_parent_hash : TAOCPP_PEGTL_STRING("parent-hash") {}; ++ struct str_via_port : TAOCPP_PEGTL_STRING("via-port") {}; ++ struct str_with_interface : TAOCPP_PEGTL_STRING("with-interface") {}; ++ struct str_serial : TAOCPP_PEGTL_STRING("serial") {}; ++ struct str_if : TAOCPP_PEGTL_STRING("if") {}; ++ struct str_id : TAOCPP_PEGTL_STRING("id") {}; ++ ++ struct str_all_of : TAOCPP_PEGTL_STRING("all-of") {}; ++ struct str_one_of : TAOCPP_PEGTL_STRING("one-of") {}; ++ struct str_none_of : TAOCPP_PEGTL_STRING("none-of") {}; ++ struct str_equals : TAOCPP_PEGTL_STRING("equals") {}; ++ struct str_equals_ordered : TAOCPP_PEGTL_STRING("equals-ordered") {}; + + /* + * Generic rule attribute +diff --git a/src/Library/UEventParser.cpp b/src/Library/UEventParser.cpp +index 2e0ce39..aebe948 100644 +--- a/src/Library/UEventParser.cpp ++++ b/src/Library/UEventParser.cpp +@@ -27,7 +27,9 @@ + #include "usbguard/Logger.hpp" + + #include +-#include ++ ++#include ++using namespace tao; + + namespace usbguard + { +@@ -114,25 +116,14 @@ namespace usbguard + void parseUEventFromString(const std::string& uevent_string, UEvent& uevent, bool trace) + { + try { +-#if HAVE_PEGTL_LTE_1_3_1 ++ tao::pegtl::string_input<> in(uevent_string, std::string()); + + if (!trace) { +- pegtl::parse(uevent_string, std::string(), uevent); ++ tao::pegtl::parse(in, uevent); + } + else { +- pegtl::parse(uevent_string, std::string(), uevent); +- } +- +-#else +- +- if (!trace) { +- pegtl::parse_string(uevent_string, std::string(), uevent); ++ tao::pegtl::parse(in, uevent); + } +- else { +- pegtl::parse_string(uevent_string, std::string(), uevent); +- } +- +-#endif + } + catch (...) { + throw; +diff --git a/src/Library/UEventParser.hpp b/src/Library/UEventParser.hpp +index 856d5ff..4261bd5 100644 +--- a/src/Library/UEventParser.hpp ++++ b/src/Library/UEventParser.hpp +@@ -23,9 +23,7 @@ + + #include "usbguard/Typedefs.hpp" + +-#include +- +-using namespace pegtl; ++#include + + namespace usbguard + { +@@ -33,6 +31,8 @@ namespace usbguard + + namespace UEventParser + { ++ using namespace tao::pegtl; ++ + struct value + : seq, star>> {}; + +diff --git a/src/Library/public/usbguard/RuleParser.cpp b/src/Library/public/usbguard/RuleParser.cpp +index 4061e01..140bf14 100644 +--- a/src/Library/public/usbguard/RuleParser.cpp ++++ b/src/Library/public/usbguard/RuleParser.cpp +@@ -34,7 +34,7 @@ + #include + #include + +-#include ++#include + + namespace usbguard + { +@@ -42,35 +42,21 @@ namespace usbguard + { + try { + Rule rule; +-#if HAVE_PEGTL_LTE_1_3_1 ++ tao::pegtl::string_input<> input(rule_spec, file); + + if (!trace) { +- pegtl::parse(rule_spec, file, rule); ++ tao::pegtl::parse(input, rule); + } + else { +- pegtl::parse(rule_spec, file, rule); ++ tao::pegtl::parse(input, rule); + } + +-#else +- +- if (!trace) { +- pegtl::parse_string(rule_spec, file, rule); +- } +- else { +- pegtl::parse_string(rule_spec, file, rule); +- } +- +-#endif + return rule; + } +- catch (const pegtl::parse_error& ex) { ++ catch (const tao::pegtl::parse_error& ex) { + RuleParserError error(rule_spec); + error.setHint(ex.what()); +-#if HAVE_PEGTL_LTE_1_3_1 +- error.setOffset(ex.positions[0].column); +-#else + error.setOffset(ex.positions[0].byte_in_line); +-#endif + + if (!file.empty() || line != 0) { + error.setFileInfo(file, line); +-- +2.13.6 + diff --git a/usbguard.spec b/usbguard.spec index 0b91e7d..26f7dae 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -15,6 +15,8 @@ URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf +Patch0: 0001-Update-to-latest-PEGTL-API.patch + Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -104,6 +106,8 @@ a D-Bus interface to the USBGuard daemon component. %prep %setup -q +%patch0 -p1 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -217,6 +221,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Thu Apr 05 2018 Daniel Kopeček - 0.7.2-4 +- Update to latest PEGTL API + * Fri Feb 09 2018 Fedora Release Engineering - 0.7.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 2eb0a0111d0638f5957e4eaa0d14b7e6576c102c Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 01:43:21 -0500 Subject: [PATCH 02/59] Remove needless use of %defattr --- usbguard.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 26f7dae..75c623a 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -159,7 +159,6 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %systemd_postun usbguard.service %files -%defattr(-,root,root,-) %doc README.adoc CHANGELOG.md %license LICENSE %{_libdir}/*.so.* @@ -178,19 +177,16 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/bash-completion/completions/usbguard %files devel -%defattr(-,root,root,-) %{_includedir}/* %{_libdir}/*.so %{_libdir}/pkgconfig/*.pc %files tools -%defattr(-,root,root,-) %{_bindir}/usbguard-rule-parser %if 0%{with_gui_qt5} ### %files applet-qt -%defattr(-,root,root,-) %{_bindir}/usbguard-applet-qt %{_mandir}/man1/usbguard-applet-qt.1.gz %{_datadir}/applications/usbguard-applet-qt.desktop @@ -201,7 +197,6 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %if 0%{with_dbus} ### %files dbus -%defattr(-,root,root,-) %{_sbindir}/usbguard-dbus %{_datadir}/dbus-1/system-services/org.usbguard.service %{_datadir}/dbus-1/system.d/org.usbguard.conf From 2604785c2cd1cb037f4ec55aa95f5e381d22ae6a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 08:19:54 +0000 Subject: [PATCH 03/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 75c623a..028730b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -216,6 +216,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 0.7.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Thu Apr 05 2018 Daniel Kopeček - 0.7.2-4 - Update to latest PEGTL API From 98fe17828670c77ff191529209b159d89dd8989b Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 21 Nov 2018 17:16:20 +0100 Subject: [PATCH 04/59] Rebuild for protobuf 3.6 Signed-off-by: Igor Gnatenko --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 028730b..a367f6b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -216,6 +216,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Wed Nov 21 2018 Igor Gnatenko - 0.7.2-6 +- Rebuild for protobuf 3.6 + * Sat Jul 14 2018 Fedora Release Engineering - 0.7.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 7cccf00f6e42f7a3fa6790864a0cef86f190ec4d Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Tue, 22 Jan 2019 18:41:15 +0100 Subject: [PATCH 05/59] Remove obsolete ldconfig scriptlets References: https://fedoraproject.org/wiki/Changes/RemoveObsoleteScriptlets Signed-off-by: Igor Gnatenko --- usbguard.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index a367f6b..4eb2f64 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -151,11 +151,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %systemd_preun usbguard.service %post -/sbin/ldconfig +%{?ldconfig} %systemd_post usbguard.service %postun -/sbin/ldconfig +%{?ldconfig} %systemd_postun usbguard.service %files From 03d834279c6d9663a91a58c7f2e71251b52584f0 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:18:29 +0100 Subject: [PATCH 06/59] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- usbguard.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 4eb2f64..c283a6e 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -7,7 +7,6 @@ Name: usbguard Version: 0.7.2 Release: 6%{?dist} Summary: A tool for implementing USB device usage policy -Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 @@ -57,7 +56,6 @@ USB device attributes. %package devel Summary: Development files for %{name} -Group: Development/Libraries Requires: %{name} = %{version}-%{release} Requires: pkgconfig Requires: libstdc++-devel @@ -68,7 +66,6 @@ developing applications that use %{name}. %package tools Summary: USBGuard Tools -Group: Applications/System Requires: %{name} = %{version}-%{release} %description tools @@ -79,7 +76,6 @@ software framework. ### %package applet-qt Summary: USBGuard Qt 5.x Applet -Group: Applications/System Requires: %{name} = %{version}-%{release} Obsoletes: usbguard-applet-qt <= 0.3 @@ -93,7 +89,6 @@ for interacting with the USBGuard daemon component. ### %package dbus Summary: USBGuard D-Bus Service -Group: Applications/System Requires: %{name} = %{version}-%{release} Requires: dbus Requires: polkit From 264f7855761106a15097221dd0d5b849f9cd7681 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 3 Feb 2019 10:57:12 +0000 Subject: [PATCH 07/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c283a6e..8b18ddb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -211,6 +211,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sun Feb 03 2019 Fedora Release Engineering - 0.7.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Nov 21 2018 Igor Gnatenko - 0.7.2-6 - Rebuild for protobuf 3.6 From f64e73a5d436ae0222958dccdee654275af719ac Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jul 2019 02:39:15 +0000 Subject: [PATCH 08/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8b18ddb..28894e8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -211,6 +211,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sat Jul 27 2019 Fedora Release Engineering - 0.7.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sun Feb 03 2019 Fedora Release Engineering - 0.7.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 9bd7d56f115f24a477dd3107f45b22c84c75a051 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 11 Nov 2019 16:39:13 +0100 Subject: [PATCH 09/59] Rebase to 0.7.6 - removed usbguard-applet-qt subpackage - because it is not supported on upstream anymore --- .gitignore | 1 + 0001-Update-to-latest-PEGTL-API.patch | 567 -------------------------- sources | 2 +- usbguard.spec | 76 +--- 4 files changed, 20 insertions(+), 626 deletions(-) delete mode 100644 0001-Update-to-latest-PEGTL-API.patch diff --git a/.gitignore b/.gitignore index 4c6ae5f..85cfc2e 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /usbguard-0.7.0.tar.gz /usbguard-0.7.1.tar.gz /usbguard-0.7.2.tar.gz +/usbguard-0.7.6.tar.gz diff --git a/0001-Update-to-latest-PEGTL-API.patch b/0001-Update-to-latest-PEGTL-API.patch deleted file mode 100644 index 1ebfd1e..0000000 --- a/0001-Update-to-latest-PEGTL-API.patch +++ /dev/null @@ -1,567 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index a135e01..f565b87 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -290,54 +290,28 @@ AC_SUBST([catch_LIBS]) - # - AC_ARG_WITH([bundled-pegtl], AS_HELP_STRING([--with-bundled-pegtl], [Build using the bundled PEGTL library]), [with_bundled_pegtl=$withval], [with_bundled_pegtl=no]) - if test "x$with_bundled_pegtl" = xyes; then -- pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL" -- pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL" -+ pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL/include" -+ pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL/include" - pegtl_LIBS="" - AC_MSG_NOTICE([Using bundled PEGTL library]) - pegtl_summary="bundled; $pegtl_CFLAGS $pegtl_LIBS" - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++11 $CPPFLAGS" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([pegtl.hh], [], [AC_MSG_FAILURE(pegtl.hh not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) -- AC_LANG_POP - pegtl_CFLAGS="" - pegtl_AC_CFLAGS="" - pegtl_LIBS="" -- CPPFLAGS=$SAVE_CPPFLAGS - pegtl_summary="system-wide; $pegtl_CFLAGS $pegtl_LIBS" - fi - AC_SUBST([pegtl_CFLAGS]) - AC_SUBST([pegtl_AC_CFLAGS]) - AC_SUBST([pegtl_LIBS]) - --# --# Check whether the available PEGTL library is compatible --# with version 1.3.1 or older. --# - SAVE_CPPFLAGS=$CPPFLAGS --CPPFLAGS="-std=c++11 $pegtl_AC_CFLAGS" -+CPPFLAGS="-std=c++11 $CPPFLAGS $pegtl_AC_CFLAGS" - AC_LANG_PUSH([C++]) --AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ --#include --#include --int main(void) --{ -- struct grammar -- : pegtl::one<'g'> {}; -- try { -- pegtl::parse_string(std::string(), std::string()); -- } catch(const pegtl::parse_error& ex) { -- auto b = ex.positions[0].byte_in_line; -- } -- return 0; --} --]])], --[have_pegtl_lte_131=no], [have_pegtl_lte_131=yes]) -+AC_CHECK_HEADER([tao/pegtl.hpp], -+ [AC_DEFINE([HAVE_TAO_PEGTL_HPP], [1], [PEGTL header file with .hpp extension is present])], -+ [AC_MSG_FAILURE(PEGTL header file not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) - AC_LANG_POP --if test "x$have_pegtl_lte_131" = xyes; then -- AC_DEFINE([HAVE_PEGTL_LTE_1_3_1], [1], [PEGTL version less than or equal to 1.3.1]) --fi - CPPFLAGS=$SAVE_CPPFLAGS - - # -diff --git a/src/Library/RuleParser/Actions.hpp b/src/Library/RuleParser/Actions.hpp -index 3e185f4..2b21bd2 100644 ---- a/src/Library/RuleParser/Actions.hpp -+++ b/src/Library/RuleParser/Actions.hpp -@@ -24,7 +24,7 @@ - #include "Utility.hpp" - #include "Common/Utility.hpp" - --#include -+#include - - namespace usbguard - { -@@ -47,7 +47,7 @@ namespace usbguard - struct str_if; - - template -- struct rule_parser_actions : pegtl::nothing {}; -+ struct rule_parser_actions : tao::pegtl::nothing {}; - - template<> - struct rule_parser_actions { -@@ -58,7 +58,7 @@ namespace usbguard - rule.setTarget(Rule::targetFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -75,7 +75,7 @@ namespace usbguard - rule.setDeviceID(device_id); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -87,7 +87,7 @@ namespace usbguard - } - - template -- struct name_actions : pegtl::nothing {}; -+ struct name_actions : tao::pegtl::nothing {}; - - template<> - struct name_actions { -@@ -95,7 +95,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeName().empty()) { -- throw pegtl::parse_error("name attribute already defined", in); -+ throw tao::pegtl::parse_error("name attribute already defined", in); - } - } - }; -@@ -109,7 +109,7 @@ namespace usbguard - rule.attributeName().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -123,13 +123,13 @@ namespace usbguard - rule.attributeName().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct id_actions : pegtl::nothing {}; -+ struct id_actions : tao::pegtl::nothing {}; - - template<> - struct id_actions { -@@ -137,7 +137,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeDeviceID().empty()) { -- throw pegtl::parse_error("id attribute already defined", in); -+ throw tao::pegtl::parse_error("id attribute already defined", in); - } - } - }; -@@ -154,7 +154,7 @@ namespace usbguard - rule.attributeDeviceID().append(device_id); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -168,13 +168,13 @@ namespace usbguard - rule.attributeDeviceID().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct hash_actions : pegtl::nothing {}; -+ struct hash_actions : tao::pegtl::nothing {}; - - template<> - struct hash_actions { -@@ -182,7 +182,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeHash().empty()) { -- throw pegtl::parse_error("hash attribute already defined", in); -+ throw tao::pegtl::parse_error("hash attribute already defined", in); - } - } - }; -@@ -196,7 +196,7 @@ namespace usbguard - rule.attributeHash().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -210,13 +210,13 @@ namespace usbguard - rule.attributeHash().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct parent_hash_actions : pegtl::nothing {}; -+ struct parent_hash_actions : tao::pegtl::nothing {}; - - template<> - struct parent_hash_actions { -@@ -224,7 +224,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeParentHash().empty()) { -- throw pegtl::parse_error("parent-hash attribute already defined", in); -+ throw tao::pegtl::parse_error("parent-hash attribute already defined", in); - } - } - }; -@@ -238,7 +238,7 @@ namespace usbguard - rule.attributeParentHash().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -252,13 +252,13 @@ namespace usbguard - rule.attributeParentHash().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct serial_actions : pegtl::nothing {}; -+ struct serial_actions : tao::pegtl::nothing {}; - - template<> - struct serial_actions { -@@ -266,7 +266,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeSerial().empty()) { -- throw pegtl::parse_error("serial attribute already defined", in); -+ throw tao::pegtl::parse_error("serial attribute already defined", in); - } - } - }; -@@ -280,7 +280,7 @@ namespace usbguard - rule.attributeSerial().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -294,13 +294,13 @@ namespace usbguard - rule.attributeSerial().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct via_port_actions : pegtl::nothing {}; -+ struct via_port_actions : tao::pegtl::nothing {}; - - template<> - struct via_port_actions { -@@ -308,7 +308,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeViaPort().empty()) { -- throw pegtl::parse_error("via-port attribute already defined", in); -+ throw tao::pegtl::parse_error("via-port attribute already defined", in); - } - } - }; -@@ -322,7 +322,7 @@ namespace usbguard - rule.attributeViaPort().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -336,13 +336,13 @@ namespace usbguard - rule.attributeViaPort().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct with_interface_actions : pegtl::nothing {}; -+ struct with_interface_actions : tao::pegtl::nothing {}; - - template<> - struct with_interface_actions { -@@ -350,7 +350,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeWithInterface().empty()) { -- throw pegtl::parse_error("with-interface attribute already defined", in); -+ throw tao::pegtl::parse_error("with-interface attribute already defined", in); - } - } - }; -@@ -365,7 +365,7 @@ namespace usbguard - rule.attributeWithInterface().append(interface_type); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -379,13 +379,13 @@ namespace usbguard - rule.attributeWithInterface().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct condition_actions : pegtl::nothing {}; -+ struct condition_actions : tao::pegtl::nothing {}; - - template<> - struct condition_actions { -@@ -393,7 +393,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeConditions().empty()) { -- throw pegtl::parse_error("conditions already defined", in); -+ throw tao::pegtl::parse_error("conditions already defined", in); - } - } - }; -@@ -407,7 +407,7 @@ namespace usbguard - rule.attributeConditions().append(RuleCondition(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -421,7 +421,7 @@ namespace usbguard - rule.attributeConditions().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -diff --git a/src/Library/RuleParser/Grammar.hpp b/src/Library/RuleParser/Grammar.hpp -index 9bd4a15..4d785c0 100644 ---- a/src/Library/RuleParser/Grammar.hpp -+++ b/src/Library/RuleParser/Grammar.hpp -@@ -22,37 +22,37 @@ - #endif - - #include "Actions.hpp" --#include - --using namespace pegtl; -+#include - - namespace usbguard - { - namespace RuleParser - { -+ using namespace tao::pegtl; - /* - * Rule language keywords - */ -- struct str_allow : pegtl_string_t("allow") {}; -- struct str_block : pegtl_string_t("block") {}; -- struct str_reject : pegtl_string_t("reject") {}; -- struct str_match : pegtl_string_t("match") {}; -- struct str_device : pegtl_string_t("device") {}; -- -- struct str_name : pegtl_string_t("name") {}; -- struct str_hash : pegtl_string_t("hash") {}; -- struct str_parent_hash : pegtl_string_t("parent-hash") {}; -- struct str_via_port : pegtl_string_t("via-port") {}; -- struct str_with_interface : pegtl_string_t("with-interface") {}; -- struct str_serial : pegtl_string_t("serial") {}; -- struct str_if : pegtl_string_t("if") {}; -- struct str_id : pegtl_string_t("id") {}; -- -- struct str_all_of : pegtl_string_t("all-of") {}; -- struct str_one_of : pegtl_string_t("one-of") {}; -- struct str_none_of : pegtl_string_t("none-of") {}; -- struct str_equals : pegtl_string_t("equals") {}; -- struct str_equals_ordered : pegtl_string_t("equals-ordered") {}; -+ struct str_allow : TAOCPP_PEGTL_STRING("allow") {}; -+ struct str_block : TAOCPP_PEGTL_STRING("block") {}; -+ struct str_reject : TAOCPP_PEGTL_STRING("reject") {}; -+ struct str_match : TAOCPP_PEGTL_STRING("match") {}; -+ struct str_device : TAOCPP_PEGTL_STRING("device") {}; -+ -+ struct str_name : TAOCPP_PEGTL_STRING("name") {}; -+ struct str_hash : TAOCPP_PEGTL_STRING("hash") {}; -+ struct str_parent_hash : TAOCPP_PEGTL_STRING("parent-hash") {}; -+ struct str_via_port : TAOCPP_PEGTL_STRING("via-port") {}; -+ struct str_with_interface : TAOCPP_PEGTL_STRING("with-interface") {}; -+ struct str_serial : TAOCPP_PEGTL_STRING("serial") {}; -+ struct str_if : TAOCPP_PEGTL_STRING("if") {}; -+ struct str_id : TAOCPP_PEGTL_STRING("id") {}; -+ -+ struct str_all_of : TAOCPP_PEGTL_STRING("all-of") {}; -+ struct str_one_of : TAOCPP_PEGTL_STRING("one-of") {}; -+ struct str_none_of : TAOCPP_PEGTL_STRING("none-of") {}; -+ struct str_equals : TAOCPP_PEGTL_STRING("equals") {}; -+ struct str_equals_ordered : TAOCPP_PEGTL_STRING("equals-ordered") {}; - - /* - * Generic rule attribute -diff --git a/src/Library/UEventParser.cpp b/src/Library/UEventParser.cpp -index 2e0ce39..aebe948 100644 ---- a/src/Library/UEventParser.cpp -+++ b/src/Library/UEventParser.cpp -@@ -27,7 +27,9 @@ - #include "usbguard/Logger.hpp" - - #include --#include -+ -+#include -+using namespace tao; - - namespace usbguard - { -@@ -114,25 +116,14 @@ namespace usbguard - void parseUEventFromString(const std::string& uevent_string, UEvent& uevent, bool trace) - { - try { --#if HAVE_PEGTL_LTE_1_3_1 -+ tao::pegtl::string_input<> in(uevent_string, std::string()); - - if (!trace) { -- pegtl::parse(uevent_string, std::string(), uevent); -+ tao::pegtl::parse(in, uevent); - } - else { -- pegtl::parse(uevent_string, std::string(), uevent); -- } -- --#else -- -- if (!trace) { -- pegtl::parse_string(uevent_string, std::string(), uevent); -+ tao::pegtl::parse(in, uevent); - } -- else { -- pegtl::parse_string(uevent_string, std::string(), uevent); -- } -- --#endif - } - catch (...) { - throw; -diff --git a/src/Library/UEventParser.hpp b/src/Library/UEventParser.hpp -index 856d5ff..4261bd5 100644 ---- a/src/Library/UEventParser.hpp -+++ b/src/Library/UEventParser.hpp -@@ -23,9 +23,7 @@ - - #include "usbguard/Typedefs.hpp" - --#include -- --using namespace pegtl; -+#include - - namespace usbguard - { -@@ -33,6 +31,8 @@ namespace usbguard - - namespace UEventParser - { -+ using namespace tao::pegtl; -+ - struct value - : seq, star>> {}; - -diff --git a/src/Library/public/usbguard/RuleParser.cpp b/src/Library/public/usbguard/RuleParser.cpp -index 4061e01..140bf14 100644 ---- a/src/Library/public/usbguard/RuleParser.cpp -+++ b/src/Library/public/usbguard/RuleParser.cpp -@@ -34,7 +34,7 @@ - #include - #include - --#include -+#include - - namespace usbguard - { -@@ -42,35 +42,21 @@ namespace usbguard - { - try { - Rule rule; --#if HAVE_PEGTL_LTE_1_3_1 -+ tao::pegtl::string_input<> input(rule_spec, file); - - if (!trace) { -- pegtl::parse(rule_spec, file, rule); -+ tao::pegtl::parse(input, rule); - } - else { -- pegtl::parse(rule_spec, file, rule); -+ tao::pegtl::parse(input, rule); - } - --#else -- -- if (!trace) { -- pegtl::parse_string(rule_spec, file, rule); -- } -- else { -- pegtl::parse_string(rule_spec, file, rule); -- } -- --#endif - return rule; - } -- catch (const pegtl::parse_error& ex) { -+ catch (const tao::pegtl::parse_error& ex) { - RuleParserError error(rule_spec); - error.setHint(ex.what()); --#if HAVE_PEGTL_LTE_1_3_1 -- error.setOffset(ex.positions[0].column); --#else - error.setOffset(ex.positions[0].byte_in_line); --#endif - - if (!file.empty() || line != 0) { - error.setFileInfo(file, line); --- -2.13.6 - diff --git a/sources b/sources index 1f06437..3f72679 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61 +SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 diff --git a/usbguard.spec b/usbguard.spec index 28894e8..14f0611 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,11 +1,6 @@ -%global _hardened_build 1 - -%define with_gui_qt5 1 -%define with_dbus 1 - Name: usbguard -Version: 0.7.2 -Release: 8%{?dist} +Version: 0.7.6 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -14,8 +9,6 @@ URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf -Patch0: 0001-Update-to-latest-PEGTL-API.patch - Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -23,6 +16,8 @@ Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig +BuildRequires: gcc +BuildRequires: gcc-c++ BuildRequires: libqb-devel BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel @@ -31,23 +26,19 @@ BuildRequires: PEGTL-static BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion -BuildRequires: asciidoctor +BuildRequires: asciidoc BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -%if 0%{with_gui_qt5} -BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist -%endif - -%if 0%{with_dbus} +# dbus BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -%endif + %description The USBGuard software framework helps to protect your computer against rogue USB @@ -72,21 +63,8 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. -%if 0%{with_gui_qt5} -### -%package applet-qt -Summary: USBGuard Qt 5.x Applet -Requires: %{name} = %{version}-%{release} -Obsoletes: usbguard-applet-qt <= 0.3 -%description applet-qt -The %{name}-applet-qt package contains an optional Qt 5.x desktop applet -for interacting with the USBGuard daemon component. -### -%endif - -%if 0%{with_dbus} -### +# dbus %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} @@ -96,12 +74,10 @@ Requires: polkit %description dbus The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. -### -%endif + %prep %setup -q -%patch0 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -114,16 +90,8 @@ autoreconf -i -v --no-recursive ./ --without-bundled-catch \ --without-bundled-pegtl \ --enable-systemd \ -%if 0%{with_gui_qt5} - --with-gui-qt=qt5 \ -%endif -%if 0%{with_dbus} --with-dbus \ --with-polkit \ -%else - --without-dbus \ - --without-polkit \ -%endif --with-crypto-library=gcrypt make %{?_smp_mflags} @@ -179,23 +147,12 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files tools %{_bindir}/usbguard-rule-parser -%if 0%{with_gui_qt5} -### -%files applet-qt -%{_bindir}/usbguard-applet-qt -%{_mandir}/man1/usbguard-applet-qt.1.gz -%{_datadir}/applications/usbguard-applet-qt.desktop -%{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg -### -%endif - -%if 0%{with_dbus} -### +# dbus %files dbus %{_sbindir}/usbguard-dbus -%{_datadir}/dbus-1/system-services/org.usbguard.service -%{_datadir}/dbus-1/system.d/org.usbguard.conf -%{_datadir}/polkit-1/actions/org.usbguard.policy +%{_datadir}/dbus-1/system-services/org.usbguard1.service +%{_datadir}/dbus-1/system.d/org.usbguard1.conf +%{_datadir}/polkit-1/actions/org.usbguard1.policy %{_unitdir}/usbguard-dbus.service %{_mandir}/man8/usbguard-dbus.8.gz @@ -207,10 +164,13 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service -### -%endif + %changelog +* Mon Nov 11 2019 Radovan Sroka - 0.7.6-1 +- rebase to 0.7.6 +- removed usbguard-applet subpackage which is not in upstream anymore + * Sat Jul 27 2019 Fedora Release Engineering - 0.7.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 6960471d528460454ab1656362c7b2a8a4b2a963 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 13 Nov 2019 13:33:17 +0100 Subject: [PATCH 10/59] Added selinux subpackage --- .gitignore | 2 ++ sources | 1 + usbguard.spec | 61 +++++++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 62 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 85cfc2e..1783a9f 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,5 @@ /usbguard-0.7.1.tar.gz /usbguard-0.7.2.tar.gz /usbguard-0.7.6.tar.gz +/usbguard-selinux-0.0.1.tar.gz +/usbguard-selinux-0.0.2.tar.gz diff --git a/sources b/sources index 3f72679..a2586cd 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 +SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec diff --git a/usbguard.spec b/usbguard.spec index 14f0611..3704900 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,13 +1,18 @@ +%global selinuxtype targeted +%global moduletype contrib +%define semodule_version 0.0.2 + Name: usbguard Version: 0.7.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: usbguard-daemon.conf +Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source2: usbguard-daemon.conf Requires: systemd Requires(post): systemd @@ -15,6 +20,7 @@ Requires(preun): systemd Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig +Recommends: %{name}-selinux BuildRequires: gcc BuildRequires: gcc-c++ @@ -75,10 +81,26 @@ Requires: polkit The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. +%package selinux +Summary: USBGuard selinux +Group: Applications/System +Requires: %{name} = %{version}-%{release} +BuildRequires: selinux-policy +BuildRequires: selinux-policy-devel +BuildArch: noarch +%{?selinux_requires} +%description selinux +The %{name}-selinux package contains selinux policy for the USBGuard +daemon. + +# usbguard %prep %setup -q +# selinux +%setup -q -D -T -a 1 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -96,9 +118,18 @@ autoreconf -i -v --no-recursive ./ make %{?_smp_mflags} +# selinux +pushd %{name}-selinux-%{semodule_version} +make +popd + %check make check +# selinux +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + %install make install INSTALL='install -p' DESTDIR=%{buildroot} @@ -107,6 +138,12 @@ mkdir -p %{buildroot}%{_sysconfdir}/usbguard mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf +# selinux +install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if + # Cleanup find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' @@ -165,8 +202,28 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} +fi + +%posttrans selinux +%selinux_relabel_post -s %{selinuxtype} + + %changelog +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-2 +- added selinux subpackage + * Mon Nov 11 2019 Radovan Sroka - 0.7.6-1 - rebase to 0.7.6 - removed usbguard-applet subpackage which is not in upstream anymore From 1228f42051a9a14bd02ce2eeb64a97959db1a9b6 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 13 Nov 2019 15:42:41 +0100 Subject: [PATCH 11/59] Fixed problem in spec - usbguard-daemon.conf was generated incorrectly Signed-off-by: Radovan Sroka --- usbguard.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 3704900..7651344 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -136,7 +136,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d -install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf # selinux install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} @@ -221,6 +221,10 @@ fi %changelog +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-3 +- fixed typo in specfile +- usbguard.conf was generated incorrectly + * Wed Nov 13 2019 Radovan Sroka - 0.7.6-2 - added selinux subpackage From 62377fbd34991902a17f1c04495395a2e04d9cc9 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 27 Nov 2019 08:51:40 +0100 Subject: [PATCH 12/59] Added 3 patches to fix 1.libqb permission inconsistencies, 2. permanent device policy changes and daemon signal handling. --- usbguard-0.7.6-libqb.patch | 118 +++++++++++++++++++++++++++++++ usbguard-0.7.6-servicefile.patch | 12 ++++ usbguard-0.7.6-sigwaitinfo.patch | 32 +++++++++ usbguard.spec | 16 ++++- 4 files changed, 177 insertions(+), 1 deletion(-) create mode 100644 usbguard-0.7.6-libqb.patch create mode 100644 usbguard-0.7.6-servicefile.patch create mode 100644 usbguard-0.7.6-sigwaitinfo.patch diff --git a/usbguard-0.7.6-libqb.patch b/usbguard-0.7.6-libqb.patch new file mode 100644 index 0000000..44b5f8d --- /dev/null +++ b/usbguard-0.7.6-libqb.patch @@ -0,0 +1,118 @@ +diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp +--- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100 ++++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100 +@@ -242,6 +242,22 @@ namespace usbguard + return stats->client_pid; + } + ++ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) ++ { ++ try { ++ std::string path = conn->description; ++ size_t last_slash = path.find_last_of("/"); ++ path = path.substr(0, last_slash); ++ chown(path.c_str(), uid, gid); ++ } ++ catch (const std::exception& exception) { ++ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what(); ++ } ++ catch (...) { ++ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits."; ++ } ++ } ++ + int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) + { + try { +@@ -259,6 +275,7 @@ namespace usbguard + << " gid=" << 0 + << " mode=0660"; + qb_ipcs_connection_auth_set(conn, uid, 0, 0660); ++ qbIPCConnectionAuthSet(conn, uid, 0); + return 0; + } + else { +diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp +--- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100 ++++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100 +@@ -39,6 +39,71 @@ + #include + #include + ++ ++/*libqb header starts*/ ++ #define CONNECTION_DESCRIPTION NAME_MAX ++ ++ enum qb_ipcs_connection_state { ++ QB_IPCS_CONNECTION_INACTIVE, ++ QB_IPCS_CONNECTION_ACTIVE, ++ QB_IPCS_CONNECTION_ESTABLISHED, ++ QB_IPCS_CONNECTION_SHUTTING_DOWN, ++ }; ++ ++ struct qb_ipcs_connection_auth { ++ uid_t uid; ++ gid_t gid; ++ mode_t mode; ++ }; ++ ++ struct qb_ringbuffer_s; ++ typedef struct qb_ringbuffer_s qb_ringbuffer_t; ++ ++ struct qb_ipc_one_way { ++ size_t max_msg_size; ++ enum qb_ipc_type type; ++ union { ++ struct { ++ int32_t sock; ++ char *sock_name; ++ void* shared_data; ++ char shared_file_name[NAME_MAX]; ++ } us; ++ struct { ++ qb_ringbuffer_t *rb; ++ } shm; ++ } u; ++ }; ++ ++ struct qb_list_head { ++ struct qb_list_head *next; ++ struct qb_list_head *prev; ++ }; ++ ++ ++ struct qb_ipcs_connection { ++ enum qb_ipcs_connection_state state; ++ int32_t refcount; ++ pid_t pid; ++ uid_t euid; ++ gid_t egid; ++ struct qb_ipcs_connection_auth auth; ++ struct qb_ipc_one_way setup; ++ struct qb_ipc_one_way request; ++ struct qb_ipc_one_way response; ++ struct qb_ipc_one_way event; ++ struct qb_ipcs_service *service; ++ struct qb_list_head list; ++ struct qb_ipc_request_header *receive_buf; ++ void *context; ++ int32_t fc_enabled; ++ int32_t poll_events; ++ int32_t outstanding_notifiers; ++ char description[CONNECTION_DESCRIPTION]; ++ struct qb_ipcs_connection_stats_2 stats; ++ }; ++/*libqb header ends*/ ++ + namespace usbguard + { + class IPCServerPrivate +@@ -107,6 +172,8 @@ namespace usbguard + bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; + bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const; + ++ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid); ++ + bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const; + bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const; + bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; diff --git a/usbguard-0.7.6-servicefile.patch b/usbguard-0.7.6-servicefile.patch new file mode 100644 index 0000000..63c462c --- /dev/null +++ b/usbguard-0.7.6-servicefile.patch @@ -0,0 +1,12 @@ +diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in +--- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100 ++++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100 +@@ -21,7 +21,7 @@ ProtectKernelModules=yes + ProtectSystem=yes + PIDFile=/run/usbguard.pid + ReadOnlyPaths=-/ +-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp ++ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ + Restart=on-failure + RestrictAddressFamilies=AF_UNIX AF_NETLINK + RestrictNamespaces=yes diff --git a/usbguard-0.7.6-sigwaitinfo.patch b/usbguard-0.7.6-sigwaitinfo.patch new file mode 100644 index 0000000..daf8aae --- /dev/null +++ b/usbguard-0.7.6-sigwaitinfo.patch @@ -0,0 +1,32 @@ +diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp +--- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100 ++++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100 +@@ -507,8 +507,14 @@ namespace usbguard + const int signal_num = sigwaitinfo(&signal_set, &signal_info); + + if (signal_num <= 0) { +- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; +- break; ++ if (errno == EINTR) { ++ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring."; ++ continue; ++ } ++ else { ++ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; ++ throw Exception("Daemon::run", "sigwaitinfo", "failed"); ++ } + } + + switch (signal_num) { +@@ -523,8 +529,11 @@ namespace usbguard + exit_loop = false; + break; + ++ ++ /* should not be reachable */ + default: + USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!"; ++ continue; + } + } + while (!exit_loop); diff --git a/usbguard.spec b/usbguard.spec index 7651344..c3f4637 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -45,6 +45,9 @@ BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 +Patch1: usbguard-0.7.6-libqb.patch +Patch2: usbguard-0.7.6-sigwaitinfo.patch +Patch3: usbguard-0.7.6-servicefile.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -104,6 +107,10 @@ daemon. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} +%patch1 -p1 -b .libqb +%patch2 -p1 -b .sigwaitinfo +%patch3 -p1 -b .servicefile + %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -221,6 +228,13 @@ fi %changelog +* Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 +- added patch for libqb related permission issues + resolves: rhbz#1776357 +- added patch to ensure that usbguard-daemons is still running after locked screen + resolves: rhbz#1751861 +- added patch to fix permanent device policy changes + * Wed Nov 13 2019 Radovan Sroka - 0.7.6-3 - fixed typo in specfile - usbguard.conf was generated incorrectly From eeccbd2e6ff3658c5145b4f28803917928a30195 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 2 Dec 2019 13:25:59 +0100 Subject: [PATCH 13/59] Added obsolete for applet-qt subpackage Signed-off-by: Radovan Sroka --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c3f4637..dfd5907 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -21,6 +21,7 @@ Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig Recommends: %{name}-selinux +Obsoletes: %{name}-applet-qt < 0.7.6 BuildRequires: gcc BuildRequires: gcc-c++ @@ -228,6 +229,9 @@ fi %changelog +* Mon Dec 02 2019 RAdovan Sroka - 0.7.6-5 +- added obsolete applet-qt subpackage + * Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 - added patch for libqb related permission issues resolves: rhbz#1776357 From 578d15f9f122cda9b6fde232a968c00082bc6bae Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 18 Dec 2019 18:04:25 +0100 Subject: [PATCH 14/59] Fixed selinux issue Signed-off-by: Radovan Sroka --- selinux.patch | 32 ++++++++++++++++++++++++++++++++ usbguard.spec | 11 ++++++++--- 2 files changed, 40 insertions(+), 3 deletions(-) create mode 100644 selinux.patch diff --git a/selinux.patch b/selinux.patch new file mode 100644 index 0000000..945878b --- /dev/null +++ b/selinux.patch @@ -0,0 +1,32 @@ +diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te +--- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500 ++++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500 +@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules, + type usbguard_t; + type usbguard_exec_t; + init_daemon_domain(usbguard_t, usbguard_exec_t) ++init_nnp_daemon_domain(usbguard_t) + + type usbguard_unit_file_t; + systemd_unit_file(usbguard_unit_file_t) + + type usbguard_conf_t; + files_config_file(usbguard_conf_t) ++systemd_mount_dir(usbguard_conf_t) + + type usbguard_log_t; + logging_log_file(usbguard_log_t) ++systemd_mount_dir(usbguard_log_t) + + type usbguard_rules_t; + files_config_file(usbguard_rules_t) +@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar + files_pid_filetrans(usbguard_t, usbguard_var_run_t, file) + + manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) +-fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file) ++fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir }) ++manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) + allow usbguard_t usbguard_tmpfs_t:file map; + + manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t) diff --git a/usbguard.spec b/usbguard.spec index dfd5907..8c3a745 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -49,6 +49,7 @@ BuildRequires: libxml2 Patch1: usbguard-0.7.6-libqb.patch Patch2: usbguard-0.7.6-sigwaitinfo.patch Patch3: usbguard-0.7.6-servicefile.patch +Patch4: selinux.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -111,6 +112,7 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch1 -p1 -b .libqb %patch2 -p1 -b .sigwaitinfo %patch3 -p1 -b .servicefile +%patch4 -p1 -b .selinux %build mkdir -p ./m4 @@ -229,8 +231,11 @@ fi %changelog -* Mon Dec 02 2019 RAdovan Sroka - 0.7.6-5 -- added obsolete applet-qt subpackage +* Wed Dec 18 2019 Radovan Sroka - 0.7.6-6 +- fix selinux problems + +* Mon Dec 02 2019 Radovan Sroka - 0.7.6-5 +- obsolete applet-qt subpackage * Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 - added patch for libqb related permission issues From 4864eaae100bf4b8c0ccfc109e692ab07770a6d4 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 18 Dec 2019 20:42:12 -0700 Subject: [PATCH 15/59] Rebuild for protobuf 3.11 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8c3a745..216069c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -231,6 +231,9 @@ fi %changelog +* Thu Dec 19 2019 Orion Poplawski - 0.7.6-7 +- Rebuild for protobuf 3.11 + * Wed Dec 18 2019 Radovan Sroka - 0.7.6-6 - fix selinux problems From 7950a374867724a117eb20584291bf7e8e26b0a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 31 Jan 2020 02:46:40 +0000 Subject: [PATCH 16/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 216069c..8ef93ef 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -231,6 +231,9 @@ fi %changelog +* Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Thu Dec 19 2019 Orion Poplawski - 0.7.6-7 - Rebuild for protobuf 3.11 From bd6d626064a274d574fdc104eaca38b12c960255 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 20 May 2020 14:36:57 +0200 Subject: [PATCH 17/59] Rebase to 0.7.8 - added rules.d - rebased selinux subpackage Resolves: rhbz#1836146 --- .gitignore | 3 + selinux.patch | 32 --------- sources | 4 +- usbguard-0.7.6-libqb.patch | 118 ------------------------------- usbguard-0.7.6-servicefile.patch | 12 ---- usbguard-0.7.6-sigwaitinfo.patch | 32 --------- usbguard-daemon.conf | 18 +++++ usbguard.spec | 24 +++---- 8 files changed, 34 insertions(+), 209 deletions(-) delete mode 100644 selinux.patch delete mode 100644 usbguard-0.7.6-libqb.patch delete mode 100644 usbguard-0.7.6-servicefile.patch delete mode 100644 usbguard-0.7.6-sigwaitinfo.patch diff --git a/.gitignore b/.gitignore index 1783a9f..0e1053c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,6 @@ /usbguard-0.7.6.tar.gz /usbguard-selinux-0.0.1.tar.gz /usbguard-selinux-0.0.2.tar.gz +/usbguard-0.7.7.tar.gz +/usbguard-selinux-0.0.3.tar.gz +/usbguard-0.7.8.tar.gz diff --git a/selinux.patch b/selinux.patch deleted file mode 100644 index 945878b..0000000 --- a/selinux.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te ---- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500 -+++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500 -@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules, - type usbguard_t; - type usbguard_exec_t; - init_daemon_domain(usbguard_t, usbguard_exec_t) -+init_nnp_daemon_domain(usbguard_t) - - type usbguard_unit_file_t; - systemd_unit_file(usbguard_unit_file_t) - - type usbguard_conf_t; - files_config_file(usbguard_conf_t) -+systemd_mount_dir(usbguard_conf_t) - - type usbguard_log_t; - logging_log_file(usbguard_log_t) -+systemd_mount_dir(usbguard_log_t) - - type usbguard_rules_t; - files_config_file(usbguard_rules_t) -@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar - files_pid_filetrans(usbguard_t, usbguard_var_run_t, file) - - manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) --fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file) -+fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir }) -+manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) - allow usbguard_t usbguard_tmpfs_t:file map; - - manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t) diff --git a/sources b/sources index a2586cd..a8275fa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 -SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec +SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 +SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426 diff --git a/usbguard-0.7.6-libqb.patch b/usbguard-0.7.6-libqb.patch deleted file mode 100644 index 44b5f8d..0000000 --- a/usbguard-0.7.6-libqb.patch +++ /dev/null @@ -1,118 +0,0 @@ -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100 -@@ -242,6 +242,22 @@ namespace usbguard - return stats->client_pid; - } - -+ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) -+ { -+ try { -+ std::string path = conn->description; -+ size_t last_slash = path.find_last_of("/"); -+ path = path.substr(0, last_slash); -+ chown(path.c_str(), uid, gid); -+ } -+ catch (const std::exception& exception) { -+ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what(); -+ } -+ catch (...) { -+ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits."; -+ } -+ } -+ - int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) - { - try { -@@ -259,6 +275,7 @@ namespace usbguard - << " gid=" << 0 - << " mode=0660"; - qb_ipcs_connection_auth_set(conn, uid, 0, 0660); -+ qbIPCConnectionAuthSet(conn, uid, 0); - return 0; - } - else { -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100 -@@ -39,6 +39,71 @@ - #include - #include - -+ -+/*libqb header starts*/ -+ #define CONNECTION_DESCRIPTION NAME_MAX -+ -+ enum qb_ipcs_connection_state { -+ QB_IPCS_CONNECTION_INACTIVE, -+ QB_IPCS_CONNECTION_ACTIVE, -+ QB_IPCS_CONNECTION_ESTABLISHED, -+ QB_IPCS_CONNECTION_SHUTTING_DOWN, -+ }; -+ -+ struct qb_ipcs_connection_auth { -+ uid_t uid; -+ gid_t gid; -+ mode_t mode; -+ }; -+ -+ struct qb_ringbuffer_s; -+ typedef struct qb_ringbuffer_s qb_ringbuffer_t; -+ -+ struct qb_ipc_one_way { -+ size_t max_msg_size; -+ enum qb_ipc_type type; -+ union { -+ struct { -+ int32_t sock; -+ char *sock_name; -+ void* shared_data; -+ char shared_file_name[NAME_MAX]; -+ } us; -+ struct { -+ qb_ringbuffer_t *rb; -+ } shm; -+ } u; -+ }; -+ -+ struct qb_list_head { -+ struct qb_list_head *next; -+ struct qb_list_head *prev; -+ }; -+ -+ -+ struct qb_ipcs_connection { -+ enum qb_ipcs_connection_state state; -+ int32_t refcount; -+ pid_t pid; -+ uid_t euid; -+ gid_t egid; -+ struct qb_ipcs_connection_auth auth; -+ struct qb_ipc_one_way setup; -+ struct qb_ipc_one_way request; -+ struct qb_ipc_one_way response; -+ struct qb_ipc_one_way event; -+ struct qb_ipcs_service *service; -+ struct qb_list_head list; -+ struct qb_ipc_request_header *receive_buf; -+ void *context; -+ int32_t fc_enabled; -+ int32_t poll_events; -+ int32_t outstanding_notifiers; -+ char description[CONNECTION_DESCRIPTION]; -+ struct qb_ipcs_connection_stats_2 stats; -+ }; -+/*libqb header ends*/ -+ - namespace usbguard - { - class IPCServerPrivate -@@ -107,6 +172,8 @@ namespace usbguard - bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const; - -+ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid); -+ - bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; diff --git a/usbguard-0.7.6-servicefile.patch b/usbguard-0.7.6-servicefile.patch deleted file mode 100644 index 63c462c..0000000 --- a/usbguard-0.7.6-servicefile.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in ---- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100 -+++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100 -@@ -21,7 +21,7 @@ ProtectKernelModules=yes - ProtectSystem=yes - PIDFile=/run/usbguard.pid - ReadOnlyPaths=-/ --ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ - Restart=on-failure - RestrictAddressFamilies=AF_UNIX AF_NETLINK - RestrictNamespaces=yes diff --git a/usbguard-0.7.6-sigwaitinfo.patch b/usbguard-0.7.6-sigwaitinfo.patch deleted file mode 100644 index daf8aae..0000000 --- a/usbguard-0.7.6-sigwaitinfo.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp ---- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100 -+++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100 -@@ -507,8 +507,14 @@ namespace usbguard - const int signal_num = sigwaitinfo(&signal_set, &signal_info); - - if (signal_num <= 0) { -- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -- break; -+ if (errno == EINTR) { -+ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring."; -+ continue; -+ } -+ else { -+ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -+ throw Exception("Daemon::run", "sigwaitinfo", "failed"); -+ } - } - - switch (signal_num) { -@@ -523,8 +529,11 @@ namespace usbguard - exit_loop = false; - break; - -+ -+ /* should not be reachable */ - default: - USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!"; -+ continue; - } - } - while (!exit_loop); diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index e9800b2..d8806a1 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -9,6 +9,19 @@ # RuleFile=/etc/usbguard/rules.conf +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFolder=/path/to/rulesfolder/ +# + +RuleFolder=/etc/usbguard/rules.d/ + + # # Implicit policy target. # @@ -171,3 +184,8 @@ AuditBackend=FileAudit # AuditFilePath=/var/log/usbguard/usbguard-audit.log +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false diff --git a/usbguard.spec b/usbguard.spec index 8ef93ef..1189ed8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.2 +%define semodule_version 0.0.3 Name: usbguard -Version: 0.7.6 -Release: 8%{?dist} +Version: 0.7.8 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -46,11 +46,6 @@ BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -Patch1: usbguard-0.7.6-libqb.patch -Patch2: usbguard-0.7.6-sigwaitinfo.patch -Patch3: usbguard-0.7.6-servicefile.patch -Patch4: selinux.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -109,11 +104,6 @@ daemon. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} -%patch1 -p1 -b .libqb -%patch2 -p1 -b .sigwaitinfo -%patch3 -p1 -b .servicefile -%patch4 -p1 -b .selinux - %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -145,6 +135,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf @@ -176,6 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_bindir}/usbguard %dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard +%dir %{_sysconfdir}/usbguard/rules.d/ %dir %{_sysconfdir}/usbguard/IPCAccessControl.d %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf @@ -231,6 +223,12 @@ fi %changelog +* Tue May 19 2020 Radovan Sroka - 0.7.8-1 +- rebase usbguard to 0.7.8 +- rebase usbguard-selinux to 0.0.3 +- added rules.d/ directory +Resolves: rhbz#1808527 + * Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From a1fb6977df1a6da2b3f13b2414e69fa567e1ce2a Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sun, 21 Jun 2020 17:45:31 +0200 Subject: [PATCH 18/59] Rebuilt for protobuf 3.12 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 1189ed8..76da765 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -223,6 +223,9 @@ fi %changelog +* Sun Jun 14 2020 Adrian Reber - 0.7.8-2 +- Rebuilt for protobuf 3.12 + * Tue May 19 2020 Radovan Sroka - 0.7.8-1 - rebase usbguard to 0.7.8 - rebase usbguard-selinux to 0.0.3 From d327155d9f3761802e28f72bffb359b0b5d89aed Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 24 Jun 2020 16:08:10 +0200 Subject: [PATCH 19/59] Rebase selinux tarball to v0.0.4 - enable forking style in unit file - set DevicePolicy to closed in unit file - usbguard prevented from writing conf via dontaudit rule Resolves: rhbz#1804713 Resolves: rhbz#1789923 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- usbguard-forking-style.patch | 34 ++++++++++++++++++++++++++++++++++ usbguard-service-fips.patch | 13 +++++++++++++ usbguard.spec | 30 +++++++++++++++++++++--------- 5 files changed, 70 insertions(+), 10 deletions(-) create mode 100644 usbguard-forking-style.patch create mode 100644 usbguard-service-fips.patch diff --git a/.gitignore b/.gitignore index 0e1053c..037ab40 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ /usbguard-0.7.7.tar.gz /usbguard-selinux-0.0.3.tar.gz /usbguard-0.7.8.tar.gz +/usbguard-selinux-0.0.4.tar.gz diff --git a/sources b/sources index a8275fa..8c31e08 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 -SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426 +SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-forking-style.patch b/usbguard-forking-style.patch new file mode 100644 index 0000000..8a6500a --- /dev/null +++ b/usbguard-forking-style.patch @@ -0,0 +1,34 @@ +diff -up ./usbguard.service.in.forking ./usbguard.service.in +--- ./usbguard.service.in.forking 2020-06-17 20:07:04.720564149 +0200 ++++ ./usbguard.service.in 2020-06-17 20:10:00.744063846 +0200 +@@ -8,11 +8,12 @@ AmbientCapabilities= + CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER + DeviceAllow=/dev/null rw + DevicePolicy=strict +-ExecStart=%sbindir%/usbguard-daemon -k -c %sysconfdir%/usbguard/usbguard-daemon.conf ++ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf + IPAddressDeny=any + LockPersonality=yes + MemoryDenyWriteExecute=yes + NoNewPrivileges=yes ++PIDFile=/var/run/usbguard.pid + PrivateDevices=yes + PrivateTmp=yes + ProtectControlGroups=yes +@@ -20,14 +21,14 @@ ProtectHome=yes + ProtectKernelModules=yes + ProtectSystem=yes + ReadOnlyPaths=-/ +-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ ++ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -/var/run + Restart=on-failure + RestrictAddressFamilies=AF_UNIX AF_NETLINK + RestrictNamespaces=yes + RestrictRealtime=yes + SystemCallArchitectures=native + SystemCallFilter=@system-service +-Type=simple ++Type=forking + UMask=0077 + + [Install] diff --git a/usbguard-service-fips.patch b/usbguard-service-fips.patch new file mode 100644 index 0000000..fce50c9 --- /dev/null +++ b/usbguard-service-fips.patch @@ -0,0 +1,13 @@ +diff -up ./usbguard.service.in.service-fips ./usbguard.service.in +--- ./usbguard.service.in.service-fips 2020-06-22 10:44:44.815860376 +0200 ++++ ./usbguard.service.in 2020-06-22 10:45:07.699135514 +0200 +@@ -6,8 +6,7 @@ Documentation=man:usbguard-daemon(8) + [Service] + AmbientCapabilities= + CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER +-DeviceAllow=/dev/null rw +-DevicePolicy=strict ++DevicePolicy=closed + ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf + IPAddressDeny=any + LockPersonality=yes diff --git a/usbguard.spec b/usbguard.spec index 76da765..bfc4f67 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.3 +%define semodule_version 0.0.4 Name: usbguard Version: 0.7.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -38,13 +38,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -# dbus -BuildRequires: dbus-glib-devel -BuildRequires: dbus-devel -BuildRequires: glib2-devel -BuildRequires: polkit-devel -BuildRequires: libxslt -BuildRequires: libxml2 +Patch1: usbguard-forking-style.patch +Patch2: usbguard-service-fips.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -74,6 +69,12 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} +BuildRequires: dbus-glib-devel +BuildRequires: dbus-devel +BuildRequires: glib2-devel +BuildRequires: polkit-devel +BuildRequires: libxslt +BuildRequires: libxml2 Requires: dbus Requires: polkit @@ -101,6 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +%patch1 -p1 -b .service1 +%patch2 -p1 -b .service2 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -223,6 +227,14 @@ fi %changelog +* Wed Jun 24 2020 Radovan Sroka - 0.7.8-3 +- rebase selinux tarball to v0.0.4 +- enable forking style in unit file +- set DevicePolicy to closed in unit file +- usbguard prevented from writing conf via dontaudit rule +Resolves: rhbz#1804713 +Resolves: rhbz#1789923 + * Sun Jun 14 2020 Adrian Reber - 0.7.8-2 - Rebuilt for protobuf 3.12 From 44f50872ecfcd3fc6fff9a62b75b6bc0984b76a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 13:25:25 +0000 Subject: [PATCH 20/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index bfc4f67..ff12143 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 0.7.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Wed Jun 24 2020 Radovan Sroka - 0.7.8-3 - rebase selinux tarball to v0.0.4 - enable forking style in unit file From 95d53e17ef51bfd3dfc7255d3190acf33c6cf344 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 14 Sep 2020 15:55:35 +0200 Subject: [PATCH 21/59] enable tests Signed-off-by: Radovan Sroka --- tests/tests.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 tests/tests.yml diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..294bc61 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,13 @@ +--- +# Test to run in classic context +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + repositories: + - repo: "https://github.com/RedHat-SP-Security/tests" + dest: "tests" + fmf_filter: "component: usbguard" + required_packages: + - beakerlib-libraries From 4f397875d0f8d572f3e8713572af02c6361fe3d0 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 24 Sep 2020 16:59:40 +0200 Subject: [PATCH 22/59] Rebuilt for protobuf 3.13 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index ff12143..4bf2999 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Thu Sep 24 2020 Adrian Reber - 0.7.8-5 +- Rebuilt for protobuf 3.13 + * Wed Jul 29 2020 Fedora Release Engineering - 0.7.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 89b4a43921993cd4f8f651fdd4bd0d1b39a0a04a Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 00:28:50 +0000 Subject: [PATCH 23/59] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- usbguard.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/usbguard.spec b/usbguard.spec index 4bf2999..33ff39a 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -23,6 +23,7 @@ Requires(postun): /sbin/ldconfig Recommends: %{name}-selinux Obsoletes: %{name}-applet-qt < 0.7.6 +BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel From 100a7d4dbbec11d9ed98fe4417bf9889bd6b3328 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Wed, 13 Jan 2021 14:43:58 +0100 Subject: [PATCH 24/59] Rebuilt for protobuf 3.14 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 33ff39a..bdec093 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -228,6 +228,9 @@ fi %changelog +* Wed Jan 13 14:43:57 CET 2021 Adrian Reber - 0.7.8-6 +- Rebuilt for protobuf 3.14 + * Thu Sep 24 2020 Adrian Reber - 0.7.8-5 - Rebuilt for protobuf 3.13 From d41c0811d4efe7ca8a62a730ca90d60b2b2c3288 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 14 Jan 2021 12:16:31 +0100 Subject: [PATCH 25/59] Rebase usbguard to 1.0.0 --- .gitignore | 1 + sources | 2 +- usbguard-forking-style.patch | 34 ---------------------------------- usbguard-service-fips.patch | 13 ------------- usbguard.spec | 18 ++++++++++-------- 5 files changed, 12 insertions(+), 56 deletions(-) delete mode 100644 usbguard-forking-style.patch delete mode 100644 usbguard-service-fips.patch diff --git a/.gitignore b/.gitignore index 037ab40..ed26253 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ /usbguard-selinux-0.0.3.tar.gz /usbguard-0.7.8.tar.gz /usbguard-selinux-0.0.4.tar.gz +/usbguard-1.0.0.tar.gz diff --git a/sources b/sources index 8c31e08..6b48e8e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 +SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-forking-style.patch b/usbguard-forking-style.patch deleted file mode 100644 index 8a6500a..0000000 --- a/usbguard-forking-style.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff -up ./usbguard.service.in.forking ./usbguard.service.in ---- ./usbguard.service.in.forking 2020-06-17 20:07:04.720564149 +0200 -+++ ./usbguard.service.in 2020-06-17 20:10:00.744063846 +0200 -@@ -8,11 +8,12 @@ AmbientCapabilities= - CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER - DeviceAllow=/dev/null rw - DevicePolicy=strict --ExecStart=%sbindir%/usbguard-daemon -k -c %sysconfdir%/usbguard/usbguard-daemon.conf -+ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf - IPAddressDeny=any - LockPersonality=yes - MemoryDenyWriteExecute=yes - NoNewPrivileges=yes -+PIDFile=/var/run/usbguard.pid - PrivateDevices=yes - PrivateTmp=yes - ProtectControlGroups=yes -@@ -20,14 +21,14 @@ ProtectHome=yes - ProtectKernelModules=yes - ProtectSystem=yes - ReadOnlyPaths=-/ --ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -/var/run - Restart=on-failure - RestrictAddressFamilies=AF_UNIX AF_NETLINK - RestrictNamespaces=yes - RestrictRealtime=yes - SystemCallArchitectures=native - SystemCallFilter=@system-service --Type=simple -+Type=forking - UMask=0077 - - [Install] diff --git a/usbguard-service-fips.patch b/usbguard-service-fips.patch deleted file mode 100644 index fce50c9..0000000 --- a/usbguard-service-fips.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up ./usbguard.service.in.service-fips ./usbguard.service.in ---- ./usbguard.service.in.service-fips 2020-06-22 10:44:44.815860376 +0200 -+++ ./usbguard.service.in 2020-06-22 10:45:07.699135514 +0200 -@@ -6,8 +6,7 @@ Documentation=man:usbguard-daemon(8) - [Service] - AmbientCapabilities= - CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER --DeviceAllow=/dev/null rw --DevicePolicy=strict -+DevicePolicy=closed - ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf - IPAddressDeny=any - LockPersonality=yes diff --git a/usbguard.spec b/usbguard.spec index bdec093..9060c5b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 0.7.8 -Release: 6%{?dist} +Version: 1.0.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -39,9 +39,6 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-forking-style.patch -Patch2: usbguard-service-fips.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -103,9 +100,6 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .service1 -%patch2 -p1 -b .service2 - # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -228,6 +222,14 @@ fi %changelog +* Thu Jan 14 2021 Zoltan Fridrich - 1.0.0-1 +- rebase usbguard to 1.0.0 +- added support for rules covering combination of classes +- fix usbguard being killed +Resolves: rhbz#1916039 +Resolves: rhbz#1861330 +Resolves: rhbz#1905257 + * Wed Jan 13 14:43:57 CET 2021 Adrian Reber - 0.7.8-6 - Rebuilt for protobuf 3.14 From ee065e6f6937c5daf9485c791880e38dc0faa08d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 16 Jan 2021 12:49:34 +0100 Subject: [PATCH 26/59] Rebuilt for protobuf 3.14 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9060c5b..b0074e7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Jan 16 12:49:32 CET 2021 Adrian Reber - 1.0.0-2 +- Rebuilt for protobuf 3.14 + * Thu Jan 14 2021 Zoltan Fridrich - 1.0.0-1 - rebase usbguard to 1.0.0 - added support for rules covering combination of classes From 5d6d9020901ecbee5ebb697886f2e711523f664e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 22:47:30 +0000 Subject: [PATCH 27/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b0074e7..7a5e489 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 1.0.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Jan 16 12:49:32 CET 2021 Adrian Reber - 1.0.0-2 - Rebuilt for protobuf 3.14 From 72f58ad74806fcaf693791d2dc8e2c6dee100ece Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:12:04 +0100 Subject: [PATCH 28/59] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 7a5e489..2237abe 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,10 @@ fi %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.0-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Wed Jan 27 2021 Fedora Release Engineering - 1.0.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 5a02b5043f6fad0207d5279352f51b1f76a70de9 Mon Sep 17 00:00:00 2001 From: Jonathan Wakely Date: Wed, 31 Mar 2021 17:38:38 +0100 Subject: [PATCH 29/59] Rebuilt for removed libstdc++ symbols (#1937698) --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 2237abe..76e10e0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Wed Mar 31 2021 Jonathan Wakely - 1.0.0-5 +- Rebuilt for removed libstdc++ symbols (#1937698) + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.0-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 05697feceba1312735df239d62f213cd080379b0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 20:10:21 +0000 Subject: [PATCH 30/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 76e10e0..9d2ee4e 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 1.0.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Mar 31 2021 Jonathan Wakely - 1.0.0-5 - Rebuilt for removed libstdc++ symbols (#1937698) From 2a01830eea407cfe4ad653d5728c548a84f4380d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 25 Oct 2021 17:38:24 +0200 Subject: [PATCH 31/59] Rebuilt for protobuf 3.18.1 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9d2ee4e..8408175 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Mon Oct 25 2021 Adrian Reber - 1.0.0-7 +- Rebuilt for protobuf 3.18.1 + * Fri Jul 23 2021 Fedora Release Engineering - 1.0.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 0574b88f1858bb8932e2aac3b483bab083e3a56a Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 6 Nov 2021 13:03:33 +0100 Subject: [PATCH 32/59] Rebuilt for protobuf 3.19.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8408175..87ce209 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Nov 06 2021 Adrian Reber - 1.0.0-8 +- Rebuilt for protobuf 3.19.0 + * Mon Oct 25 2021 Adrian Reber - 1.0.0-7 - Rebuilt for protobuf 3.18.1 From 44200f7461e9f8d4be96e8cca364afa1c255201e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 03:39:29 +0000 Subject: [PATCH 33/59] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 87ce209..d07c449 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 1.0.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 06 2021 Adrian Reber - 1.0.0-8 - Rebuilt for protobuf 3.19.0 From 80738463b0a47da3fa096b70f204c7000570b9b1 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Thu, 3 Mar 2022 15:13:50 +0100 Subject: [PATCH 34/59] Rebase to 1.1.0 Resolves: rhbz#2058450 - fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus Resolves: rhbz#2058466 --- .gitignore | 1 + sources | 2 +- usbguard-revert-catch.patch | 17 +++++++++++++++++ usbguard.spec | 17 ++++++++++++++--- 4 files changed, 33 insertions(+), 4 deletions(-) create mode 100644 usbguard-revert-catch.patch diff --git a/.gitignore b/.gitignore index ed26253..0bb9727 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /usbguard-0.7.8.tar.gz /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz +/usbguard-1.1.0.tar.gz diff --git a/sources b/sources index 6b48e8e..f4811e8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd +SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch new file mode 100644 index 0000000..d75cb85 --- /dev/null +++ b/usbguard-revert-catch.patch @@ -0,0 +1,17 @@ +diff -up ./configure.ac.fix ./configure.ac +--- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 ++++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 +@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t + catch_summary="bundled; $catch_CFLAGS $catch_LIBS" + else + SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" + AC_LANG_PUSH([C++]) + AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" ++ catch_CFLAGS="-I/usr/include/catch" + catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index d07c449..0aa5e23 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 1.0.0 -Release: 9%{?dist} +Version: 1.1.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -39,6 +39,10 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd +Patch1: usbguard-revert-catch.patch + + + %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -62,7 +66,6 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. - # dbus %package dbus Summary: USBGuard D-Bus Service @@ -100,6 +103,8 @@ daemon. # selinux %setup -q -D -T -a 1 +%patch1 -p1 -b .catch + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -222,6 +227,12 @@ fi %changelog +* Thu Mar 03 2022 Radovan Sroka - 1.1.0-1 +- rebase to 1.1.0 +Resolves: rhbz#2058450 +- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus +Resolves: rhbz#2058466 + * Sat Jan 22 2022 Fedora Release Engineering - 1.0.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 2eb6b48d69a40eb701477325736dd4bea5304f86 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Tue, 15 Mar 2022 10:41:50 +0100 Subject: [PATCH 35/59] Backported two patches - selinux: allow policykit dbus comunnication - restore support for access control filenames without a group Signed-off-by: Radovan Sroka --- policykit-dbus-chat-selinux.patch | 22 ++++++++++ ...restore-support-access-control-names.patch | 44 +++++++++++++++++++ usbguard.spec | 12 +++-- 3 files changed, 75 insertions(+), 3 deletions(-) create mode 100644 policykit-dbus-chat-selinux.patch create mode 100644 usbguard-restore-support-access-control-names.patch diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch new file mode 100644 index 0000000..8f0200e --- /dev/null +++ b/policykit-dbus-chat-selinux.patch @@ -0,0 +1,22 @@ +diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te +--- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 ++++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 +@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua + + logging_send_syslog_msg(usbguard_t) + +-dbus_system_domain(usbguard_t, usbguard_exec_t) + usbguard_ipc_access(usbguard_t) + ++optional_policy(` ++ dbus_system_domain(usbguard_t, usbguard_exec_t) ++ ++ optional_policy(` ++ policykit_dbus_chat(usbguard_t) ++ ') ++') ++ ++ + tunable_policy(`usbguard_daemon_write_rules',` + rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) + ') diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch new file mode 100644 index 0000000..5f4bed2 --- /dev/null +++ b/usbguard-restore-support-access-control-names.patch @@ -0,0 +1,44 @@ +From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 5 Mar 2022 17:22:05 +0100 +Subject: [PATCH] Restore support for access control filenames without a group + +Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 +of release 1.1.0, detailed analysis online at +https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 +--- + src/Daemon/Daemon.cpp | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp +index 45ddb76d..4ec2d934 100644 +--- a/src/Daemon/Daemon.cpp ++++ b/src/Daemon/Daemon.cpp +@@ -446,12 +446,25 @@ namespace usbguard + void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, + std::string* const ptr_group) + { ++ // There are five supported forms: ++ // - ":" ++ // - ":" ++ // - "" ++ // - ":" ++ // - ":" + const auto ug_separator = basename.find_first_of(":"); + const bool has_group = ug_separator != std::string::npos; + const std::string user = basename.substr(0, ug_separator); + const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); +- checkIPCAccessControlName(user); +- checkIPCAccessControlName(group); ++ ++ if (! user.empty()) { ++ checkIPCAccessControlName(user); ++ } ++ ++ if (! group.empty()) { ++ checkIPCAccessControlName(group); ++ } ++ + *ptr_user = user; + *ptr_group = group; + } diff --git a/usbguard.spec b/usbguard.spec index 0aa5e23..f3efa4f 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -40,8 +40,8 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch - - +Patch2: policykit-dbus-chat-selinux.patch +Patch3: usbguard-restore-support-access-control-names.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -104,6 +104,8 @@ daemon. %setup -q -D -T -a 1 %patch1 -p1 -b .catch +%patch2 -p1 -b .policykit +%patch3 -p1 -b .access-contol-names # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -227,6 +229,10 @@ fi %changelog +* Tue Mar 15 2022 Radovan Sroka - 1.1.0-2 +- selinux: allow policykit dbus comunnication +- restore support for access control filenames without a group + * Thu Mar 03 2022 Radovan Sroka - 1.1.0-1 - rebase to 1.1.0 Resolves: rhbz#2058450 From 1c3f2c8ee7aca9e552e87e84eee7b756205f30a8 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Tue, 29 Mar 2022 10:55:18 +0200 Subject: [PATCH 36/59] Usbguard requires selinux subpackage - this ensures that the selinux package and all its dependencies are not pulled into containers and other systems that do not use SELinux Signed-off-by: Radovan Sroka --- usbguard.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index f3efa4f..8fdc0c8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -20,7 +20,8 @@ Requires(preun): systemd Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig -Recommends: %{name}-selinux + +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) Obsoletes: %{name}-applet-qt < 0.7.6 BuildRequires: make @@ -227,8 +228,12 @@ fi %selinux_relabel_post -s %{selinuxtype} - %changelog +* Tue Mar 29 2022 Radovan Sroka - 1.1.0-3 +- usbguard requires selinux subpackage +- this ensures that the selinux package and all its dependencies are + not pulled into containers and other systems that do not use SELinux + * Tue Mar 15 2022 Radovan Sroka - 1.1.0-2 - selinux: allow policykit dbus comunnication - restore support for access control filenames without a group From 0ae94a6ee8b9629e5a7779190aa2979985d4f2c0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 11:32:28 +0000 Subject: [PATCH 37/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8fdc0c8..7eb0353 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -229,6 +229,9 @@ fi %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Mar 29 2022 Radovan Sroka - 1.1.0-3 - usbguard requires selinux subpackage - this ensures that the selinux package and all its dependencies are From ca389b9dcd7c7c64d8db90eb9ad9b6550b0fd3cd Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Mon, 26 Sep 2022 13:51:02 +0200 Subject: [PATCH 38/59] selinux: Update based on latest packaging guide https://fedoraproject.org/wiki/SELinux/IndependentPolicy Add dependency on selinux-policy-targeted Exclude installed policy module file from RPM verification Signed-off-by: Nikola Knazekova --- usbguard.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 7eb0353..e74cfcb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -88,7 +88,8 @@ a D-Bus interface to the USBGuard daemon component. Summary: USBGuard selinux Group: Applications/System Requires: %{name} = %{version}-%{release} -BuildRequires: selinux-policy +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} BuildRequires: selinux-policy-devel BuildArch: noarch %{?selinux_requires} @@ -213,7 +214,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if %post selinux From a7b34bb53f5498e72ebd4cf26ccab9b5e26eb13c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 05:57:42 +0000 Subject: [PATCH 39/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e74cfcb..d26b3bd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -230,6 +230,9 @@ fi %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 6763ed0496d9e12cf0071f9dec2e40b01bfda8dd Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 24 Jan 2023 15:01:59 -0500 Subject: [PATCH 40/59] Fix build with GCC 13 --- usbguard-gcc13.patch | 12 ++++++++++++ usbguard.spec | 3 +++ 2 files changed, 15 insertions(+) create mode 100644 usbguard-gcc13.patch diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch new file mode 100644 index 0000000..2229079 --- /dev/null +++ b/usbguard-gcc13.patch @@ -0,0 +1,12 @@ +diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp +index 0947f21..aa76311 100644 +--- a/src/Library/Base64.hpp ++++ b/src/Library/Base64.hpp +@@ -24,6 +24,7 @@ + + #include + #include ++#include + + namespace usbguard + { diff --git a/usbguard.spec b/usbguard.spec index d26b3bd..50552b0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -43,6 +43,8 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch Patch3: usbguard-restore-support-access-control-names.patch +# https://github.com/USBGuard/usbguard/pull/582 +Patch4: usbguard-gcc13.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,6 +110,7 @@ daemon. %patch1 -p1 -b .catch %patch2 -p1 -b .policykit %patch3 -p1 -b .access-contol-names +%patch4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 301862791baeeb84463d0d59998517d6d9959692 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 20 Feb 2023 14:14:12 +0100 Subject: [PATCH 41/59] Rebuild Resolves: rhbz#2171749 --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 50552b0..2adf917 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -233,6 +233,10 @@ fi %changelog +* Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 +- Rebuild +Resolves: rhbz#2171749 + * Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 97ffebda9664433933e976da02f06cf9b4d8c97c Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Wed, 10 May 2023 15:11:04 +0200 Subject: [PATCH 42/59] Drop BR on dbus-glib as the requirement was dropped in 0.7.7 --- usbguard.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 2adf917..12ce1c1 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -73,7 +73,6 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} -BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel @@ -233,6 +232,9 @@ fi %changelog +* Wed May 10 2023 Tomas Popela - 1.1.0-7 +- Drop BR on dbus-glib as the requirement was dropped in 0.7.7 + * Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 - Rebuild Resolves: rhbz#2171749 From b38cc691dbb5f07b75e40739ccd73407953621d1 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 31 May 2023 10:32:34 +0200 Subject: [PATCH 43/59] Update License tag for SPDX and fix deprecated %patchN --- usbguard.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 12ce1c1..9ccacb7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -6,7 +6,7 @@ Name: usbguard Version: 1.1.0 Release: 7%{?dist} Summary: A tool for implementing USB device usage policy -License: GPLv2+ +License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ @@ -106,10 +106,10 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .catch -%patch2 -p1 -b .policykit -%patch3 -p1 -b .access-contol-names -%patch4 -p1 -b .gcc13 +%patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .policykit +%patch -P 3 -p1 -b .access-contol-names +%patch -P 4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 5aa21e5bdcd82588be6dd790086bccf277182a34 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 17:15:47 +0000 Subject: [PATCH 44/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9ccacb7..c602254 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 10 2023 Tomas Popela - 1.1.0-7 - Drop BR on dbus-glib as the requirement was dropped in 0.7.7 From b0c20efcc06c5f8ad94389b64e7ae576cdf46a96 Mon Sep 17 00:00:00 2001 From: alakatos Date: Thu, 27 Jul 2023 10:56:48 +0200 Subject: [PATCH 45/59] Rebase to 1.1.2 Resolves: rhbz#2064543 --- .gitignore | 1 + sources | 2 +- ...restore-support-access-control-names.patch | 44 ------------------- usbguard-selinux-audit-write.patch | 12 +++++ usbguard.spec | 16 ++++--- 5 files changed, 24 insertions(+), 51 deletions(-) delete mode 100644 usbguard-restore-support-access-control-names.patch create mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 0bb9727..37047d1 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz +/usbguard-1.1.2.tar.gz diff --git a/sources b/sources index f4811e8..c5d8006 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 +SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch deleted file mode 100644 index 5f4bed2..0000000 --- a/usbguard-restore-support-access-control-names.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Sat, 5 Mar 2022 17:22:05 +0100 -Subject: [PATCH] Restore support for access control filenames without a group - -Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 -of release 1.1.0, detailed analysis online at -https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 ---- - src/Daemon/Daemon.cpp | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index 45ddb76d..4ec2d934 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -446,12 +446,25 @@ namespace usbguard - void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, - std::string* const ptr_group) - { -+ // There are five supported forms: -+ // - ":" -+ // - ":" -+ // - "" -+ // - ":" -+ // - ":" - const auto ug_separator = basename.find_first_of(":"); - const bool has_group = ug_separator != std::string::npos; - const std::string user = basename.substr(0, ug_separator); - const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); -- checkIPCAccessControlName(user); -- checkIPCAccessControlName(group); -+ -+ if (! user.empty()) { -+ checkIPCAccessControlName(user); -+ } -+ -+ if (! group.empty()) { -+ checkIPCAccessControlName(group); -+ } -+ - *ptr_user = user; - *ptr_group = group; - } diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch new file mode 100644 index 0000000..4d8b376 --- /dev/null +++ b/usbguard-selinux-audit-write.patch @@ -0,0 +1,12 @@ +diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te +--- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 ++++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 +@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) + # Local policy + # + +-allow usbguard_t self:capability { chown fowner }; ++allow usbguard_t self:capability { chown fowner audit_write }; + allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; + allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; + diff --git a/usbguard.spec b/usbguard.spec index c602254..9c13cf0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 1.1.0 -Release: 8%{?dist} +Version: 1.1.2 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -42,9 +42,9 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch -Patch3: usbguard-restore-support-access-control-names.patch # https://github.com/USBGuard/usbguard/pull/582 -Patch4: usbguard-gcc13.patch +Patch3: usbguard-gcc13.patch +Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,8 +108,8 @@ daemon. %patch -P 1 -p1 -b .catch %patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .access-contol-names -%patch -P 4 -p1 -b .gcc13 +%patch -P 3 -p1 -b .gcc13 +%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +232,10 @@ fi %changelog +* Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 +- Rebase to 1.1.2 +Resolves: rhbz#2064543 + * Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 5015f2bbcb4b0ee3847683f8a79b901640740d27 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 07:16:53 +0000 Subject: [PATCH 46/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9c13cf0..09bae0b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 - Rebase to 1.1.2 Resolves: rhbz#2064543 From 13ea59fa5a3488307c30075ed79ede40726a2aa5 Mon Sep 17 00:00:00 2001 From: alakatos Date: Fri, 7 Jun 2024 09:00:59 +0200 Subject: [PATCH 47/59] Rebase to 1.1.3 Resolves: rhbz#2290724 selinux package policy update Resolves: rhbz#2271330 --- .gitignore | 2 ++ policykit-dbus-chat-selinux.patch | 22 ---------------------- sources | 4 ++-- usbguard-gcc13.patch | 12 ------------ usbguard-selinux-audit-write.patch | 12 ------------ usbguard.spec | 21 ++++++++++----------- 6 files changed, 14 insertions(+), 59 deletions(-) delete mode 100644 policykit-dbus-chat-selinux.patch delete mode 100644 usbguard-gcc13.patch delete mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 37047d1..884279b 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz /usbguard-1.1.2.tar.gz +/usbguard-1.1.3.tar.gz +/usbguard-selinux-0.0.5.tar.gz diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch deleted file mode 100644 index 8f0200e..0000000 --- a/policykit-dbus-chat-selinux.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te ---- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 -+++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 -@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua - - logging_send_syslog_msg(usbguard_t) - --dbus_system_domain(usbguard_t, usbguard_exec_t) - usbguard_ipc_access(usbguard_t) - -+optional_policy(` -+ dbus_system_domain(usbguard_t, usbguard_exec_t) -+ -+ optional_policy(` -+ policykit_dbus_chat(usbguard_t) -+ ') -+') -+ -+ - tunable_policy(`usbguard_daemon_write_rules',` - rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) - ') diff --git a/sources b/sources index c5d8006..6fead78 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 -SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 +SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch deleted file mode 100644 index 2229079..0000000 --- a/usbguard-gcc13.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp -index 0947f21..aa76311 100644 ---- a/src/Library/Base64.hpp -+++ b/src/Library/Base64.hpp -@@ -24,6 +24,7 @@ - - #include - #include -+#include - - namespace usbguard - { diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch deleted file mode 100644 index 4d8b376..0000000 --- a/usbguard-selinux-audit-write.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te ---- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 -+++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 -@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) - # Local policy - # - --allow usbguard_t self:capability { chown fowner }; -+allow usbguard_t self:capability { chown fowner audit_write }; - allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; - allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; - diff --git a/usbguard.spec b/usbguard.spec index 09bae0b..e1fb9bb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,17 +1,17 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.4 +%define semodule_version 0.0.5 Name: usbguard -Version: 1.1.2 -Release: 2%{?dist} +Version: 1.1.3 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz Source2: usbguard-daemon.conf Requires: systemd @@ -41,10 +41,6 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch -Patch2: policykit-dbus-chat-selinux.patch -# https://github.com/USBGuard/usbguard/pull/582 -Patch3: usbguard-gcc13.patch -Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -107,9 +103,6 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .gcc13 -%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +225,12 @@ fi %changelog +* Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 +- Rebase to 1.1.3 +Resolves: rhbz#2290724 +- selinux package policy update +Resolves: rhbz#2271330 + * Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 5fe2cc1565aa287b660deca31154afc0dc0b4a12 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 08:24:46 +0000 Subject: [PATCH 48/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e1fb9bb..da720a7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 - Rebase to 1.1.3 Resolves: rhbz#2290724 From f1ffa2655608f13954d0b87cda19107e572253d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 13:55:52 +0000 Subject: [PATCH 49/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index da720a7..94ebf10 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 5d01f96eab2bb003f1c35319396205bc43b4971b Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 6 Feb 2025 09:31:12 +0100 Subject: [PATCH 50/59] Add usbguard-tmpfles.conf --- tmpfiles.patch | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ usbguard.spec | 8 ++++++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 tmpfiles.patch diff --git a/tmpfiles.patch b/tmpfiles.patch new file mode 100644 index 0000000..4eb6b0f --- /dev/null +++ b/tmpfiles.patch @@ -0,0 +1,58 @@ +From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Thu, 6 Feb 2025 08:00:59 +0100 +Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= + =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= + =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= + =?UTF-8?q?y.?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +--- + Makefile.am | 13 +++++++++++-- + usbguard-tmpfiles.conf | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + create mode 100644 usbguard-tmpfiles.conf + +diff --git a/Makefile.am b/Makefile.am +index 7dc6849..2a8bfeb 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc + $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ + endif + +-install-data-hook: install-daemon-conf install-systemd-service install-data-dbus +-uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus ++install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles ++uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles + + CLEANFILES+=\ + $(top_builddir)/usbguard-daemon.conf +@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard + + distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print + ++EXTRA_DIST+=usbguard-tmpfiles.conf ++ ++install-tmpfiles: ++ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ ++ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ ++uninstall-tmpfiles: ++ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ + install-daemon-conf: $(top_builddir)/usbguard-daemon.conf + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +new file mode 100644 +index 0000000..e90908f +--- /dev/null ++++ b/usbguard-tmpfiles.conf +@@ -0,0 +1 @@ ++d /var/log/usbguard 0700 root root - - +-- +2.48.1 + diff --git a/usbguard.spec b/usbguard.spec index 94ebf10..aac3acd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -41,6 +41,7 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch +Patch2: tmpfiles.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,6 +104,7 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .tmpfiles # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -180,6 +182,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel %{_includedir}/* @@ -225,6 +228,9 @@ fi %changelog +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + * Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 4125b6a0ad5aefa12690edd2deacb65c36a99a3c Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 24 Apr 2025 10:12:16 +0200 Subject: [PATCH 51/59] Fix usbguard-tmpfiles.conf Remove catch1 dependency Adapt for protobuf api changes Fix regression in specifying IPC privileges using UID selinux subpackage update: unified bin and sbin Resolves: rhbz#2297169 --- catch2-support.patch | 281 ++++++++++++++++++++++++++++ disable-catch.patch | 153 +++++++++++++++ ipc-privileges.patch | 88 +++++++++ protobuf-3.0.patch | 70 +++++++ selinux-bin-sbin.patch | 14 ++ tmpfiles.patch => tmpfiles-v1.patch | 24 +-- tmpfiles-v2.patch | 7 + uninstall-ignore-error.patch | 34 ++++ usbguard-revert-catch.patch | 17 -- usbguard.spec | 40 +++- 10 files changed, 679 insertions(+), 49 deletions(-) create mode 100644 catch2-support.patch create mode 100644 disable-catch.patch create mode 100644 ipc-privileges.patch create mode 100644 protobuf-3.0.patch create mode 100644 selinux-bin-sbin.patch rename tmpfiles.patch => tmpfiles-v1.patch (66%) create mode 100644 tmpfiles-v2.patch create mode 100644 uninstall-ignore-error.patch delete mode 100644 usbguard-revert-catch.patch diff --git a/catch2-support.patch b/catch2-support.patch new file mode 100644 index 0000000..49ae059 --- /dev/null +++ b/catch2-support.patch @@ -0,0 +1,281 @@ +diff --git a/configure.ac b/configure.ac +index 1f5be3a3..617d3bcf 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -396,10 +396,15 @@ else + SAVE_CPPFLAGS=$CPPFLAGS + CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" + AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" + fi +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index e10e8456..2efbb509 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ + + test_unit_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + + test_unit_LDFLAGS=\ +@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ + + test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + +diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp +index 73b536a3..6f6e350c 100644 +--- a/src/Tests/Regression/github-PR209-config-parser.cpp ++++ b/src/Tests/Regression/github-PR209-config-parser.cpp +@@ -18,7 +18,11 @@ + // + + #include "usbguard/ConfigFile.hpp" +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + #include + #include +diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp +index f3d9b82d..24b84935 100644 +--- a/src/Tests/Regression/test_Rule_ghi113.cpp ++++ b/src/Tests/Regression/test_Rule_ghi113.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp +index 2056102d..72483bb1 100644 +--- a/src/Tests/Regression/test_Rule_ghi247.cpp ++++ b/src/Tests/Regression/test_Rule_ghi247.cpp +@@ -19,7 +19,11 @@ + #include "usbguard/Rule.hpp" + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp +index f240c8b5..df2ef637 100644 +--- a/src/Tests/Regression/test_Rule_ghi37.cpp ++++ b/src/Tests/Regression/test_Rule_ghi37.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp +index 3f87093f..113b0633 100644 +--- a/src/Tests/Unit/test_Base64.cpp ++++ b/src/Tests/Unit/test_Base64.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +index 4ed4167b..f85a4ccb 100644 +--- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp ++++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/IPCServer.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp +index cafc8cca..015ce1bc 100644 +--- a/src/Tests/Unit/test_Rule.cpp ++++ b/src/Tests/Unit/test_Rule.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp +index ddb93dec..2aff77b6 100644 +--- a/src/Tests/Unit/test_RuleAttribute_id.cpp ++++ b/src/Tests/Unit/test_RuleAttribute_id.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp +index e9bc21e2..e310de81 100644 +--- a/src/Tests/Unit/test_RuleParser.cpp ++++ b/src/Tests/Unit/test_RuleParser.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp +index 759ee2cd..cbfd554c 100644 +--- a/src/Tests/Unit/test_UEvent.cpp ++++ b/src/Tests/Unit/test_UEvent.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp +index cefbc3bd..205a6885 100644 +--- a/src/Tests/Unit/test_UEventParser.cpp ++++ b/src/Tests/Unit/test_UEventParser.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +index fbe8bbdc..4a2e9612 100644 +--- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp ++++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + #include "test_UMockdevDeviceDefinition.data.hpp" +diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp +index 6d3e188f..a85fa362 100644 +--- a/src/Tests/Unit/test_Utility.cpp ++++ b/src/Tests/Unit/test_Utility.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp +index 4e3e8760..1b001998 100644 +--- a/src/Tests/main.cpp ++++ b/src/Tests/main.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#define CATCH_CONFIG_MAIN +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #define CATCH_CONFIG_MAIN ++ #include ++#endif + + /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch new file mode 100644 index 0000000..3a7219a --- /dev/null +++ b/disable-catch.patch @@ -0,0 +1,153 @@ +diff --git a/configure.ac b/configure.ac +index 617d3bcf..56bbe9e3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -386,27 +386,38 @@ fi + # + # Catch C++ library + # ++AC_ARG_ENABLE([catch], ++ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], ++ [enable_catch=$enableval], [enable_catch=yes]) ++ + AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) +-if test "x$with_bundled_catch" = xyes; then +- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" +- catch_LIBS="" +- AC_MSG_NOTICE([Using bundled Catch library]) +- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ ++if test "x$enable_catch" = xyes; then ++ if test "x$with_bundled_catch" = xyes; then ++ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" ++ catch_LIBS="" ++ AC_MSG_NOTICE([Using bundled Catch library]) ++ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ else ++ SAVE_CPPFLAGS=$CPPFLAGS ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ AC_LANG_PUSH([C++]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) ++ AC_LANG_POP ++ CPPFLAGS=$SAVE_CPPFLAGS ++ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ fi + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch_test_macros.hpp], +- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" +- catch_LIBS="-lCatch2Main -lCatch2"], +- [AC_CHECK_HEADER([catch.hpp], +- [catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS=""], +- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] +- )]) +- AC_LANG_POP +- CPPFLAGS=$SAVE_CPPFLAGS +- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ catch_CFLAGS="" ++ catch_LIBS="" ++ catch_summary="disabled; not checking for Catch2" + fi + AC_SUBST([catch_CFLAGS]) + AC_SUBST([catch_LIBS]) +@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) + AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) + AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) + AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) ++AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) + + CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" + CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index b84d2480..aa504bc9 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -583,7 +583,8 @@ namespace usbguard + return true; + } + +- bool isValidNameOrUID(const std::string& input) { ++ bool isValidNameOrUID(const std::string& input) ++ { + return isValidName(input) || isValidUID(input); + } + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index b75df136..555d113e 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,7 +36,7 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidNameOrUID(name)) { ++ if (!isValidNameOrUID(name)) { + throw Exception("IPC access control", "invalid name or UID format", name); + } + } +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index 2efbb509..435a4264 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ + + + TESTS=\ +- test-unit \ +- test-regression \ + USB/test-descriptor-parser.sh \ + Rules/test-rules.sh + ++if CATCH_ENABLED ++TESTS+=\ ++ test-unit \ ++ test-regression ++endif ++ + if FULL_TEST_SUITE_ENABLED + TESTS+=\ + Source/check-driver.sh \ +@@ -101,10 +105,15 @@ TESTS+=\ + + endif + +-check_PROGRAMS=\ ++check_PROGRAMS= ++ ++if CATCH_ENABLED ++check_PROGRAMS+=\ + test-unit \ + test-regression ++endif + ++if CATCH_ENABLED + test_unit_SOURCES=\ + main.cpp \ + Unit/test_Rule.cpp \ +@@ -128,7 +137,9 @@ test_unit_LDADD=\ + + test_unit_LDFLAGS=\ + -static ++endif + ++if CATCH_ENABLED + test_regression_SOURCES=\ + main.cpp \ + Regression/test_Rule_ghi37.cpp \ +@@ -143,4 +154,4 @@ test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ + $(catch_LIBS) \ + $(PTHREAD_LIBS) +- ++endif +\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch new file mode 100644 index 0000000..bf0f65d --- /dev/null +++ b/ipc-privileges.patch @@ -0,0 +1,88 @@ +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index aee50ce0..b84d2480 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -543,7 +543,22 @@ namespace usbguard + return rulefile_list; + } + +- bool isValidName(const std::string& name) ++ static bool isValidUID(const std::string& uid) ++ { ++ if (uid.empty()) { ++ return false; ++ } ++ ++ for (char c : uid) { ++ if (!std::isdigit(c)) { ++ return false; ++ } ++ } ++ ++ return true; ++ } ++ ++ static bool isValidName(const std::string& name) + { + const char* s = name.data(); + +@@ -568,6 +583,10 @@ namespace usbguard + return true; + } + ++ bool isValidNameOrUID(const std::string& input) { ++ return isValidName(input) || isValidUID(input); ++ } ++ + } /* namespace usbguard */ + + /* vim: set ts=2 sw=2 et */ +diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp +index d49e24dc..ac0bae4f 100644 +--- a/src/Common/Utility.hpp ++++ b/src/Common/Utility.hpp +@@ -319,12 +319,11 @@ namespace usbguard + /** + * @brief Checks whether a given name is a valid group/user name + * +- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] + * + * @param name Name to check + * @return True if given name is valid, false otherwise + */ +- bool isValidName(const std::string& name); ++ bool isValidNameOrUID(const std::string& name); + + } /* namespace usbguard */ + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index 973eb8bd..b75df136 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,8 +36,8 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidName(name)) { +- throw Exception("IPC access control", "invalid name format", name); ++ if (!isValidNameOrUID(name)) { ++ throw Exception("IPC access control", "invalid name or UID format", name); + } + } + +diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp +index ddb1d8a7..0ba6f93d 100644 +--- a/src/Library/public/usbguard/IPCServer.hpp ++++ b/src/Library/public/usbguard/IPCServer.hpp +@@ -50,9 +50,9 @@ namespace usbguard + /** + * @brief Checks whether given name is a valid access control name. + * +- * Name is a valid access control name iff: ++ * Name is a valid access control name if: + * 1. it is not longer then 32 characters +- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] ++ * 2. it is aligned with the syntax of useradd(8) + * + * @param name Name to be verified. + * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch new file mode 100644 index 0000000..ce12d9f --- /dev/null +++ b/protobuf-3.0.patch @@ -0,0 +1,70 @@ +diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp +index 6aa52013..452ecd41 100644 +--- a/src/Library/IPCClientPrivate.cpp ++++ b/src/Library/IPCClientPrivate.cpp +@@ -225,7 +225,7 @@ namespace usbguard + std::string payload; + message.SerializeToString(&payload); + struct qb_ipc_request_header hdr; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + struct iovec iov[2]; + iov[0].iov_base = &hdr; +diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp +index d92a1d47..a33022e2 100644 +--- a/src/Library/IPCClientPrivate.hpp ++++ b/src/Library/IPCClientPrivate.hpp +@@ -84,7 +84,7 @@ namespace usbguard + template + void registerHandler(MessageHandler::HandlerType method) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method)); + } + +diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp +index 548a7261..b976f025 100644 +--- a/src/Library/IPCServerPrivate.cpp ++++ b/src/Library/IPCServerPrivate.cpp +@@ -311,7 +311,7 @@ namespace usbguard + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr; + struct iovec iov[2]; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + iov[0].iov_base = &hdr; +@@ -555,7 +555,7 @@ namespace usbguard + std::string payload; + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr = { }; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + struct iovec iov[2]; +@@ -563,7 +563,7 @@ namespace usbguard + iov[0].iov_len = sizeof hdr; + iov[1].iov_base = (void*)payload.data(); + iov[1].iov_len = payload.size(); +- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); ++ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); + iov[0].iov_base = nullptr; + iov[1].iov_base = nullptr; + } +diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp +index 25f9ac38..3b3dcc51 100644 +--- a/src/Library/IPCServerPrivate.hpp ++++ b/src/Library/IPCServerPrivate.hpp +@@ -134,7 +134,7 @@ namespace usbguard + void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, + IPCServer::AccessControl::Privilege privilege) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); + } + diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/tmpfiles.patch b/tmpfiles-v1.patch similarity index 66% rename from tmpfiles.patch rename to tmpfiles-v1.patch index 4eb6b0f..21e1468 100644 --- a/tmpfiles.patch +++ b/tmpfiles-v1.patch @@ -1,22 +1,5 @@ -From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 -From: Cropi -Date: Thu, 6 Feb 2025 08:00:59 +0100 -Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= - =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= - =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= - =?UTF-8?q?y.?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - ---- - Makefile.am | 13 +++++++++++-- - usbguard-tmpfiles.conf | 1 + - 2 files changed, 12 insertions(+), 2 deletions(-) - create mode 100644 usbguard-tmpfiles.conf - diff --git a/Makefile.am b/Makefile.am -index 7dc6849..2a8bfeb 100644 +index 7dc6849d..2a8bfebd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc @@ -48,11 +31,8 @@ index 7dc6849..2a8bfeb 100644 $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf new file mode 100644 -index 0000000..e90908f +index 00000000..e90908f9 --- /dev/null +++ b/usbguard-tmpfiles.conf @@ -0,0 +1 @@ +d /var/log/usbguard 0700 root root - - --- -2.48.1 - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch new file mode 100644 index 0000000..069ee15 --- /dev/null +++ b/tmpfiles-v2.patch @@ -0,0 +1,7 @@ +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +index e90908f9..aff00c56 100644 +--- a/usbguard-tmpfiles.conf ++++ b/usbguard-tmpfiles.conf +@@ -1 +1 @@ +-d /var/log/usbguard 0700 root root - - ++d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch new file mode 100644 index 0000000..c05d50a --- /dev/null +++ b/uninstall-ignore-error.patch @@ -0,0 +1,34 @@ +diff --git a/Makefile.am b/Makefile.am +index 2a8bfebd..74a08cb7 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit + + uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service + rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service +- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) ++ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) + rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf +- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) ++ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) + + dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml + # +@@ -563,7 +563,7 @@ install-polkit-policy: + + uninstall-polkit-policy: + rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy +- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) ++ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) + + else + install-polkit-policy: +@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service + + uninstall-systemd-dbus-service: + rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service +- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) ++ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) + + else + install-systemd-dbus-service: diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index aac3acd..c65991c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -32,7 +32,6 @@ BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoc @@ -40,8 +39,14 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch -Patch2: tmpfiles.patch +Patch0: tmpfiles-v1.patch +Patch1: tmpfiles-v2.patch +Patch2: uninstall-ignore-error.patch +Patch3: ipc-privileges.patch +Patch4: protobuf-3.0.patch +Patch5: catch2-support.patch +Patch6: disable-catch.patch +Patch7: selinux-bin-sbin.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,8 +108,17 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .tmpfiles +%patch -P 0 -p1 +%patch -P 1 -p1 +%patch -P 2 -p1 +%patch -P 3 -p1 +%patch -P 4 -p1 +%patch -P 5 -p1 +%patch -P 6 -p1 + +pushd %{name}-selinux-%{semodule_version} +%patch -P 7 -p1 +popd # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -119,7 +133,8 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --disable-catch make %{?_smp_mflags} @@ -128,9 +143,6 @@ pushd %{name}-selinux-%{semodule_version} make popd -%check -make check - # selinux %pre selinux %selinux_relabel_pre -s %{selinuxtype} @@ -228,6 +240,14 @@ fi %changelog +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + * Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 - Install usbguard-tmpfles.conf From 1da2d8dacd5f9bb2eb88b34901c8afe0d8b89a51 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 19:52:18 +0000 Subject: [PATCH 52/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c65991c..5b108c2 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 - Fix usbguard-tmpfiles.conf - Remove catch1 dependency From 7f57f2807aee176da5e4c7a030726cde72e5aa0f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 19:41:27 +0000 Subject: [PATCH 53/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 5b108c2..0e68fcd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From f7c30b9e6b99a9f17c77357b056f0c9061a1c834 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 15 Apr 2026 09:53:56 +0200 Subject: [PATCH 54/59] Rebase usbguard to 1.1.4 Rebased from 1.1.3 to 1.1.4. Dropped patches merged upstream: - tmpfiles-v1.patch - tmpfiles-v2.patch - uninstall-ignore-error.patch - ipc-privileges.patch - protobuf-3.0.patch - catch2-support.patch - disable-catch.patch Added selinux-homed.patch for systemd-homed stream connect. Resolves: rhbz#2380396 Resolves: rhbz#2376283 --- .gitignore | 1 + catch2-support.patch | 281 ----------------------------------- disable-catch.patch | 153 ------------------- ipc-privileges.patch | 88 ----------- protobuf-3.0.patch | 70 --------- selinux-homed.patch | 14 ++ sources | 2 +- tmpfiles-v1.patch | 38 ----- tmpfiles-v2.patch | 7 - uninstall-ignore-error.patch | 34 ----- usbguard.spec | 32 ++-- 11 files changed, 30 insertions(+), 690 deletions(-) delete mode 100644 catch2-support.patch delete mode 100644 disable-catch.patch delete mode 100644 ipc-privileges.patch delete mode 100644 protobuf-3.0.patch create mode 100644 selinux-homed.patch delete mode 100644 tmpfiles-v1.patch delete mode 100644 tmpfiles-v2.patch delete mode 100644 uninstall-ignore-error.patch diff --git a/.gitignore b/.gitignore index 884279b..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /usbguard-1.1.2.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch2-support.patch b/catch2-support.patch deleted file mode 100644 index 49ae059..0000000 --- a/catch2-support.patch +++ /dev/null @@ -1,281 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 1f5be3a3..617d3bcf 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -396,10 +396,15 @@ else - SAVE_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" - AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" - fi -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index e10e8456..2efbb509 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ - - test_unit_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - - test_unit_LDFLAGS=\ -@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ - - test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - -diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp -index 73b536a3..6f6e350c 100644 ---- a/src/Tests/Regression/github-PR209-config-parser.cpp -+++ b/src/Tests/Regression/github-PR209-config-parser.cpp -@@ -18,7 +18,11 @@ - // - - #include "usbguard/ConfigFile.hpp" --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - #include - #include -diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp -index f3d9b82d..24b84935 100644 ---- a/src/Tests/Regression/test_Rule_ghi113.cpp -+++ b/src/Tests/Regression/test_Rule_ghi113.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp -index 2056102d..72483bb1 100644 ---- a/src/Tests/Regression/test_Rule_ghi247.cpp -+++ b/src/Tests/Regression/test_Rule_ghi247.cpp -@@ -19,7 +19,11 @@ - #include "usbguard/Rule.hpp" - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp -index f240c8b5..df2ef637 100644 ---- a/src/Tests/Regression/test_Rule_ghi37.cpp -+++ b/src/Tests/Regression/test_Rule_ghi37.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp -index 3f87093f..113b0633 100644 ---- a/src/Tests/Unit/test_Base64.cpp -+++ b/src/Tests/Unit/test_Base64.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -index 4ed4167b..f85a4ccb 100644 ---- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp -+++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/IPCServer.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp -index cafc8cca..015ce1bc 100644 ---- a/src/Tests/Unit/test_Rule.cpp -+++ b/src/Tests/Unit/test_Rule.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp -index ddb93dec..2aff77b6 100644 ---- a/src/Tests/Unit/test_RuleAttribute_id.cpp -+++ b/src/Tests/Unit/test_RuleAttribute_id.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp -index e9bc21e2..e310de81 100644 ---- a/src/Tests/Unit/test_RuleParser.cpp -+++ b/src/Tests/Unit/test_RuleParser.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp -index 759ee2cd..cbfd554c 100644 ---- a/src/Tests/Unit/test_UEvent.cpp -+++ b/src/Tests/Unit/test_UEvent.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp -index cefbc3bd..205a6885 100644 ---- a/src/Tests/Unit/test_UEventParser.cpp -+++ b/src/Tests/Unit/test_UEventParser.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -index fbe8bbdc..4a2e9612 100644 ---- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -+++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - #include "test_UMockdevDeviceDefinition.data.hpp" -diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp -index 6d3e188f..a85fa362 100644 ---- a/src/Tests/Unit/test_Utility.cpp -+++ b/src/Tests/Unit/test_Utility.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp -index 4e3e8760..1b001998 100644 ---- a/src/Tests/main.cpp -+++ b/src/Tests/main.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#define CATCH_CONFIG_MAIN --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #define CATCH_CONFIG_MAIN -+ #include -+#endif - - /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch deleted file mode 100644 index 3a7219a..0000000 --- a/disable-catch.patch +++ /dev/null @@ -1,153 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 617d3bcf..56bbe9e3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -386,27 +386,38 @@ fi - # - # Catch C++ library - # -+AC_ARG_ENABLE([catch], -+ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], -+ [enable_catch=$enableval], [enable_catch=yes]) -+ - AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) --if test "x$with_bundled_catch" = xyes; then -- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -- catch_LIBS="" -- AC_MSG_NOTICE([Using bundled Catch library]) -- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ -+if test "x$enable_catch" = xyes; then -+ if test "x$with_bundled_catch" = xyes; then -+ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -+ catch_LIBS="" -+ AC_MSG_NOTICE([Using bundled Catch library]) -+ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ else -+ SAVE_CPPFLAGS=$CPPFLAGS -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ AC_LANG_PUSH([C++]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) -+ AC_LANG_POP -+ CPPFLAGS=$SAVE_CPPFLAGS -+ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ fi - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch_test_macros.hpp], -- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -- catch_LIBS="-lCatch2Main -lCatch2"], -- [AC_CHECK_HEADER([catch.hpp], -- [catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS=""], -- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -- )]) -- AC_LANG_POP -- CPPFLAGS=$SAVE_CPPFLAGS -- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ catch_CFLAGS="" -+ catch_LIBS="" -+ catch_summary="disabled; not checking for Catch2" - fi - AC_SUBST([catch_CFLAGS]) - AC_SUBST([catch_LIBS]) -@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) - AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) - AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) - AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) -+AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) - - CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" - CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index b84d2480..aa504bc9 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -583,7 +583,8 @@ namespace usbguard - return true; - } - -- bool isValidNameOrUID(const std::string& input) { -+ bool isValidNameOrUID(const std::string& input) -+ { - return isValidName(input) || isValidUID(input); - } - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index b75df136..555d113e 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,7 +36,7 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidNameOrUID(name)) { -+ if (!isValidNameOrUID(name)) { - throw Exception("IPC access control", "invalid name or UID format", name); - } - } -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index 2efbb509..435a4264 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ - - - TESTS=\ -- test-unit \ -- test-regression \ - USB/test-descriptor-parser.sh \ - Rules/test-rules.sh - -+if CATCH_ENABLED -+TESTS+=\ -+ test-unit \ -+ test-regression -+endif -+ - if FULL_TEST_SUITE_ENABLED - TESTS+=\ - Source/check-driver.sh \ -@@ -101,10 +105,15 @@ TESTS+=\ - - endif - --check_PROGRAMS=\ -+check_PROGRAMS= -+ -+if CATCH_ENABLED -+check_PROGRAMS+=\ - test-unit \ - test-regression -+endif - -+if CATCH_ENABLED - test_unit_SOURCES=\ - main.cpp \ - Unit/test_Rule.cpp \ -@@ -128,7 +137,9 @@ test_unit_LDADD=\ - - test_unit_LDFLAGS=\ - -static -+endif - -+if CATCH_ENABLED - test_regression_SOURCES=\ - main.cpp \ - Regression/test_Rule_ghi37.cpp \ -@@ -143,4 +154,4 @@ test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ - $(catch_LIBS) \ - $(PTHREAD_LIBS) -- -+endif -\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch deleted file mode 100644 index bf0f65d..0000000 --- a/ipc-privileges.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index aee50ce0..b84d2480 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -543,7 +543,22 @@ namespace usbguard - return rulefile_list; - } - -- bool isValidName(const std::string& name) -+ static bool isValidUID(const std::string& uid) -+ { -+ if (uid.empty()) { -+ return false; -+ } -+ -+ for (char c : uid) { -+ if (!std::isdigit(c)) { -+ return false; -+ } -+ } -+ -+ return true; -+ } -+ -+ static bool isValidName(const std::string& name) - { - const char* s = name.data(); - -@@ -568,6 +583,10 @@ namespace usbguard - return true; - } - -+ bool isValidNameOrUID(const std::string& input) { -+ return isValidName(input) || isValidUID(input); -+ } -+ - } /* namespace usbguard */ - - /* vim: set ts=2 sw=2 et */ -diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp -index d49e24dc..ac0bae4f 100644 ---- a/src/Common/Utility.hpp -+++ b/src/Common/Utility.hpp -@@ -319,12 +319,11 @@ namespace usbguard - /** - * @brief Checks whether a given name is a valid group/user name - * -- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] - * - * @param name Name to check - * @return True if given name is valid, false otherwise - */ -- bool isValidName(const std::string& name); -+ bool isValidNameOrUID(const std::string& name); - - } /* namespace usbguard */ - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index 973eb8bd..b75df136 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,8 +36,8 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidName(name)) { -- throw Exception("IPC access control", "invalid name format", name); -+ if (!isValidNameOrUID(name)) { -+ throw Exception("IPC access control", "invalid name or UID format", name); - } - } - -diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp -index ddb1d8a7..0ba6f93d 100644 ---- a/src/Library/public/usbguard/IPCServer.hpp -+++ b/src/Library/public/usbguard/IPCServer.hpp -@@ -50,9 +50,9 @@ namespace usbguard - /** - * @brief Checks whether given name is a valid access control name. - * -- * Name is a valid access control name iff: -+ * Name is a valid access control name if: - * 1. it is not longer then 32 characters -- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] -+ * 2. it is aligned with the syntax of useradd(8) - * - * @param name Name to be verified. - * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch deleted file mode 100644 index ce12d9f..0000000 --- a/protobuf-3.0.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp -index 6aa52013..452ecd41 100644 ---- a/src/Library/IPCClientPrivate.cpp -+++ b/src/Library/IPCClientPrivate.cpp -@@ -225,7 +225,7 @@ namespace usbguard - std::string payload; - message.SerializeToString(&payload); - struct qb_ipc_request_header hdr; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - struct iovec iov[2]; - iov[0].iov_base = &hdr; -diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp -index d92a1d47..a33022e2 100644 ---- a/src/Library/IPCClientPrivate.hpp -+++ b/src/Library/IPCClientPrivate.hpp -@@ -84,7 +84,7 @@ namespace usbguard - template - void registerHandler(MessageHandler::HandlerType method) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method)); - } - -diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp -index 548a7261..b976f025 100644 ---- a/src/Library/IPCServerPrivate.cpp -+++ b/src/Library/IPCServerPrivate.cpp -@@ -311,7 +311,7 @@ namespace usbguard - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr; - struct iovec iov[2]; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - iov[0].iov_base = &hdr; -@@ -555,7 +555,7 @@ namespace usbguard - std::string payload; - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr = { }; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - struct iovec iov[2]; -@@ -563,7 +563,7 @@ namespace usbguard - iov[0].iov_len = sizeof hdr; - iov[1].iov_base = (void*)payload.data(); - iov[1].iov_len = payload.size(); -- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); -+ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); - iov[0].iov_base = nullptr; - iov[1].iov_base = nullptr; - } -diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp -index 25f9ac38..3b3dcc51 100644 ---- a/src/Library/IPCServerPrivate.hpp -+++ b/src/Library/IPCServerPrivate.hpp -@@ -134,7 +134,7 @@ namespace usbguard - void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, - IPCServer::AccessControl::Privilege privilege) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); - } - diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 6fead78..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tmpfiles-v1.patch b/tmpfiles-v1.patch deleted file mode 100644 index 21e1468..0000000 --- a/tmpfiles-v1.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 7dc6849d..2a8bfebd 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 00000000..e90908f9 ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch deleted file mode 100644 index 069ee15..0000000 --- a/tmpfiles-v2.patch +++ /dev/null @@ -1,7 +0,0 @@ -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -index e90908f9..aff00c56 100644 ---- a/usbguard-tmpfiles.conf -+++ b/usbguard-tmpfiles.conf -@@ -1 +1 @@ --d /var/log/usbguard 0700 root root - - -+d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch deleted file mode 100644 index c05d50a..0000000 --- a/uninstall-ignore-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 2a8bfebd..74a08cb7 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit - - uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service - rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service -- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) -+ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) - rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf -- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) -+ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) - - dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml - # -@@ -563,7 +563,7 @@ install-polkit-policy: - - uninstall-polkit-policy: - rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy -- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) -+ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) - - else - install-polkit-policy: -@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service - - uninstall-systemd-dbus-service: - rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service -- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) -+ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) - - else - install-systemd-dbus-service: diff --git a/usbguard.spec b/usbguard.spec index 0e68fcd..e31109c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.5 Name: usbguard -Version: 1.1.3 -Release: 7%{?dist} +Version: 1.1.4 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -39,14 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch0: tmpfiles-v1.patch -Patch1: tmpfiles-v2.patch -Patch2: uninstall-ignore-error.patch -Patch3: ipc-privileges.patch -Patch4: protobuf-3.0.patch -Patch5: catch2-support.patch -Patch6: disable-catch.patch -Patch7: selinux-bin-sbin.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,16 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} %patch -P 0 -p1 %patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 - -pushd %{name}-selinux-%{semodule_version} -%patch -P 7 -p1 popd # Remove bundled library sources before build @@ -240,6 +227,15 @@ fi %changelog +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + * Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 4678a493473ffa43f5b513724b7e86fb54fdfd85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 29 May 2026 22:38:59 +0200 Subject: [PATCH 55/59] rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e31109c..d0013cb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + * Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 - Rebase to 1.1.4 - Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, From d8c5d46563d9e227ddeff80ba2b2929e804edb7d Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 10 Jun 2026 17:01:34 -0400 Subject: [PATCH 56/59] Use openssl for crypto openssl is preferred over libgcrypt because the latter does not support FIPS or crypto policies. --- usbguard.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index d0013cb..70d0d0c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -28,7 +28,7 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static @@ -120,7 +120,7 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt \ + --with-crypto-library=openssl \ --disable-catch make %{?_smp_mflags} @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + * Fri May 29 2026 Miroslav Suchy - 1.1.4-2 - rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x From 9dc2db7571bfc681d193e2bacb78b8ce662c4118 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 21 Jun 2026 23:03:27 -0400 Subject: [PATCH 57/59] Rebuilt for openssl 4.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 70d0d0c..408a85b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + * Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 - Use openssl for crypto From d0db16e23688fe489d1b553843cc1f17c604015f Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 24 Jun 2026 06:55:37 +0100 Subject: [PATCH 58/59] Rebuilt for abseil-cpp 20260526.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 408a85b..b5c21c6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + * Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 - Rebuilt for openssl 4.0 From c3a58aca9edcba6676dcdc785129c099be1d0b08 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 08:16:04 +0000 Subject: [PATCH 59/59] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b5c21c6..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 - Rebuilt for abseil-cpp 20260526.0