From 880e0f048c9fffc73cb38938c992453a129c4662 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Fri, 17 Mar 2017 16:53:23 +0100 Subject: [PATCH 01/85] Update to latest git snapshot - Use --enable-werror configure option as the upstream default changed to not use -Werror. Resolves: rhbz#1427416 --- .gitignore | 1 + sources | 2 +- usbguard.spec | 12 +++++++++--- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b526c63..772b1f4 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /usbguard-0.6.1.tar.gz /usbguard-0.6.2.tar.gz /dkopecek-usbguard-fcde518.tar.gz +/dkopecek-usbguard-522c34c.tar.gz diff --git a/sources b/sources index 483d6cd..f808715 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-fcde518.tar.gz) = c795b0ea740ab5ab64807be1cbcf89c27e26caa163800f6b4b8ece9ed326130c2ab736bad377c10ef92fc5b435fb5db68235b3def3fde5a2134c3b3b5c87ffdd +SHA512 (dkopecek-usbguard-522c34c.tar.gz) = e2c0bb3f727514ce5e4c18cb31cb71a0f951b7c2ab11d2ad5299f27bdcdaa31dd05ee838f395858c5fd1a00675b97546ea888fac64e92f35ff65f7fa737657a9 diff --git a/usbguard.spec b/usbguard.spec index 96f1c10..3675e43 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 -%global gitdate 20170301 -%global gittag fcde51810701b09adb68b37523c773eb190c19ee +%global gitdate 20170317 +%global gittag 522c34c1c1c89f0245c9715a80914957a3180c39 %global shorttag %(c=%{gittag}; echo ${c:0:7}) %global user dkopecek @@ -110,7 +110,8 @@ autoreconf -i -v --no-recursive ./ --with-gui-qt=qt5 \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --enable-werror make %{?_smp_mflags} @@ -191,6 +192,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %changelog +* Fri Mar 17 2017 Daniel Kopeček 0.6.3-0.1.20170317 +- Update to latest git snapshot +- Use --enable-werror configure option as the upstream default + changed to not use -Werror. + * Thu Mar 02 2017 Daniel Kopeček 0.6.3-0.1.20170301 - Update to latest git snapshot - Disabled upstream alignment warning compiler flag From 06a029c3dfffb2f2737dfab09fd757a7528ab4e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Fri, 17 Mar 2017 16:53:23 +0100 Subject: [PATCH 02/85] Update to latest git snapshot - Use --enable-werror configure option as the upstream default changed to not use -Werror. Resolves: rhbz#1427416 --- .gitignore | 1 + sources | 2 +- usbguard.spec | 12 +++++++++--- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b526c63..772b1f4 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ /usbguard-0.6.1.tar.gz /usbguard-0.6.2.tar.gz /dkopecek-usbguard-fcde518.tar.gz +/dkopecek-usbguard-522c34c.tar.gz diff --git a/sources b/sources index 483d6cd..f808715 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-fcde518.tar.gz) = c795b0ea740ab5ab64807be1cbcf89c27e26caa163800f6b4b8ece9ed326130c2ab736bad377c10ef92fc5b435fb5db68235b3def3fde5a2134c3b3b5c87ffdd +SHA512 (dkopecek-usbguard-522c34c.tar.gz) = e2c0bb3f727514ce5e4c18cb31cb71a0f951b7c2ab11d2ad5299f27bdcdaa31dd05ee838f395858c5fd1a00675b97546ea888fac64e92f35ff65f7fa737657a9 diff --git a/usbguard.spec b/usbguard.spec index 96f1c10..3675e43 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 -%global gitdate 20170301 -%global gittag fcde51810701b09adb68b37523c773eb190c19ee +%global gitdate 20170317 +%global gittag 522c34c1c1c89f0245c9715a80914957a3180c39 %global shorttag %(c=%{gittag}; echo ${c:0:7}) %global user dkopecek @@ -110,7 +110,8 @@ autoreconf -i -v --no-recursive ./ --with-gui-qt=qt5 \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --enable-werror make %{?_smp_mflags} @@ -191,6 +192,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %changelog +* Fri Mar 17 2017 Daniel Kopeček 0.6.3-0.1.20170317 +- Update to latest git snapshot +- Use --enable-werror configure option as the upstream default + changed to not use -Werror. + * Thu Mar 02 2017 Daniel Kopeček 0.6.3-0.1.20170301 - Update to latest git snapshot - Disabled upstream alignment warning compiler flag From 93c60700b9e1dac621a880f1806c60aa1898dd5e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Sun, 19 Mar 2017 18:27:25 +0100 Subject: [PATCH 03/85] Update to latest git snapshot --- .gitignore | 1 + sources | 2 +- usbguard.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 772b1f4..edbd874 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /usbguard-0.6.2.tar.gz /dkopecek-usbguard-fcde518.tar.gz /dkopecek-usbguard-522c34c.tar.gz +/dkopecek-usbguard-e528ff6.tar.gz diff --git a/sources b/sources index f808715..5858005 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-522c34c.tar.gz) = e2c0bb3f727514ce5e4c18cb31cb71a0f951b7c2ab11d2ad5299f27bdcdaa31dd05ee838f395858c5fd1a00675b97546ea888fac64e92f35ff65f7fa737657a9 +SHA512 (dkopecek-usbguard-e528ff6.tar.gz) = 9aca5e19ebfc32b964ce52b38d6ef2b1b1523112f78c78b6ac6667216061c3143fdeddb7d5f8458d6e4e95928f63db66d3e59aa04ac0c50046de4632abf1c83a diff --git a/usbguard.spec b/usbguard.spec index 3675e43..452e8eb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 -%global gitdate 20170317 -%global gittag 522c34c1c1c89f0245c9715a80914957a3180c39 +%global gitdate 20170319 +%global gittag e528ff6fa8ce2ec522004e25fb3e3c48a63f5bbd %global shorttag %(c=%{gittag}; echo ${c:0:7}) %global user dkopecek @@ -192,6 +192,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %changelog +* Sun Mar 19 2017 Daniel Kopeček 0.6.3-0.1.20170319 +- Update to latest git snapshot + * Fri Mar 17 2017 Daniel Kopeček 0.6.3-0.1.20170317 - Update to latest git snapshot - Use --enable-werror configure option as the upstream default From ab2d1a1986a1ee147fb7df00c89e378c0f2798cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Sun, 19 Mar 2017 18:27:25 +0100 Subject: [PATCH 04/85] Update to latest git snapshot --- .gitignore | 1 + sources | 2 +- usbguard.spec | 7 +++++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 772b1f4..edbd874 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,4 @@ /usbguard-0.6.2.tar.gz /dkopecek-usbguard-fcde518.tar.gz /dkopecek-usbguard-522c34c.tar.gz +/dkopecek-usbguard-e528ff6.tar.gz diff --git a/sources b/sources index f808715..5858005 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-522c34c.tar.gz) = e2c0bb3f727514ce5e4c18cb31cb71a0f951b7c2ab11d2ad5299f27bdcdaa31dd05ee838f395858c5fd1a00675b97546ea888fac64e92f35ff65f7fa737657a9 +SHA512 (dkopecek-usbguard-e528ff6.tar.gz) = 9aca5e19ebfc32b964ce52b38d6ef2b1b1523112f78c78b6ac6667216061c3143fdeddb7d5f8458d6e4e95928f63db66d3e59aa04ac0c50046de4632abf1c83a diff --git a/usbguard.spec b/usbguard.spec index 3675e43..452e8eb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,7 +1,7 @@ %global _hardened_build 1 -%global gitdate 20170317 -%global gittag 522c34c1c1c89f0245c9715a80914957a3180c39 +%global gitdate 20170319 +%global gittag e528ff6fa8ce2ec522004e25fb3e3c48a63f5bbd %global shorttag %(c=%{gittag}; echo ${c:0:7}) %global user dkopecek @@ -192,6 +192,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %changelog +* Sun Mar 19 2017 Daniel Kopeček 0.6.3-0.1.20170319 +- Update to latest git snapshot + * Fri Mar 17 2017 Daniel Kopeček 0.6.3-0.1.20170317 - Update to latest git snapshot - Use --enable-werror configure option as the upstream default From d1dc25eb072bf36bf886f0c1c20b0cef4f20e837 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 13 Apr 2017 09:21:50 +0200 Subject: [PATCH 05/85] Update to 0.7.0 - changed PresentDevicePolicy setting from keep to apply-policy - added AuditFilePath configuration option pointing to /var/log/usbguard/usbguard-audit.log file - install bash-completion script - use 0600 file permissions for usbguard-daemon.conf and rules.conf --- .gitignore | 1 + sources | 2 +- usbguard-daemon.conf | 7 +++- usbguard.spec | 77 +++++++++++++++++++++++++++++++++----------- 4 files changed, 66 insertions(+), 21 deletions(-) diff --git a/.gitignore b/.gitignore index edbd874..1de1341 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /dkopecek-usbguard-fcde518.tar.gz /dkopecek-usbguard-522c34c.tar.gz /dkopecek-usbguard-e528ff6.tar.gz +/usbguard-0.7.0.tar.gz diff --git a/sources b/sources index 5858005..50ed7e9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-e528ff6.tar.gz) = 9aca5e19ebfc32b964ce52b38d6ef2b1b1523112f78c78b6ac6667216061c3143fdeddb7d5f8458d6e4e95928f63db66d3e59aa04ac0c50046de4632abf1c83a +SHA512 (usbguard-0.7.0.tar.gz) = e0a63457011379f50cc5eb14516bb1b6192d5710c81e7fa9042b67c481514158811e761e982ad16a9b1fcae62c58e68574910da1a98be3a07e6c99f69d5c03c4 diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index 8fe701a..9c44903 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -34,7 +34,7 @@ ImplicitPolicyTarget=block # * apply-policy - evaluate the ruleset for every present # device # -PresentDevicePolicy=keep +PresentDevicePolicy=apply-policy # # Present controller policy. @@ -93,3 +93,8 @@ IPCAllowedGroups=wheel # details. # DeviceRulesWithPort=false + +# +# USBGuard audit events log file path. +# +AuditFilePath=/var/log/usbguard/usbguard-audit.log diff --git a/usbguard.spec b/usbguard.spec index 452e8eb..b0fc6a3 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,27 +1,20 @@ %global _hardened_build 1 -%global gitdate 20170319 -%global gittag e528ff6fa8ce2ec522004e25fb3e3c48a63f5bbd -%global shorttag %(c=%{gittag}; echo ${c:0:7}) -%global user dkopecek +%define with_gui_qt5 1 +%define with_dbus 1 Name: usbguard -Version: 0.6.3 -Release: 0.1.%{gitdate}git%{shorttag}%{?dist} +Version: 0.7.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://dkopecek.github.io/usbguard -# Regular source URL -#Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -# Snapshot source URL -Source0: https://github.com/%{user}/%{name}/tarball/%{gittag}/%{user}-%{name}-%{shorttag}.tar.gz +Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf -Patch0: usbguard-0.6.3-disable-cast-align-warning.patch - Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -31,20 +24,33 @@ Requires(postun): /sbin/ldconfig BuildRequires: libqb-devel BuildRequires: libgcrypt-devel -BuildRequires: systemd systemd-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static +BuildRequires: catch-devel +BuildRequires: autoconf automake libtool +BuildRequires: bash-completion +# For `pkg-config systemd` only +BuildRequires: systemd + +%if 0%{with_gui_qt5} BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist +%endif + +%if 0%{with_dbus} BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -BuildRequires: catch-devel +%endif + +%if 0%{?fedora} BuildRequires: pandoc -BuildRequires: autoconf automake libtool +%endif + +Patch0: usbguard-0.6.3-disable-cast-align-warning.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -71,6 +77,8 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. +%if 0%{with_gui_qt5} +### %package applet-qt Summary: USBGuard Qt 5.x Applet Group: Applications/System @@ -80,7 +88,11 @@ Obsoletes: usbguard-applet-qt <= 0.3 %description applet-qt The %{name}-applet-qt package contains an optional Qt 5.x desktop applet for interacting with the USBGuard daemon component. +### +%endif +%if 0%{with_dbus} +### %package dbus Summary: USBGuard D-Bus Service Group: Applications/System @@ -91,9 +103,11 @@ Requires: polkit %description dbus The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. +### +%endif %prep -%setup -q -n %{user}-%{name}-%{shorttag} +%setup -q # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -107,9 +121,16 @@ autoreconf -i -v --no-recursive ./ --without-bundled-catch \ --without-bundled-pegtl \ --enable-systemd \ +%if 0%{with_gui_qt5} --with-gui-qt=qt5 \ +%endif +%if 0%{with_dbus} --with-dbus \ --with-polkit \ +%else + --without-dbus \ + --without-polkit \ +%endif --with-crypto-library=gcrypt \ --enable-werror @@ -146,14 +167,17 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_libdir}/*.so.* %{_sbindir}/usbguard-daemon %{_bindir}/usbguard +%dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard -%config(noreplace) %{_sysconfdir}/usbguard/usbguard-daemon.conf -%config(noreplace) %{_sysconfdir}/usbguard/rules.conf +%dir %{_sysconfdir}/usbguard/IPCAccessControl.d +%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf +%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf %{_unitdir}/usbguard.service %{_datadir}/man/man8/usbguard-daemon.8.gz %{_datadir}/man/man5/usbguard-daemon.conf.5.gz %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz +%{_datadir}/bash-completion/completions/usbguard %files devel %defattr(-,root,root,-) @@ -165,13 +189,19 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %defattr(-,root,root,-) %{_bindir}/usbguard-rule-parser +%if 0%{with_gui_qt5} +### %files applet-qt %defattr(-,root,root,-) %{_bindir}/usbguard-applet-qt %{_mandir}/man1/usbguard-applet-qt.1.gz %{_datadir}/applications/usbguard-applet-qt.desktop %{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg +### +%endif +%if 0%{with_dbus} +### %files dbus %defattr(-,root,root,-) %{_sbindir}/usbguard-dbus @@ -189,9 +219,18 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service - +### +%endif %changelog +* Thu Apr 13 2017 Daniel Kopeček 0.7.0-1 +- Update to 0.7.0 + - changed PresentDevicePolicy setting from keep to apply-policy + - added AuditFilePath configuration option pointing to + /var/log/usbguard/usbguard-audit.log file + - install bash-completion script + - use 0600 file permissions for usbguard-daemon.conf and rules.conf + * Sun Mar 19 2017 Daniel Kopeček 0.6.3-0.1.20170319 - Update to latest git snapshot From 561a99c8f5679ee4d724f7e5b2997e401722d94b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 13 Apr 2017 09:21:50 +0200 Subject: [PATCH 06/85] Update to 0.7.0 - changed PresentDevicePolicy setting from keep to apply-policy - added AuditFilePath configuration option pointing to /var/log/usbguard/usbguard-audit.log file - install bash-completion script - use 0600 file permissions for usbguard-daemon.conf and rules.conf --- .gitignore | 1 + sources | 2 +- usbguard-daemon.conf | 7 +++- usbguard.spec | 77 +++++++++++++++++++++++++++++++++----------- 4 files changed, 66 insertions(+), 21 deletions(-) diff --git a/.gitignore b/.gitignore index edbd874..1de1341 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ /dkopecek-usbguard-fcde518.tar.gz /dkopecek-usbguard-522c34c.tar.gz /dkopecek-usbguard-e528ff6.tar.gz +/usbguard-0.7.0.tar.gz diff --git a/sources b/sources index 5858005..50ed7e9 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (dkopecek-usbguard-e528ff6.tar.gz) = 9aca5e19ebfc32b964ce52b38d6ef2b1b1523112f78c78b6ac6667216061c3143fdeddb7d5f8458d6e4e95928f63db66d3e59aa04ac0c50046de4632abf1c83a +SHA512 (usbguard-0.7.0.tar.gz) = e0a63457011379f50cc5eb14516bb1b6192d5710c81e7fa9042b67c481514158811e761e982ad16a9b1fcae62c58e68574910da1a98be3a07e6c99f69d5c03c4 diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index 8fe701a..9c44903 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -34,7 +34,7 @@ ImplicitPolicyTarget=block # * apply-policy - evaluate the ruleset for every present # device # -PresentDevicePolicy=keep +PresentDevicePolicy=apply-policy # # Present controller policy. @@ -93,3 +93,8 @@ IPCAllowedGroups=wheel # details. # DeviceRulesWithPort=false + +# +# USBGuard audit events log file path. +# +AuditFilePath=/var/log/usbguard/usbguard-audit.log diff --git a/usbguard.spec b/usbguard.spec index 452e8eb..b0fc6a3 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,27 +1,20 @@ %global _hardened_build 1 -%global gitdate 20170319 -%global gittag e528ff6fa8ce2ec522004e25fb3e3c48a63f5bbd -%global shorttag %(c=%{gittag}; echo ${c:0:7}) -%global user dkopecek +%define with_gui_qt5 1 +%define with_dbus 1 Name: usbguard -Version: 0.6.3 -Release: 0.1.%{gitdate}git%{shorttag}%{?dist} +Version: 0.7.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://dkopecek.github.io/usbguard -# Regular source URL -#Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -# Snapshot source URL -Source0: https://github.com/%{user}/%{name}/tarball/%{gittag}/%{user}-%{name}-%{shorttag}.tar.gz +Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf -Patch0: usbguard-0.6.3-disable-cast-align-warning.patch - Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -31,20 +24,33 @@ Requires(postun): /sbin/ldconfig BuildRequires: libqb-devel BuildRequires: libgcrypt-devel -BuildRequires: systemd systemd-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static +BuildRequires: catch-devel +BuildRequires: autoconf automake libtool +BuildRequires: bash-completion +# For `pkg-config systemd` only +BuildRequires: systemd + +%if 0%{with_gui_qt5} BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist +%endif + +%if 0%{with_dbus} BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -BuildRequires: catch-devel +%endif + +%if 0%{?fedora} BuildRequires: pandoc -BuildRequires: autoconf automake libtool +%endif + +Patch0: usbguard-0.6.3-disable-cast-align-warning.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -71,6 +77,8 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. +%if 0%{with_gui_qt5} +### %package applet-qt Summary: USBGuard Qt 5.x Applet Group: Applications/System @@ -80,7 +88,11 @@ Obsoletes: usbguard-applet-qt <= 0.3 %description applet-qt The %{name}-applet-qt package contains an optional Qt 5.x desktop applet for interacting with the USBGuard daemon component. +### +%endif +%if 0%{with_dbus} +### %package dbus Summary: USBGuard D-Bus Service Group: Applications/System @@ -91,9 +103,11 @@ Requires: polkit %description dbus The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. +### +%endif %prep -%setup -q -n %{user}-%{name}-%{shorttag} +%setup -q # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -107,9 +121,16 @@ autoreconf -i -v --no-recursive ./ --without-bundled-catch \ --without-bundled-pegtl \ --enable-systemd \ +%if 0%{with_gui_qt5} --with-gui-qt=qt5 \ +%endif +%if 0%{with_dbus} --with-dbus \ --with-polkit \ +%else + --without-dbus \ + --without-polkit \ +%endif --with-crypto-library=gcrypt \ --enable-werror @@ -146,14 +167,17 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_libdir}/*.so.* %{_sbindir}/usbguard-daemon %{_bindir}/usbguard +%dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard -%config(noreplace) %{_sysconfdir}/usbguard/usbguard-daemon.conf -%config(noreplace) %{_sysconfdir}/usbguard/rules.conf +%dir %{_sysconfdir}/usbguard/IPCAccessControl.d +%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf +%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf %{_unitdir}/usbguard.service %{_datadir}/man/man8/usbguard-daemon.8.gz %{_datadir}/man/man5/usbguard-daemon.conf.5.gz %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz +%{_datadir}/bash-completion/completions/usbguard %files devel %defattr(-,root,root,-) @@ -165,13 +189,19 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %defattr(-,root,root,-) %{_bindir}/usbguard-rule-parser +%if 0%{with_gui_qt5} +### %files applet-qt %defattr(-,root,root,-) %{_bindir}/usbguard-applet-qt %{_mandir}/man1/usbguard-applet-qt.1.gz %{_datadir}/applications/usbguard-applet-qt.desktop %{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg +### +%endif +%if 0%{with_dbus} +### %files dbus %defattr(-,root,root,-) %{_sbindir}/usbguard-dbus @@ -189,9 +219,18 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service - +### +%endif %changelog +* Thu Apr 13 2017 Daniel Kopeček 0.7.0-1 +- Update to 0.7.0 + - changed PresentDevicePolicy setting from keep to apply-policy + - added AuditFilePath configuration option pointing to + /var/log/usbguard/usbguard-audit.log file + - install bash-completion script + - use 0600 file permissions for usbguard-daemon.conf and rules.conf + * Sun Mar 19 2017 Daniel Kopeček 0.6.3-0.1.20170319 - Update to latest git snapshot From ad6e87cf172724134173ad80ef494d30665c35cb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 15 May 2017 20:29:21 +0000 Subject: [PATCH 07/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b0fc6a3..bc6e9ba 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -223,6 +223,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon May 15 2017 Fedora Release Engineering - 0.7.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild + * Thu Apr 13 2017 Daniel Kopeček 0.7.0-1 - Update to 0.7.0 - changed PresentDevicePolicy setting from keep to apply-policy From ec1c5d0fae5c6df6147aabb3ad26aa65415c04dc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 15 May 2017 20:29:26 +0000 Subject: [PATCH 08/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b0fc6a3..bc6e9ba 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -223,6 +223,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon May 15 2017 Fedora Release Engineering - 0.7.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild + * Thu Apr 13 2017 Daniel Kopeček 0.7.0-1 - Update to 0.7.0 - changed PresentDevicePolicy setting from keep to apply-policy From ed8e63cfae8f17d5fae039542d6fdef1b9cce237 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Tue, 13 Jun 2017 09:48:23 -0600 Subject: [PATCH 09/85] Rebuild for protobuf 3.3.1 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index bc6e9ba..2e0fd64 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -223,6 +223,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Tue Jun 13 2017 Orion Poplawski - 0.7.0-3 +- Rebuild for protobuf 3.3.1 + * Mon May 15 2017 Fedora Release Engineering - 0.7.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild From 5f29306a90604997f0e252b9cf28eda88b2308e0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 13 Jul 2017 10:36:23 +0200 Subject: [PATCH 10/85] Disable unused parameter warning for protobuf generated sources Added patch to disable unused parameter warning for protobuf generated sources to fix compilation with newer protobuf version. --- usbguard.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 2e0fd64..1a7a802 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -51,6 +51,7 @@ BuildRequires: pandoc %endif Patch0: usbguard-0.6.3-disable-cast-align-warning.patch +Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -112,6 +113,7 @@ a D-Bus interface to the USBGuard daemon component. rm -rf src/ThirdParty/{Catch,PEGTL} %patch0 -p1 +%patch1 -p1 %build mkdir -p ./m4 @@ -223,6 +225,10 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Thu Jul 13 2017 Daniel Kopeček 0.7.0-4 +- Added patch to disable unused parameter warning for protobuf + generated sources to fix compilation with newer protobuf version + * Tue Jun 13 2017 Orion Poplawski - 0.7.0-3 - Rebuild for protobuf 3.3.1 From 96c3ebf23e01a28302b683ae7378b412adbb3d6b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 13 Jul 2017 10:59:00 +0200 Subject: [PATCH 11/85] Add missing patch file --- ...ard-0.7.0-disable-unused-parameter-warning.patch | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 usbguard-0.7.0-disable-unused-parameter-warning.patch diff --git a/usbguard-0.7.0-disable-unused-parameter-warning.patch b/usbguard-0.7.0-disable-unused-parameter-warning.patch new file mode 100644 index 0000000..7c0a6c8 --- /dev/null +++ b/usbguard-0.7.0-disable-unused-parameter-warning.patch @@ -0,0 +1,13 @@ +diff --git a/Makefile.am b/Makefile.am +index 090e69c..b8fb47f 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -291,7 +291,7 @@ pkginclude_HEADERS=\ + # void AddDescriptorImpl() { + # ^~~~~~~~~~~~~~~~~ + #``` +-%.pb.lo : CXXFLAGS += -Wno-missing-declarations ++%.pb.lo : CXXFLAGS += -Wno-missing-declarations -Wno-unused-parameter + + %.pb.cc %.pb.h: %.proto + $(MKDIR_P) $(top_builddir)/src/Library/IPC From 72a0b55b4077709227dd1177d089b145238e1179 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 21:05:00 +0000 Subject: [PATCH 12/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 1a7a802..b8d61b6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -225,6 +225,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 0.7.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Thu Jul 13 2017 Daniel Kopeček 0.7.0-4 - Added patch to disable unused parameter warning for protobuf generated sources to fix compilation with newer protobuf version From f1156353be7c9443b10576fc9a32002eaefe9891 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 3 Aug 2017 09:53:16 +0000 Subject: [PATCH 13/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b8d61b6..3666ce9 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -225,6 +225,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Thu Aug 03 2017 Fedora Release Engineering - 0.7.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + * Thu Jul 27 2017 Fedora Release Engineering - 0.7.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From 2c7bde0cb724d7385ecf1b34669eedd79e61d80b Mon Sep 17 00:00:00 2001 From: user Date: Mon, 16 Oct 2017 09:56:02 +0200 Subject: [PATCH 14/85] Fix enumeration timeout on kernel >= 4.13 Resolves: rhbz#1499052 --- usbguard-0.7.0-kernel-4.13-fix.patch | 68 ++++++++++++++++++++++++++++ usbguard.spec | 9 +++- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 usbguard-0.7.0-kernel-4.13-fix.patch diff --git a/usbguard-0.7.0-kernel-4.13-fix.patch b/usbguard-0.7.0-kernel-4.13-fix.patch new file mode 100644 index 0000000..09188f2 --- /dev/null +++ b/usbguard-0.7.0-kernel-4.13-fix.patch @@ -0,0 +1,68 @@ +diff -up usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig usbguard-0.7.0/src/Library/SysFSDevice.cpp +--- usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig 2017-10-16 09:40:33.257969336 +0200 ++++ usbguard-0.7.0/src/Library/SysFSDevice.cpp 2017-10-16 09:42:11.110603414 +0200 +@@ -126,6 +126,20 @@ namespace usbguard + return fd; + } + ++ bool SysFSDevice::hasAttribute(const std::string& name) const ++ { ++ struct ::stat st; ++ ++ if (::fstatat(_sysfs_dirfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) != 0) { ++ if (errno == ENOENT) { ++ return false; ++ } ++ throw ErrnoException("SysFSDevice::hasAttribute", name, errno); ++ } ++ ++ return S_ISREG(st.st_mode); ++ } ++ + String SysFSDevice::readAttribute(const String& name, bool strip_last_null, bool optional) const + { + USBGUARD_LOG(Trace) << "name=" << name; +diff -up usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig usbguard-0.7.0/src/Library/SysFSDevice.hpp +--- usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig 2017-10-16 09:40:33.258969332 +0200 ++++ usbguard-0.7.0/src/Library/SysFSDevice.hpp 2017-10-16 09:42:52.346449212 +0200 +@@ -36,6 +36,7 @@ namespace usbguard + const String& getName() const; + const UEvent& getUEvent() const; + const String& getParentPath() const; ++ bool hasAttribute(const std::string& name) const; + String readAttribute(const String& name, bool strip_last_null = false, bool optional = false) const; + void setAttribute(const String& name, const String& value); + int openAttribute(const String& name) const; +diff -up usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig usbguard-0.7.0/src/Library/UEventDeviceManager.cpp +--- usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig 2017-01-29 18:52:18.290000000 +0100 ++++ usbguard-0.7.0/src/Library/UEventDeviceManager.cpp 2017-10-16 09:40:33.259969329 +0200 +@@ -572,7 +572,12 @@ namespace usbguard { + const String devtype = uevent.getAttribute("DEVTYPE"); + const String action = uevent.getAttribute("ACTION"); + +- if (subsystem != "usb" || devtype != "usb_device") { ++ /* ++ * We don't care about the event if it's not from the "usb" subsystem. ++ * The device type attribute value is checked later based on the data ++ * read from the sysfs uevent file in the device directory. ++ */ ++ if (subsystem != "usb") { + USBGUARD_LOG(Debug) << "Ignoring non-USB device:" + << " subsystem=" << subsystem + << " devtype=" << devtype +@@ -602,8 +607,13 @@ namespace usbguard { + if (sysfs_device.getUEvent().hasAttribute("DEVTYPE")) { + const String devtype = sysfs_device.getUEvent().getAttribute("DEVTYPE"); + if (devtype != "usb_device") { +- USBGUARD_LOG(Warning) << sysfs_devpath << ": UEvent DEVTYPE mismatch." +- << " Expected \"usb_device\", got \"" << devtype << "\""; ++ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent DEVTYPE != usb_device. Ignoring event."; ++ return; ++ } ++ } ++ else { ++ if (!sysfs_device.hasAttribute("descriptors")) { ++ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent doesn't refer to a device with a descriptors file. Ignoring event."; + return; + } + } diff --git a/usbguard.spec b/usbguard.spec index 3666ce9..47b35e6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -52,6 +52,8 @@ BuildRequires: pandoc Patch0: usbguard-0.6.3-disable-cast-align-warning.patch Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch +# Bug 1499052 - usbguard-daemon fails with kernel 4.13 +Patch2: usbguard-0.7.0-kernel-4.13-fix.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -114,6 +116,7 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch0 -p1 %patch1 -p1 +%patch2 -p1 %build mkdir -p ./m4 @@ -225,6 +228,10 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon Oct 16 2017 Daniel Kopeček 0.7.0-7 +- Fix enumeration timeout on kernel >= 4.13 + Resolves: rhbz#1499052 + * Thu Aug 03 2017 Fedora Release Engineering - 0.7.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild From bb237663fdf690202e2bdf713be1709cbfe54c1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Mon, 16 Oct 2017 10:04:41 +0200 Subject: [PATCH 15/85] Fix enumeration timeout on kernel >= 4.13 Resolves: rhbz#1499052 --- usbguard-0.7.0-kernel-4.13-fix.patch | 68 ++++++++++++++++++++++++++++ usbguard.spec | 9 +++- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 usbguard-0.7.0-kernel-4.13-fix.patch diff --git a/usbguard-0.7.0-kernel-4.13-fix.patch b/usbguard-0.7.0-kernel-4.13-fix.patch new file mode 100644 index 0000000..09188f2 --- /dev/null +++ b/usbguard-0.7.0-kernel-4.13-fix.patch @@ -0,0 +1,68 @@ +diff -up usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig usbguard-0.7.0/src/Library/SysFSDevice.cpp +--- usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig 2017-10-16 09:40:33.257969336 +0200 ++++ usbguard-0.7.0/src/Library/SysFSDevice.cpp 2017-10-16 09:42:11.110603414 +0200 +@@ -126,6 +126,20 @@ namespace usbguard + return fd; + } + ++ bool SysFSDevice::hasAttribute(const std::string& name) const ++ { ++ struct ::stat st; ++ ++ if (::fstatat(_sysfs_dirfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) != 0) { ++ if (errno == ENOENT) { ++ return false; ++ } ++ throw ErrnoException("SysFSDevice::hasAttribute", name, errno); ++ } ++ ++ return S_ISREG(st.st_mode); ++ } ++ + String SysFSDevice::readAttribute(const String& name, bool strip_last_null, bool optional) const + { + USBGUARD_LOG(Trace) << "name=" << name; +diff -up usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig usbguard-0.7.0/src/Library/SysFSDevice.hpp +--- usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig 2017-10-16 09:40:33.258969332 +0200 ++++ usbguard-0.7.0/src/Library/SysFSDevice.hpp 2017-10-16 09:42:52.346449212 +0200 +@@ -36,6 +36,7 @@ namespace usbguard + const String& getName() const; + const UEvent& getUEvent() const; + const String& getParentPath() const; ++ bool hasAttribute(const std::string& name) const; + String readAttribute(const String& name, bool strip_last_null = false, bool optional = false) const; + void setAttribute(const String& name, const String& value); + int openAttribute(const String& name) const; +diff -up usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig usbguard-0.7.0/src/Library/UEventDeviceManager.cpp +--- usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig 2017-01-29 18:52:18.290000000 +0100 ++++ usbguard-0.7.0/src/Library/UEventDeviceManager.cpp 2017-10-16 09:40:33.259969329 +0200 +@@ -572,7 +572,12 @@ namespace usbguard { + const String devtype = uevent.getAttribute("DEVTYPE"); + const String action = uevent.getAttribute("ACTION"); + +- if (subsystem != "usb" || devtype != "usb_device") { ++ /* ++ * We don't care about the event if it's not from the "usb" subsystem. ++ * The device type attribute value is checked later based on the data ++ * read from the sysfs uevent file in the device directory. ++ */ ++ if (subsystem != "usb") { + USBGUARD_LOG(Debug) << "Ignoring non-USB device:" + << " subsystem=" << subsystem + << " devtype=" << devtype +@@ -602,8 +607,13 @@ namespace usbguard { + if (sysfs_device.getUEvent().hasAttribute("DEVTYPE")) { + const String devtype = sysfs_device.getUEvent().getAttribute("DEVTYPE"); + if (devtype != "usb_device") { +- USBGUARD_LOG(Warning) << sysfs_devpath << ": UEvent DEVTYPE mismatch." +- << " Expected \"usb_device\", got \"" << devtype << "\""; ++ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent DEVTYPE != usb_device. Ignoring event."; ++ return; ++ } ++ } ++ else { ++ if (!sysfs_device.hasAttribute("descriptors")) { ++ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent doesn't refer to a device with a descriptors file. Ignoring event."; + return; + } + } diff --git a/usbguard.spec b/usbguard.spec index bc6e9ba..a49f3fe 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -51,6 +51,8 @@ BuildRequires: pandoc %endif Patch0: usbguard-0.6.3-disable-cast-align-warning.patch +# Bug 1499052 - usbguard-daemon fails with kernel 4.13 +Patch1: usbguard-0.7.0-kernel-4.13-fix.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -112,6 +114,7 @@ a D-Bus interface to the USBGuard daemon component. rm -rf src/ThirdParty/{Catch,PEGTL} %patch0 -p1 +%patch1 -p1 %build mkdir -p ./m4 @@ -223,6 +226,10 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon Oct 16 2017 Daniel Kopeček 0.7.0-3 +- Fix enumeration timeout on kernel >= 4.13 + Resolves: rhbz#1499052 + * Mon May 15 2017 Fedora Release Engineering - 0.7.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild From 1db790497efabeef592783af76ac67b9d879abe3 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 13 Nov 2017 23:27:42 +0100 Subject: [PATCH 16/85] Rebuild for protobuf 3.4 Signed-off-by: Igor Gnatenko --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 47b35e6..87ccc7a 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -228,6 +228,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon Nov 13 2017 Igor Gnatenko - 0.7.0-8 +- Rebuild for protobuf 3.4 + * Mon Oct 16 2017 Daniel Kopeček 0.7.0-7 - Fix enumeration timeout on kernel >= 4.13 Resolves: rhbz#1499052 From 763244be51a9cbc0533fde443e2b2dc855f3842b Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 29 Nov 2017 12:14:41 +0100 Subject: [PATCH 17/85] Rebuild for protobuf 3.5 Signed-off-by: Igor Gnatenko --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 87ccc7a..3714517 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -228,6 +228,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Wed Nov 29 2017 Igor Gnatenko - 0.7.0-9 +- Rebuild for protobuf 3.5 + * Mon Nov 13 2017 Igor Gnatenko - 0.7.0-8 - Rebuild for protobuf 3.4 From 353f081dee435ca2bf52a5beabf11ffa772e207a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 7 Dec 2017 11:51:53 +0100 Subject: [PATCH 18/85] Update to 0.7.1 --- .gitignore | 1 + sources | 2 +- usbguard-0.7.1-disable-unused-result.patch | 15 ++++++ usbguard-0.7.1-quiet-compiler-warnings.patch | 49 ++++++++++++++++++++ usbguard-daemon.conf | 12 +++++ usbguard.spec | 25 +++++----- 6 files changed, 92 insertions(+), 12 deletions(-) create mode 100644 usbguard-0.7.1-disable-unused-result.patch create mode 100644 usbguard-0.7.1-quiet-compiler-warnings.patch diff --git a/.gitignore b/.gitignore index 1de1341..b28cf62 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /dkopecek-usbguard-522c34c.tar.gz /dkopecek-usbguard-e528ff6.tar.gz /usbguard-0.7.0.tar.gz +/usbguard-0.7.1.tar.gz diff --git a/sources b/sources index 50ed7e9..1f21673 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.0.tar.gz) = e0a63457011379f50cc5eb14516bb1b6192d5710c81e7fa9042b67c481514158811e761e982ad16a9b1fcae62c58e68574910da1a98be3a07e6c99f69d5c03c4 +SHA512 (usbguard-0.7.1.tar.gz) = c4eb133d3f2d87552789551d8df0a0910962713c42444b8218db858a83f4d9131d1e1c62923c7a0a249dab0517f4172c636d00e714eb0a23b08307adf9eb601a diff --git a/usbguard-0.7.1-disable-unused-result.patch b/usbguard-0.7.1-disable-unused-result.patch new file mode 100644 index 0000000..98c715e --- /dev/null +++ b/usbguard-0.7.1-disable-unused-result.patch @@ -0,0 +1,15 @@ +diff -up usbguard-0.7.1/configure.ac.disable-unused-result usbguard-0.7.1/configure.ac +--- usbguard-0.7.1/configure.ac.disable-unused-result 2017-12-05 12:47:27.531879954 +0100 ++++ usbguard-0.7.1/configure.ac 2017-12-05 12:48:21.582663544 +0100 +@@ -42,6 +42,11 @@ COMMON_WARNING_FLAGS+=" -Wformat-nonlite + COMMON_WARNING_FLAGS+=" -Wno-missing-field-initializers" + + # ++# Workaround https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 ++# ++COMMON_WARNING_FLAGS+=" -Wno-unused-result" ++ ++# + # Don't warn about implicit fallthrough + # + # TODO: Use [[fallthrough]] C++ attribute specifier with diff --git a/usbguard-0.7.1-quiet-compiler-warnings.patch b/usbguard-0.7.1-quiet-compiler-warnings.patch new file mode 100644 index 0000000..0bd7c02 --- /dev/null +++ b/usbguard-0.7.1-quiet-compiler-warnings.patch @@ -0,0 +1,49 @@ +From e7f984bf1319df6059f09789c81cda877964ec24 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= +Date: Tue, 5 Dec 2017 11:01:31 +0100 +Subject: [PATCH] Quiet compiler warnings + +...for function calls where we are not interested in the result. + +Addressing: +``` +src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::run()': +src/Daemon/Daemon.cpp:498:12: error: ignoring return value of 'int lockf(int, int, __off_t)', declared with attribute warn_unused_result [-Werror=unused-result] + lockf(pid_fd, F_ULOCK, 0); + ~~~~~^~~~~~~~~~~~~~~~~~~~ +src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::daemonize(const string&)': +src/Daemon/Daemon.cpp:571:10: error: ignoring return value of 'int chdir(const char*)', declared with attribute warn_unused_result [-Werror=unused-result] + chdir("/"); + ~~~~~^~~~~ +``` +--- + src/Daemon/Daemon.cpp | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp +index df318a5..be0e57e 100644 +--- a/src/Daemon/Daemon.cpp ++++ b/src/Daemon/Daemon.cpp +@@ -495,8 +495,8 @@ namespace usbguard + while (!exit_loop); + + if (pid_fd != -1) { +- lockf(pid_fd, F_ULOCK, 0); +- close(pid_fd); ++ (void)lockf(pid_fd, F_ULOCK, 0); ++ (void)close(pid_fd); + } + + IPCServer::stop(); +@@ -568,7 +568,7 @@ namespace usbguard + + /* Now we are forked 2nd time */ + umask(0047); /* no need for world-accessible or executable files */ +- chdir("/"); ++ (void)chdir("/"); + const std::array std_fds {{STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO}}; + int fd_null; + USBGUARD_SYSCALL_THROW("Daemonize", (fd_null = open("/dev/null", O_RDWR)) < 0); +-- +2.13.6 + diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index 9c44903..c096743 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -94,6 +94,18 @@ IPCAllowedGroups=wheel # DeviceRulesWithPort=false +# +# USBGuard Audit events log backend +# +# One of: +# +# * FileAudit - Log audit events into a file specified by +# AuditFilePath setting (see below) +# * LinuxAudit - Log audit events using the Linux Audit +# subsystem (using audit_log_user_message) +# +AuditBackend=FileAudit + # # USBGuard audit events log file path. # diff --git a/usbguard.spec b/usbguard.spec index 3714517..eba151f 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,15 +4,15 @@ %define with_dbus 1 Name: usbguard -Version: 0.7.0 -Release: 9%{?dist} +Version: 0.7.1 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 -URL: https://dkopecek.github.io/usbguard -Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz +URL: https://usbguard.github.io/ +Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf Requires: systemd @@ -30,6 +30,8 @@ BuildRequires: PEGTL-static BuildRequires: catch-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion +BuildRequires: asciidoctor +BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd @@ -46,14 +48,11 @@ BuildRequires: libxslt BuildRequires: libxml2 %endif -%if 0%{?fedora} -BuildRequires: pandoc -%endif - Patch0: usbguard-0.6.3-disable-cast-align-warning.patch Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch -# Bug 1499052 - usbguard-daemon fails with kernel 4.13 -Patch2: usbguard-0.7.0-kernel-4.13-fix.patch +Patch2: usbguard-0.7.1-quiet-compiler-warnings.patch +# Workaround: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 +Patch3: usbguard-0.7.1-disable-unused-result.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -117,6 +116,7 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch0 -p1 %patch1 -p1 %patch2 -p1 +%patch3 -p1 %build mkdir -p ./m4 @@ -167,7 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files %defattr(-,root,root,-) -%doc README.md CHANGELOG.md +%doc README.adoc CHANGELOG.md %license LICENSE %{_libdir}/*.so.* %{_sbindir}/usbguard-daemon @@ -228,6 +228,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Wed Dec 06 2017 Daniel Kopeček - 0.7.1-1 +- Update to 0.7.1 + * Wed Nov 29 2017 Igor Gnatenko - 0.7.0-9 - Rebuild for protobuf 3.5 From 3c3ff11717dc002d20a62c108e03e77031aa888c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 7 Dec 2017 11:51:53 +0100 Subject: [PATCH 19/85] Update to 0.7.1 --- .gitignore | 1 + sources | 2 +- usbguard-0.7.1-disable-unused-result.patch | 15 ++++++ usbguard-0.7.1-quiet-compiler-warnings.patch | 49 ++++++++++++++++++++ usbguard-daemon.conf | 12 +++++ usbguard.spec | 27 ++++++----- 6 files changed, 94 insertions(+), 12 deletions(-) create mode 100644 usbguard-0.7.1-disable-unused-result.patch create mode 100644 usbguard-0.7.1-quiet-compiler-warnings.patch diff --git a/.gitignore b/.gitignore index 1de1341..b28cf62 100644 --- a/.gitignore +++ b/.gitignore @@ -10,3 +10,4 @@ /dkopecek-usbguard-522c34c.tar.gz /dkopecek-usbguard-e528ff6.tar.gz /usbguard-0.7.0.tar.gz +/usbguard-0.7.1.tar.gz diff --git a/sources b/sources index 50ed7e9..1f21673 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.0.tar.gz) = e0a63457011379f50cc5eb14516bb1b6192d5710c81e7fa9042b67c481514158811e761e982ad16a9b1fcae62c58e68574910da1a98be3a07e6c99f69d5c03c4 +SHA512 (usbguard-0.7.1.tar.gz) = c4eb133d3f2d87552789551d8df0a0910962713c42444b8218db858a83f4d9131d1e1c62923c7a0a249dab0517f4172c636d00e714eb0a23b08307adf9eb601a diff --git a/usbguard-0.7.1-disable-unused-result.patch b/usbguard-0.7.1-disable-unused-result.patch new file mode 100644 index 0000000..98c715e --- /dev/null +++ b/usbguard-0.7.1-disable-unused-result.patch @@ -0,0 +1,15 @@ +diff -up usbguard-0.7.1/configure.ac.disable-unused-result usbguard-0.7.1/configure.ac +--- usbguard-0.7.1/configure.ac.disable-unused-result 2017-12-05 12:47:27.531879954 +0100 ++++ usbguard-0.7.1/configure.ac 2017-12-05 12:48:21.582663544 +0100 +@@ -42,6 +42,11 @@ COMMON_WARNING_FLAGS+=" -Wformat-nonlite + COMMON_WARNING_FLAGS+=" -Wno-missing-field-initializers" + + # ++# Workaround https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 ++# ++COMMON_WARNING_FLAGS+=" -Wno-unused-result" ++ ++# + # Don't warn about implicit fallthrough + # + # TODO: Use [[fallthrough]] C++ attribute specifier with diff --git a/usbguard-0.7.1-quiet-compiler-warnings.patch b/usbguard-0.7.1-quiet-compiler-warnings.patch new file mode 100644 index 0000000..0bd7c02 --- /dev/null +++ b/usbguard-0.7.1-quiet-compiler-warnings.patch @@ -0,0 +1,49 @@ +From e7f984bf1319df6059f09789c81cda877964ec24 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= +Date: Tue, 5 Dec 2017 11:01:31 +0100 +Subject: [PATCH] Quiet compiler warnings + +...for function calls where we are not interested in the result. + +Addressing: +``` +src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::run()': +src/Daemon/Daemon.cpp:498:12: error: ignoring return value of 'int lockf(int, int, __off_t)', declared with attribute warn_unused_result [-Werror=unused-result] + lockf(pid_fd, F_ULOCK, 0); + ~~~~~^~~~~~~~~~~~~~~~~~~~ +src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::daemonize(const string&)': +src/Daemon/Daemon.cpp:571:10: error: ignoring return value of 'int chdir(const char*)', declared with attribute warn_unused_result [-Werror=unused-result] + chdir("/"); + ~~~~~^~~~~ +``` +--- + src/Daemon/Daemon.cpp | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp +index df318a5..be0e57e 100644 +--- a/src/Daemon/Daemon.cpp ++++ b/src/Daemon/Daemon.cpp +@@ -495,8 +495,8 @@ namespace usbguard + while (!exit_loop); + + if (pid_fd != -1) { +- lockf(pid_fd, F_ULOCK, 0); +- close(pid_fd); ++ (void)lockf(pid_fd, F_ULOCK, 0); ++ (void)close(pid_fd); + } + + IPCServer::stop(); +@@ -568,7 +568,7 @@ namespace usbguard + + /* Now we are forked 2nd time */ + umask(0047); /* no need for world-accessible or executable files */ +- chdir("/"); ++ (void)chdir("/"); + const std::array std_fds {{STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO}}; + int fd_null; + USBGUARD_SYSCALL_THROW("Daemonize", (fd_null = open("/dev/null", O_RDWR)) < 0); +-- +2.13.6 + diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index 9c44903..c096743 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -94,6 +94,18 @@ IPCAllowedGroups=wheel # DeviceRulesWithPort=false +# +# USBGuard Audit events log backend +# +# One of: +# +# * FileAudit - Log audit events into a file specified by +# AuditFilePath setting (see below) +# * LinuxAudit - Log audit events using the Linux Audit +# subsystem (using audit_log_user_message) +# +AuditBackend=FileAudit + # # USBGuard audit events log file path. # diff --git a/usbguard.spec b/usbguard.spec index a49f3fe..3ab228e 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,15 +4,15 @@ %define with_dbus 1 Name: usbguard -Version: 0.7.0 -Release: 3%{?dist} +Version: 0.7.1 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 -URL: https://dkopecek.github.io/usbguard -Source0: https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz +URL: https://usbguard.github.io/ +Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf Requires: systemd @@ -30,6 +30,8 @@ BuildRequires: PEGTL-static BuildRequires: catch-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion +BuildRequires: asciidoctor +BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd @@ -46,13 +48,11 @@ BuildRequires: libxslt BuildRequires: libxml2 %endif -%if 0%{?fedora} -BuildRequires: pandoc -%endif - Patch0: usbguard-0.6.3-disable-cast-align-warning.patch -# Bug 1499052 - usbguard-daemon fails with kernel 4.13 -Patch1: usbguard-0.7.0-kernel-4.13-fix.patch +Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch +Patch2: usbguard-0.7.1-quiet-compiler-warnings.patch +# Workaround: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 +Patch3: usbguard-0.7.1-disable-unused-result.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -115,6 +115,8 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch0 -p1 %patch1 -p1 +%patch2 -p1 +%patch3 -p1 %build mkdir -p ./m4 @@ -165,7 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files %defattr(-,root,root,-) -%doc README.md CHANGELOG.md +%doc README.adoc CHANGELOG.md %license LICENSE %{_libdir}/*.so.* %{_sbindir}/usbguard-daemon @@ -226,6 +228,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Wed Dec 06 2017 Daniel Kopeček - 0.7.1-1 +- Update to 0.7.1 + * Mon Oct 16 2017 Daniel Kopeček 0.7.0-3 - Fix enumeration timeout on kernel >= 4.13 Resolves: rhbz#1499052 From 5d940f3a0574af43c941818565c7bcad953fe61e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 7 Dec 2017 13:05:10 +0100 Subject: [PATCH 20/85] Add missing patch: usbguard-0.7.0-disable-unused-parameter-warning.patch --- ...ard-0.7.0-disable-unused-parameter-warning.patch | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 usbguard-0.7.0-disable-unused-parameter-warning.patch diff --git a/usbguard-0.7.0-disable-unused-parameter-warning.patch b/usbguard-0.7.0-disable-unused-parameter-warning.patch new file mode 100644 index 0000000..7c0a6c8 --- /dev/null +++ b/usbguard-0.7.0-disable-unused-parameter-warning.patch @@ -0,0 +1,13 @@ +diff --git a/Makefile.am b/Makefile.am +index 090e69c..b8fb47f 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -291,7 +291,7 @@ pkginclude_HEADERS=\ + # void AddDescriptorImpl() { + # ^~~~~~~~~~~~~~~~~ + #``` +-%.pb.lo : CXXFLAGS += -Wno-missing-declarations ++%.pb.lo : CXXFLAGS += -Wno-missing-declarations -Wno-unused-parameter + + %.pb.cc %.pb.h: %.proto + $(MKDIR_P) $(top_builddir)/src/Library/IPC From c24184f99fbf7cdec5fb9d4fdaaa7cc5f3026b6a Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Tue, 16 Jan 2018 00:00:22 +0100 Subject: [PATCH 21/85] =?UTF-8?q?catch=20=E2=86=92=20catch1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Igor Gnatenko --- usbguard.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index eba151f..b8807e6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -27,7 +27,7 @@ BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch-devel +BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoctor @@ -228,6 +228,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Mon Jan 15 2018 Igor Gnatenko - 0.7.1-2 +- catch → catch1 + * Wed Dec 06 2017 Daniel Kopeček - 0.7.1-1 - Update to 0.7.1 From 0ad02dee6ae767463949c51d1972327f7bc9b1e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Tue, 23 Jan 2018 12:00:09 +0100 Subject: [PATCH 22/85] Update to usbguard-0.7.2 --- .gitignore | 1 + sources | 2 +- ...ard-0.6.3-disable-cast-align-warning.patch | 13 ---- ...7.0-disable-unused-parameter-warning.patch | 13 ---- usbguard-0.7.0-kernel-4.13-fix.patch | 68 ------------------- usbguard-0.7.1-disable-unused-result.patch | 15 ---- usbguard-0.7.1-quiet-compiler-warnings.patch | 49 ------------- usbguard-daemon.conf | 61 +++++++++++++++++ usbguard.spec | 24 +++---- 9 files changed, 72 insertions(+), 174 deletions(-) delete mode 100644 usbguard-0.6.3-disable-cast-align-warning.patch delete mode 100644 usbguard-0.7.0-disable-unused-parameter-warning.patch delete mode 100644 usbguard-0.7.0-kernel-4.13-fix.patch delete mode 100644 usbguard-0.7.1-disable-unused-result.patch delete mode 100644 usbguard-0.7.1-quiet-compiler-warnings.patch diff --git a/.gitignore b/.gitignore index b28cf62..4c6ae5f 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /dkopecek-usbguard-e528ff6.tar.gz /usbguard-0.7.0.tar.gz /usbguard-0.7.1.tar.gz +/usbguard-0.7.2.tar.gz diff --git a/sources b/sources index 1f21673..1f06437 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.1.tar.gz) = c4eb133d3f2d87552789551d8df0a0910962713c42444b8218db858a83f4d9131d1e1c62923c7a0a249dab0517f4172c636d00e714eb0a23b08307adf9eb601a +SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61 diff --git a/usbguard-0.6.3-disable-cast-align-warning.patch b/usbguard-0.6.3-disable-cast-align-warning.patch deleted file mode 100644 index 20fd18a..0000000 --- a/usbguard-0.6.3-disable-cast-align-warning.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 6727391..51cef14 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -24,7 +24,7 @@ COMMON_WARNING_FLAGS+=" -Wall" - COMMON_WARNING_FLAGS+=" -Wextra" - COMMON_WARNING_FLAGS+=" -Wformat=2" - COMMON_WARNING_FLAGS+=" -Wredundant-decls" --COMMON_WARNING_FLAGS+=" -Wcast-align" -+#COMMON_WARNING_FLAGS+=" -Wcast-align" - COMMON_WARNING_FLAGS+=" -Wmissing-declarations" - COMMON_WARNING_FLAGS+=" -Wmissing-include-dirs" - COMMON_WARNING_FLAGS+=" -Wmissing-format-attribute" diff --git a/usbguard-0.7.0-disable-unused-parameter-warning.patch b/usbguard-0.7.0-disable-unused-parameter-warning.patch deleted file mode 100644 index 7c0a6c8..0000000 --- a/usbguard-0.7.0-disable-unused-parameter-warning.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 090e69c..b8fb47f 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -291,7 +291,7 @@ pkginclude_HEADERS=\ - # void AddDescriptorImpl() { - # ^~~~~~~~~~~~~~~~~ - #``` --%.pb.lo : CXXFLAGS += -Wno-missing-declarations -+%.pb.lo : CXXFLAGS += -Wno-missing-declarations -Wno-unused-parameter - - %.pb.cc %.pb.h: %.proto - $(MKDIR_P) $(top_builddir)/src/Library/IPC diff --git a/usbguard-0.7.0-kernel-4.13-fix.patch b/usbguard-0.7.0-kernel-4.13-fix.patch deleted file mode 100644 index 09188f2..0000000 --- a/usbguard-0.7.0-kernel-4.13-fix.patch +++ /dev/null @@ -1,68 +0,0 @@ -diff -up usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig usbguard-0.7.0/src/Library/SysFSDevice.cpp ---- usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig 2017-10-16 09:40:33.257969336 +0200 -+++ usbguard-0.7.0/src/Library/SysFSDevice.cpp 2017-10-16 09:42:11.110603414 +0200 -@@ -126,6 +126,20 @@ namespace usbguard - return fd; - } - -+ bool SysFSDevice::hasAttribute(const std::string& name) const -+ { -+ struct ::stat st; -+ -+ if (::fstatat(_sysfs_dirfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) != 0) { -+ if (errno == ENOENT) { -+ return false; -+ } -+ throw ErrnoException("SysFSDevice::hasAttribute", name, errno); -+ } -+ -+ return S_ISREG(st.st_mode); -+ } -+ - String SysFSDevice::readAttribute(const String& name, bool strip_last_null, bool optional) const - { - USBGUARD_LOG(Trace) << "name=" << name; -diff -up usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig usbguard-0.7.0/src/Library/SysFSDevice.hpp ---- usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig 2017-10-16 09:40:33.258969332 +0200 -+++ usbguard-0.7.0/src/Library/SysFSDevice.hpp 2017-10-16 09:42:52.346449212 +0200 -@@ -36,6 +36,7 @@ namespace usbguard - const String& getName() const; - const UEvent& getUEvent() const; - const String& getParentPath() const; -+ bool hasAttribute(const std::string& name) const; - String readAttribute(const String& name, bool strip_last_null = false, bool optional = false) const; - void setAttribute(const String& name, const String& value); - int openAttribute(const String& name) const; -diff -up usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig usbguard-0.7.0/src/Library/UEventDeviceManager.cpp ---- usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig 2017-01-29 18:52:18.290000000 +0100 -+++ usbguard-0.7.0/src/Library/UEventDeviceManager.cpp 2017-10-16 09:40:33.259969329 +0200 -@@ -572,7 +572,12 @@ namespace usbguard { - const String devtype = uevent.getAttribute("DEVTYPE"); - const String action = uevent.getAttribute("ACTION"); - -- if (subsystem != "usb" || devtype != "usb_device") { -+ /* -+ * We don't care about the event if it's not from the "usb" subsystem. -+ * The device type attribute value is checked later based on the data -+ * read from the sysfs uevent file in the device directory. -+ */ -+ if (subsystem != "usb") { - USBGUARD_LOG(Debug) << "Ignoring non-USB device:" - << " subsystem=" << subsystem - << " devtype=" << devtype -@@ -602,8 +607,13 @@ namespace usbguard { - if (sysfs_device.getUEvent().hasAttribute("DEVTYPE")) { - const String devtype = sysfs_device.getUEvent().getAttribute("DEVTYPE"); - if (devtype != "usb_device") { -- USBGUARD_LOG(Warning) << sysfs_devpath << ": UEvent DEVTYPE mismatch." -- << " Expected \"usb_device\", got \"" << devtype << "\""; -+ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent DEVTYPE != usb_device. Ignoring event."; -+ return; -+ } -+ } -+ else { -+ if (!sysfs_device.hasAttribute("descriptors")) { -+ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent doesn't refer to a device with a descriptors file. Ignoring event."; - return; - } - } diff --git a/usbguard-0.7.1-disable-unused-result.patch b/usbguard-0.7.1-disable-unused-result.patch deleted file mode 100644 index 98c715e..0000000 --- a/usbguard-0.7.1-disable-unused-result.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up usbguard-0.7.1/configure.ac.disable-unused-result usbguard-0.7.1/configure.ac ---- usbguard-0.7.1/configure.ac.disable-unused-result 2017-12-05 12:47:27.531879954 +0100 -+++ usbguard-0.7.1/configure.ac 2017-12-05 12:48:21.582663544 +0100 -@@ -42,6 +42,11 @@ COMMON_WARNING_FLAGS+=" -Wformat-nonlite - COMMON_WARNING_FLAGS+=" -Wno-missing-field-initializers" - - # -+# Workaround https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 -+# -+COMMON_WARNING_FLAGS+=" -Wno-unused-result" -+ -+# - # Don't warn about implicit fallthrough - # - # TODO: Use [[fallthrough]] C++ attribute specifier with diff --git a/usbguard-0.7.1-quiet-compiler-warnings.patch b/usbguard-0.7.1-quiet-compiler-warnings.patch deleted file mode 100644 index 0bd7c02..0000000 --- a/usbguard-0.7.1-quiet-compiler-warnings.patch +++ /dev/null @@ -1,49 +0,0 @@ -From e7f984bf1319df6059f09789c81cda877964ec24 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= -Date: Tue, 5 Dec 2017 11:01:31 +0100 -Subject: [PATCH] Quiet compiler warnings - -...for function calls where we are not interested in the result. - -Addressing: -``` -src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::run()': -src/Daemon/Daemon.cpp:498:12: error: ignoring return value of 'int lockf(int, int, __off_t)', declared with attribute warn_unused_result [-Werror=unused-result] - lockf(pid_fd, F_ULOCK, 0); - ~~~~~^~~~~~~~~~~~~~~~~~~~ -src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::daemonize(const string&)': -src/Daemon/Daemon.cpp:571:10: error: ignoring return value of 'int chdir(const char*)', declared with attribute warn_unused_result [-Werror=unused-result] - chdir("/"); - ~~~~~^~~~~ -``` ---- - src/Daemon/Daemon.cpp | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index df318a5..be0e57e 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -495,8 +495,8 @@ namespace usbguard - while (!exit_loop); - - if (pid_fd != -1) { -- lockf(pid_fd, F_ULOCK, 0); -- close(pid_fd); -+ (void)lockf(pid_fd, F_ULOCK, 0); -+ (void)close(pid_fd); - } - - IPCServer::stop(); -@@ -568,7 +568,7 @@ namespace usbguard - - /* Now we are forked 2nd time */ - umask(0047); /* no need for world-accessible or executable files */ -- chdir("/"); -+ (void)chdir("/"); - const std::array std_fds {{STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO}}; - int fd_null; - USBGUARD_SYSCALL_THROW("Daemonize", (fd_null = open("/dev/null", O_RDWR)) < 0); --- -2.13.6 - diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index c096743..e9800b2 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -51,6 +51,48 @@ PresentDevicePolicy=apply-policy # PresentControllerPolicy=keep +# +# Inserted device policy. +# +# How to treat USB devices that are already connected +# *after* the daemon starts. One of: +# +# * block - deauthorize every present device +# * reject - remove every present device +# * apply-policy - evaluate the ruleset for every present +# device +# +InsertedDevicePolicy=apply-policy + +# +# Restore controller device state. +# +# The USBGuard daemon modifies some attributes of controller +# devices like the default authorization state of new child device +# instances. Using this setting, you can controll whether the +# daemon will try to restore the attribute values to the state +# before modificaton on shutdown. +# +# SECURITY CONSIDERATIONS: If set to true, the USB authorization +# policy could be bypassed by performing some sort of attack on the +# daemon (via a local exploit or via a USB device) to make it shutdown +# and restore to the operating-system default state (known to be permissive). +# +RestoreControllerDeviceState=false + +# +# Device manager backend +# +# Which device manager backend implementation to use. One of: +# +# * uevent - Netlink based implementation which uses sysfs to scan for present +# devices and an uevent netlink socket for receiving USB device +# related events. +# * dummy - A dummy device manager which simulates several devices and device +# events. Useful for testing. +# +DeviceManagerBackend=uevent + #!!! WARNING: It's good practice to set at least one of the !!! #!!! two options bellow. If none of them are set, !!! #!!! the daemon will accept IPC connections from !!! @@ -77,6 +119,24 @@ IPCAllowedUsers=root # IPCAllowedGroups=wheel +# +# IPC access control definition files path. +# +# The files at this location will be interpreted by the daemon +# as access control definition files. The (base)name of a file +# should be in the form: +# +# [user][:] +# +# and should contain lines in the form: +# +#
=[privilege] ... +# +# This way each file defines who is able to connect to the IPC +# bus and what privileges he has. +# +IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ + # # Generate device specific rules including the "via-port" # attribute. @@ -110,3 +170,4 @@ AuditBackend=FileAudit # USBGuard audit events log file path. # AuditFilePath=/var/log/usbguard/usbguard-audit.log + diff --git a/usbguard.spec b/usbguard.spec index b8807e6..fedb194 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,8 +4,8 @@ %define with_dbus 1 Name: usbguard -Version: 0.7.1 -Release: 2%{?dist} +Version: 0.7.2 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -48,12 +48,6 @@ BuildRequires: libxslt BuildRequires: libxml2 %endif -Patch0: usbguard-0.6.3-disable-cast-align-warning.patch -Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch -Patch2: usbguard-0.7.1-quiet-compiler-warnings.patch -# Workaround: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 -Patch3: usbguard-0.7.1-disable-unused-result.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -113,11 +107,6 @@ a D-Bus interface to the USBGuard daemon component. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 - %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -136,8 +125,7 @@ autoreconf -i -v --no-recursive ./ --without-dbus \ --without-polkit \ %endif - --with-crypto-library=gcrypt \ - --enable-werror + --with-crypto-library=gcrypt make %{?_smp_mflags} @@ -149,6 +137,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf # Cleanup @@ -228,6 +217,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Tue Jan 23 2018 Daniel Kopeček - 0.7.2-1 +- Update to 0.7.2 +- Don't use --enable-werror downstream +- Removed patches related to compiler warnings + * Mon Jan 15 2018 Igor Gnatenko - 0.7.1-2 - catch → catch1 From df7a04d12f079d389b6f98189d4229cf205c4170 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Tue, 23 Jan 2018 12:00:09 +0100 Subject: [PATCH 23/85] Update to usbguard-0.7.2 --- .gitignore | 1 + sources | 2 +- ...ard-0.6.3-disable-cast-align-warning.patch | 13 ---- ...7.0-disable-unused-parameter-warning.patch | 13 ---- usbguard-0.7.0-kernel-4.13-fix.patch | 68 ------------------- usbguard-0.7.1-disable-unused-result.patch | 15 ---- usbguard-0.7.1-quiet-compiler-warnings.patch | 49 ------------- usbguard-daemon.conf | 61 +++++++++++++++++ usbguard.spec | 22 +++--- 9 files changed, 71 insertions(+), 173 deletions(-) delete mode 100644 usbguard-0.6.3-disable-cast-align-warning.patch delete mode 100644 usbguard-0.7.0-disable-unused-parameter-warning.patch delete mode 100644 usbguard-0.7.0-kernel-4.13-fix.patch delete mode 100644 usbguard-0.7.1-disable-unused-result.patch delete mode 100644 usbguard-0.7.1-quiet-compiler-warnings.patch diff --git a/.gitignore b/.gitignore index b28cf62..4c6ae5f 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ /dkopecek-usbguard-e528ff6.tar.gz /usbguard-0.7.0.tar.gz /usbguard-0.7.1.tar.gz +/usbguard-0.7.2.tar.gz diff --git a/sources b/sources index 1f21673..1f06437 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.1.tar.gz) = c4eb133d3f2d87552789551d8df0a0910962713c42444b8218db858a83f4d9131d1e1c62923c7a0a249dab0517f4172c636d00e714eb0a23b08307adf9eb601a +SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61 diff --git a/usbguard-0.6.3-disable-cast-align-warning.patch b/usbguard-0.6.3-disable-cast-align-warning.patch deleted file mode 100644 index 20fd18a..0000000 --- a/usbguard-0.6.3-disable-cast-align-warning.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 6727391..51cef14 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -24,7 +24,7 @@ COMMON_WARNING_FLAGS+=" -Wall" - COMMON_WARNING_FLAGS+=" -Wextra" - COMMON_WARNING_FLAGS+=" -Wformat=2" - COMMON_WARNING_FLAGS+=" -Wredundant-decls" --COMMON_WARNING_FLAGS+=" -Wcast-align" -+#COMMON_WARNING_FLAGS+=" -Wcast-align" - COMMON_WARNING_FLAGS+=" -Wmissing-declarations" - COMMON_WARNING_FLAGS+=" -Wmissing-include-dirs" - COMMON_WARNING_FLAGS+=" -Wmissing-format-attribute" diff --git a/usbguard-0.7.0-disable-unused-parameter-warning.patch b/usbguard-0.7.0-disable-unused-parameter-warning.patch deleted file mode 100644 index 7c0a6c8..0000000 --- a/usbguard-0.7.0-disable-unused-parameter-warning.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 090e69c..b8fb47f 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -291,7 +291,7 @@ pkginclude_HEADERS=\ - # void AddDescriptorImpl() { - # ^~~~~~~~~~~~~~~~~ - #``` --%.pb.lo : CXXFLAGS += -Wno-missing-declarations -+%.pb.lo : CXXFLAGS += -Wno-missing-declarations -Wno-unused-parameter - - %.pb.cc %.pb.h: %.proto - $(MKDIR_P) $(top_builddir)/src/Library/IPC diff --git a/usbguard-0.7.0-kernel-4.13-fix.patch b/usbguard-0.7.0-kernel-4.13-fix.patch deleted file mode 100644 index 09188f2..0000000 --- a/usbguard-0.7.0-kernel-4.13-fix.patch +++ /dev/null @@ -1,68 +0,0 @@ -diff -up usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig usbguard-0.7.0/src/Library/SysFSDevice.cpp ---- usbguard-0.7.0/src/Library/SysFSDevice.cpp.orig 2017-10-16 09:40:33.257969336 +0200 -+++ usbguard-0.7.0/src/Library/SysFSDevice.cpp 2017-10-16 09:42:11.110603414 +0200 -@@ -126,6 +126,20 @@ namespace usbguard - return fd; - } - -+ bool SysFSDevice::hasAttribute(const std::string& name) const -+ { -+ struct ::stat st; -+ -+ if (::fstatat(_sysfs_dirfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) != 0) { -+ if (errno == ENOENT) { -+ return false; -+ } -+ throw ErrnoException("SysFSDevice::hasAttribute", name, errno); -+ } -+ -+ return S_ISREG(st.st_mode); -+ } -+ - String SysFSDevice::readAttribute(const String& name, bool strip_last_null, bool optional) const - { - USBGUARD_LOG(Trace) << "name=" << name; -diff -up usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig usbguard-0.7.0/src/Library/SysFSDevice.hpp ---- usbguard-0.7.0/src/Library/SysFSDevice.hpp.orig 2017-10-16 09:40:33.258969332 +0200 -+++ usbguard-0.7.0/src/Library/SysFSDevice.hpp 2017-10-16 09:42:52.346449212 +0200 -@@ -36,6 +36,7 @@ namespace usbguard - const String& getName() const; - const UEvent& getUEvent() const; - const String& getParentPath() const; -+ bool hasAttribute(const std::string& name) const; - String readAttribute(const String& name, bool strip_last_null = false, bool optional = false) const; - void setAttribute(const String& name, const String& value); - int openAttribute(const String& name) const; -diff -up usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig usbguard-0.7.0/src/Library/UEventDeviceManager.cpp ---- usbguard-0.7.0/src/Library/UEventDeviceManager.cpp.orig 2017-01-29 18:52:18.290000000 +0100 -+++ usbguard-0.7.0/src/Library/UEventDeviceManager.cpp 2017-10-16 09:40:33.259969329 +0200 -@@ -572,7 +572,12 @@ namespace usbguard { - const String devtype = uevent.getAttribute("DEVTYPE"); - const String action = uevent.getAttribute("ACTION"); - -- if (subsystem != "usb" || devtype != "usb_device") { -+ /* -+ * We don't care about the event if it's not from the "usb" subsystem. -+ * The device type attribute value is checked later based on the data -+ * read from the sysfs uevent file in the device directory. -+ */ -+ if (subsystem != "usb") { - USBGUARD_LOG(Debug) << "Ignoring non-USB device:" - << " subsystem=" << subsystem - << " devtype=" << devtype -@@ -602,8 +607,13 @@ namespace usbguard { - if (sysfs_device.getUEvent().hasAttribute("DEVTYPE")) { - const String devtype = sysfs_device.getUEvent().getAttribute("DEVTYPE"); - if (devtype != "usb_device") { -- USBGUARD_LOG(Warning) << sysfs_devpath << ": UEvent DEVTYPE mismatch." -- << " Expected \"usb_device\", got \"" << devtype << "\""; -+ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent DEVTYPE != usb_device. Ignoring event."; -+ return; -+ } -+ } -+ else { -+ if (!sysfs_device.hasAttribute("descriptors")) { -+ USBGUARD_LOG(Debug) << sysfs_devpath << ": UEvent doesn't refer to a device with a descriptors file. Ignoring event."; - return; - } - } diff --git a/usbguard-0.7.1-disable-unused-result.patch b/usbguard-0.7.1-disable-unused-result.patch deleted file mode 100644 index 98c715e..0000000 --- a/usbguard-0.7.1-disable-unused-result.patch +++ /dev/null @@ -1,15 +0,0 @@ -diff -up usbguard-0.7.1/configure.ac.disable-unused-result usbguard-0.7.1/configure.ac ---- usbguard-0.7.1/configure.ac.disable-unused-result 2017-12-05 12:47:27.531879954 +0100 -+++ usbguard-0.7.1/configure.ac 2017-12-05 12:48:21.582663544 +0100 -@@ -42,6 +42,11 @@ COMMON_WARNING_FLAGS+=" -Wformat-nonlite - COMMON_WARNING_FLAGS+=" -Wno-missing-field-initializers" - - # -+# Workaround https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 -+# -+COMMON_WARNING_FLAGS+=" -Wno-unused-result" -+ -+# - # Don't warn about implicit fallthrough - # - # TODO: Use [[fallthrough]] C++ attribute specifier with diff --git a/usbguard-0.7.1-quiet-compiler-warnings.patch b/usbguard-0.7.1-quiet-compiler-warnings.patch deleted file mode 100644 index 0bd7c02..0000000 --- a/usbguard-0.7.1-quiet-compiler-warnings.patch +++ /dev/null @@ -1,49 +0,0 @@ -From e7f984bf1319df6059f09789c81cda877964ec24 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= -Date: Tue, 5 Dec 2017 11:01:31 +0100 -Subject: [PATCH] Quiet compiler warnings - -...for function calls where we are not interested in the result. - -Addressing: -``` -src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::run()': -src/Daemon/Daemon.cpp:498:12: error: ignoring return value of 'int lockf(int, int, __off_t)', declared with attribute warn_unused_result [-Werror=unused-result] - lockf(pid_fd, F_ULOCK, 0); - ~~~~~^~~~~~~~~~~~~~~~~~~~ -src/Daemon/Daemon.cpp: In member function 'void usbguard::Daemon::daemonize(const string&)': -src/Daemon/Daemon.cpp:571:10: error: ignoring return value of 'int chdir(const char*)', declared with attribute warn_unused_result [-Werror=unused-result] - chdir("/"); - ~~~~~^~~~~ -``` ---- - src/Daemon/Daemon.cpp | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index df318a5..be0e57e 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -495,8 +495,8 @@ namespace usbguard - while (!exit_loop); - - if (pid_fd != -1) { -- lockf(pid_fd, F_ULOCK, 0); -- close(pid_fd); -+ (void)lockf(pid_fd, F_ULOCK, 0); -+ (void)close(pid_fd); - } - - IPCServer::stop(); -@@ -568,7 +568,7 @@ namespace usbguard - - /* Now we are forked 2nd time */ - umask(0047); /* no need for world-accessible or executable files */ -- chdir("/"); -+ (void)chdir("/"); - const std::array std_fds {{STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO}}; - int fd_null; - USBGUARD_SYSCALL_THROW("Daemonize", (fd_null = open("/dev/null", O_RDWR)) < 0); --- -2.13.6 - diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index c096743..e9800b2 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -51,6 +51,48 @@ PresentDevicePolicy=apply-policy # PresentControllerPolicy=keep +# +# Inserted device policy. +# +# How to treat USB devices that are already connected +# *after* the daemon starts. One of: +# +# * block - deauthorize every present device +# * reject - remove every present device +# * apply-policy - evaluate the ruleset for every present +# device +# +InsertedDevicePolicy=apply-policy + +# +# Restore controller device state. +# +# The USBGuard daemon modifies some attributes of controller +# devices like the default authorization state of new child device +# instances. Using this setting, you can controll whether the +# daemon will try to restore the attribute values to the state +# before modificaton on shutdown. +# +# SECURITY CONSIDERATIONS: If set to true, the USB authorization +# policy could be bypassed by performing some sort of attack on the +# daemon (via a local exploit or via a USB device) to make it shutdown +# and restore to the operating-system default state (known to be permissive). +# +RestoreControllerDeviceState=false + +# +# Device manager backend +# +# Which device manager backend implementation to use. One of: +# +# * uevent - Netlink based implementation which uses sysfs to scan for present +# devices and an uevent netlink socket for receiving USB device +# related events. +# * dummy - A dummy device manager which simulates several devices and device +# events. Useful for testing. +# +DeviceManagerBackend=uevent + #!!! WARNING: It's good practice to set at least one of the !!! #!!! two options bellow. If none of them are set, !!! #!!! the daemon will accept IPC connections from !!! @@ -77,6 +119,24 @@ IPCAllowedUsers=root # IPCAllowedGroups=wheel +# +# IPC access control definition files path. +# +# The files at this location will be interpreted by the daemon +# as access control definition files. The (base)name of a file +# should be in the form: +# +# [user][:] +# +# and should contain lines in the form: +# +#
=[privilege] ... +# +# This way each file defines who is able to connect to the IPC +# bus and what privileges he has. +# +IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/ + # # Generate device specific rules including the "via-port" # attribute. @@ -110,3 +170,4 @@ AuditBackend=FileAudit # USBGuard audit events log file path. # AuditFilePath=/var/log/usbguard/usbguard-audit.log + diff --git a/usbguard.spec b/usbguard.spec index 3ab228e..7cfd3a8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ %define with_dbus 1 Name: usbguard -Version: 0.7.1 +Version: 0.7.2 Release: 1%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons @@ -48,12 +48,6 @@ BuildRequires: libxslt BuildRequires: libxml2 %endif -Patch0: usbguard-0.6.3-disable-cast-align-warning.patch -Patch1: usbguard-0.7.0-disable-unused-parameter-warning.patch -Patch2: usbguard-0.7.1-quiet-compiler-warnings.patch -# Workaround: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 -Patch3: usbguard-0.7.1-disable-unused-result.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -113,11 +107,6 @@ a D-Bus interface to the USBGuard daemon component. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 - %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -136,8 +125,7 @@ autoreconf -i -v --no-recursive ./ --without-dbus \ --without-polkit \ %endif - --with-crypto-library=gcrypt \ - --enable-werror + --with-crypto-library=gcrypt make %{?_smp_mflags} @@ -149,6 +137,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf # Cleanup @@ -228,6 +217,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Tue Jan 23 2018 Daniel Kopeček - 0.7.2-1 +- Update to 0.7.2 +- Don't use --enable-werror downstream +- Removed patches related to compiler warnings + * Wed Dec 06 2017 Daniel Kopeček - 0.7.1-1 - Update to 0.7.1 From 13913e002c2245b7320299f8beba144fa45870fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Tue, 23 Jan 2018 14:49:41 +0100 Subject: [PATCH 24/85] Escape rpm macros mentioned in changelog section Resolves: #1527956 --- usbguard.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index fedb194..08d2a21 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -217,6 +217,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Tue Jan 23 2018 Daniel Kopeček - 0.7.2-2 +- Escape rpm macros mentioned in changelog section + * Tue Jan 23 2018 Daniel Kopeček - 0.7.2-1 - Update to 0.7.2 - Don't use --enable-werror downstream @@ -332,7 +335,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' * Tue Apr 14 2015 Daniel Kopecek 0.3p3-1 - Update to version 0.3p3 -- added %check section +- added %%check section - removed explicit -devel requires on systemd, libqb and libsodium devel files - added -devel requires on libstdc++-devel From 7d9285f67a43c050c70f8dd394f626ec07b28105 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Tue, 23 Jan 2018 14:49:41 +0100 Subject: [PATCH 25/85] Escape rpm macros mentioned in changelog section Resolves: #1527956 --- usbguard.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 7cfd3a8..84abb61 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -217,6 +217,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Tue Jan 23 2018 Daniel Kopeček - 0.7.2-2 +- Escape rpm macros mentioned in changelog section + * Tue Jan 23 2018 Daniel Kopeček - 0.7.2-1 - Update to 0.7.2 - Don't use --enable-werror downstream @@ -310,7 +313,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' * Tue Apr 14 2015 Daniel Kopecek 0.3p3-1 - Update to version 0.3p3 -- added %check section +- added %%check section - removed explicit -devel requires on systemd, libqb and libsodium devel files - added -devel requires on libstdc++-devel From 0f5b605e381ebe43d04a9fe881a9658e997fb583 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 9 Feb 2018 20:10:33 +0000 Subject: [PATCH 26/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 08d2a21..0b91e7d 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -217,6 +217,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Fri Feb 09 2018 Fedora Release Engineering - 0.7.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Tue Jan 23 2018 Daniel Kopeček - 0.7.2-2 - Escape rpm macros mentioned in changelog section From b434466770fa865e796ea63f659e2f9bf164039a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Kope=C4=8Dek?= Date: Thu, 5 Apr 2018 13:55:14 +0200 Subject: [PATCH 27/85] Update to latest PEGTL API --- 0001-Update-to-latest-PEGTL-API.patch | 567 ++++++++++++++++++++++++++ usbguard.spec | 9 +- 2 files changed, 575 insertions(+), 1 deletion(-) create mode 100644 0001-Update-to-latest-PEGTL-API.patch diff --git a/0001-Update-to-latest-PEGTL-API.patch b/0001-Update-to-latest-PEGTL-API.patch new file mode 100644 index 0000000..1ebfd1e --- /dev/null +++ b/0001-Update-to-latest-PEGTL-API.patch @@ -0,0 +1,567 @@ +diff --git a/configure.ac b/configure.ac +index a135e01..f565b87 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -290,54 +290,28 @@ AC_SUBST([catch_LIBS]) + # + AC_ARG_WITH([bundled-pegtl], AS_HELP_STRING([--with-bundled-pegtl], [Build using the bundled PEGTL library]), [with_bundled_pegtl=$withval], [with_bundled_pegtl=no]) + if test "x$with_bundled_pegtl" = xyes; then +- pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL" +- pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL" ++ pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL/include" ++ pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL/include" + pegtl_LIBS="" + AC_MSG_NOTICE([Using bundled PEGTL library]) + pegtl_summary="bundled; $pegtl_CFLAGS $pegtl_LIBS" + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++11 $CPPFLAGS" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([pegtl.hh], [], [AC_MSG_FAILURE(pegtl.hh not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) +- AC_LANG_POP + pegtl_CFLAGS="" + pegtl_AC_CFLAGS="" + pegtl_LIBS="" +- CPPFLAGS=$SAVE_CPPFLAGS + pegtl_summary="system-wide; $pegtl_CFLAGS $pegtl_LIBS" + fi + AC_SUBST([pegtl_CFLAGS]) + AC_SUBST([pegtl_AC_CFLAGS]) + AC_SUBST([pegtl_LIBS]) + +-# +-# Check whether the available PEGTL library is compatible +-# with version 1.3.1 or older. +-# + SAVE_CPPFLAGS=$CPPFLAGS +-CPPFLAGS="-std=c++11 $pegtl_AC_CFLAGS" ++CPPFLAGS="-std=c++11 $CPPFLAGS $pegtl_AC_CFLAGS" + AC_LANG_PUSH([C++]) +-AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ +-#include +-#include +-int main(void) +-{ +- struct grammar +- : pegtl::one<'g'> {}; +- try { +- pegtl::parse_string(std::string(), std::string()); +- } catch(const pegtl::parse_error& ex) { +- auto b = ex.positions[0].byte_in_line; +- } +- return 0; +-} +-]])], +-[have_pegtl_lte_131=no], [have_pegtl_lte_131=yes]) ++AC_CHECK_HEADER([tao/pegtl.hpp], ++ [AC_DEFINE([HAVE_TAO_PEGTL_HPP], [1], [PEGTL header file with .hpp extension is present])], ++ [AC_MSG_FAILURE(PEGTL header file not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) + AC_LANG_POP +-if test "x$have_pegtl_lte_131" = xyes; then +- AC_DEFINE([HAVE_PEGTL_LTE_1_3_1], [1], [PEGTL version less than or equal to 1.3.1]) +-fi + CPPFLAGS=$SAVE_CPPFLAGS + + # +diff --git a/src/Library/RuleParser/Actions.hpp b/src/Library/RuleParser/Actions.hpp +index 3e185f4..2b21bd2 100644 +--- a/src/Library/RuleParser/Actions.hpp ++++ b/src/Library/RuleParser/Actions.hpp +@@ -24,7 +24,7 @@ + #include "Utility.hpp" + #include "Common/Utility.hpp" + +-#include ++#include + + namespace usbguard + { +@@ -47,7 +47,7 @@ namespace usbguard + struct str_if; + + template +- struct rule_parser_actions : pegtl::nothing {}; ++ struct rule_parser_actions : tao::pegtl::nothing {}; + + template<> + struct rule_parser_actions { +@@ -58,7 +58,7 @@ namespace usbguard + rule.setTarget(Rule::targetFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -75,7 +75,7 @@ namespace usbguard + rule.setDeviceID(device_id); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -87,7 +87,7 @@ namespace usbguard + } + + template +- struct name_actions : pegtl::nothing {}; ++ struct name_actions : tao::pegtl::nothing {}; + + template<> + struct name_actions { +@@ -95,7 +95,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeName().empty()) { +- throw pegtl::parse_error("name attribute already defined", in); ++ throw tao::pegtl::parse_error("name attribute already defined", in); + } + } + }; +@@ -109,7 +109,7 @@ namespace usbguard + rule.attributeName().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -123,13 +123,13 @@ namespace usbguard + rule.attributeName().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct id_actions : pegtl::nothing {}; ++ struct id_actions : tao::pegtl::nothing {}; + + template<> + struct id_actions { +@@ -137,7 +137,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeDeviceID().empty()) { +- throw pegtl::parse_error("id attribute already defined", in); ++ throw tao::pegtl::parse_error("id attribute already defined", in); + } + } + }; +@@ -154,7 +154,7 @@ namespace usbguard + rule.attributeDeviceID().append(device_id); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -168,13 +168,13 @@ namespace usbguard + rule.attributeDeviceID().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct hash_actions : pegtl::nothing {}; ++ struct hash_actions : tao::pegtl::nothing {}; + + template<> + struct hash_actions { +@@ -182,7 +182,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeHash().empty()) { +- throw pegtl::parse_error("hash attribute already defined", in); ++ throw tao::pegtl::parse_error("hash attribute already defined", in); + } + } + }; +@@ -196,7 +196,7 @@ namespace usbguard + rule.attributeHash().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -210,13 +210,13 @@ namespace usbguard + rule.attributeHash().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct parent_hash_actions : pegtl::nothing {}; ++ struct parent_hash_actions : tao::pegtl::nothing {}; + + template<> + struct parent_hash_actions { +@@ -224,7 +224,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeParentHash().empty()) { +- throw pegtl::parse_error("parent-hash attribute already defined", in); ++ throw tao::pegtl::parse_error("parent-hash attribute already defined", in); + } + } + }; +@@ -238,7 +238,7 @@ namespace usbguard + rule.attributeParentHash().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -252,13 +252,13 @@ namespace usbguard + rule.attributeParentHash().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct serial_actions : pegtl::nothing {}; ++ struct serial_actions : tao::pegtl::nothing {}; + + template<> + struct serial_actions { +@@ -266,7 +266,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeSerial().empty()) { +- throw pegtl::parse_error("serial attribute already defined", in); ++ throw tao::pegtl::parse_error("serial attribute already defined", in); + } + } + }; +@@ -280,7 +280,7 @@ namespace usbguard + rule.attributeSerial().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -294,13 +294,13 @@ namespace usbguard + rule.attributeSerial().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct via_port_actions : pegtl::nothing {}; ++ struct via_port_actions : tao::pegtl::nothing {}; + + template<> + struct via_port_actions { +@@ -308,7 +308,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeViaPort().empty()) { +- throw pegtl::parse_error("via-port attribute already defined", in); ++ throw tao::pegtl::parse_error("via-port attribute already defined", in); + } + } + }; +@@ -322,7 +322,7 @@ namespace usbguard + rule.attributeViaPort().append(stringValueFromRule(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -336,13 +336,13 @@ namespace usbguard + rule.attributeViaPort().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct with_interface_actions : pegtl::nothing {}; ++ struct with_interface_actions : tao::pegtl::nothing {}; + + template<> + struct with_interface_actions { +@@ -350,7 +350,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeWithInterface().empty()) { +- throw pegtl::parse_error("with-interface attribute already defined", in); ++ throw tao::pegtl::parse_error("with-interface attribute already defined", in); + } + } + }; +@@ -365,7 +365,7 @@ namespace usbguard + rule.attributeWithInterface().append(interface_type); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -379,13 +379,13 @@ namespace usbguard + rule.attributeWithInterface().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; + + template +- struct condition_actions : pegtl::nothing {}; ++ struct condition_actions : tao::pegtl::nothing {}; + + template<> + struct condition_actions { +@@ -393,7 +393,7 @@ namespace usbguard + static void apply(const Input& in, Rule& rule) + { + if (!rule.attributeConditions().empty()) { +- throw pegtl::parse_error("conditions already defined", in); ++ throw tao::pegtl::parse_error("conditions already defined", in); + } + } + }; +@@ -407,7 +407,7 @@ namespace usbguard + rule.attributeConditions().append(RuleCondition(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +@@ -421,7 +421,7 @@ namespace usbguard + rule.attributeConditions().setSetOperator(Rule::setOperatorFromString(in.string())); + } + catch (const std::exception& ex) { +- throw pegtl::parse_error(ex.what(), in); ++ throw tao::pegtl::parse_error(ex.what(), in); + } + } + }; +diff --git a/src/Library/RuleParser/Grammar.hpp b/src/Library/RuleParser/Grammar.hpp +index 9bd4a15..4d785c0 100644 +--- a/src/Library/RuleParser/Grammar.hpp ++++ b/src/Library/RuleParser/Grammar.hpp +@@ -22,37 +22,37 @@ + #endif + + #include "Actions.hpp" +-#include + +-using namespace pegtl; ++#include + + namespace usbguard + { + namespace RuleParser + { ++ using namespace tao::pegtl; + /* + * Rule language keywords + */ +- struct str_allow : pegtl_string_t("allow") {}; +- struct str_block : pegtl_string_t("block") {}; +- struct str_reject : pegtl_string_t("reject") {}; +- struct str_match : pegtl_string_t("match") {}; +- struct str_device : pegtl_string_t("device") {}; +- +- struct str_name : pegtl_string_t("name") {}; +- struct str_hash : pegtl_string_t("hash") {}; +- struct str_parent_hash : pegtl_string_t("parent-hash") {}; +- struct str_via_port : pegtl_string_t("via-port") {}; +- struct str_with_interface : pegtl_string_t("with-interface") {}; +- struct str_serial : pegtl_string_t("serial") {}; +- struct str_if : pegtl_string_t("if") {}; +- struct str_id : pegtl_string_t("id") {}; +- +- struct str_all_of : pegtl_string_t("all-of") {}; +- struct str_one_of : pegtl_string_t("one-of") {}; +- struct str_none_of : pegtl_string_t("none-of") {}; +- struct str_equals : pegtl_string_t("equals") {}; +- struct str_equals_ordered : pegtl_string_t("equals-ordered") {}; ++ struct str_allow : TAOCPP_PEGTL_STRING("allow") {}; ++ struct str_block : TAOCPP_PEGTL_STRING("block") {}; ++ struct str_reject : TAOCPP_PEGTL_STRING("reject") {}; ++ struct str_match : TAOCPP_PEGTL_STRING("match") {}; ++ struct str_device : TAOCPP_PEGTL_STRING("device") {}; ++ ++ struct str_name : TAOCPP_PEGTL_STRING("name") {}; ++ struct str_hash : TAOCPP_PEGTL_STRING("hash") {}; ++ struct str_parent_hash : TAOCPP_PEGTL_STRING("parent-hash") {}; ++ struct str_via_port : TAOCPP_PEGTL_STRING("via-port") {}; ++ struct str_with_interface : TAOCPP_PEGTL_STRING("with-interface") {}; ++ struct str_serial : TAOCPP_PEGTL_STRING("serial") {}; ++ struct str_if : TAOCPP_PEGTL_STRING("if") {}; ++ struct str_id : TAOCPP_PEGTL_STRING("id") {}; ++ ++ struct str_all_of : TAOCPP_PEGTL_STRING("all-of") {}; ++ struct str_one_of : TAOCPP_PEGTL_STRING("one-of") {}; ++ struct str_none_of : TAOCPP_PEGTL_STRING("none-of") {}; ++ struct str_equals : TAOCPP_PEGTL_STRING("equals") {}; ++ struct str_equals_ordered : TAOCPP_PEGTL_STRING("equals-ordered") {}; + + /* + * Generic rule attribute +diff --git a/src/Library/UEventParser.cpp b/src/Library/UEventParser.cpp +index 2e0ce39..aebe948 100644 +--- a/src/Library/UEventParser.cpp ++++ b/src/Library/UEventParser.cpp +@@ -27,7 +27,9 @@ + #include "usbguard/Logger.hpp" + + #include +-#include ++ ++#include ++using namespace tao; + + namespace usbguard + { +@@ -114,25 +116,14 @@ namespace usbguard + void parseUEventFromString(const std::string& uevent_string, UEvent& uevent, bool trace) + { + try { +-#if HAVE_PEGTL_LTE_1_3_1 ++ tao::pegtl::string_input<> in(uevent_string, std::string()); + + if (!trace) { +- pegtl::parse(uevent_string, std::string(), uevent); ++ tao::pegtl::parse(in, uevent); + } + else { +- pegtl::parse(uevent_string, std::string(), uevent); +- } +- +-#else +- +- if (!trace) { +- pegtl::parse_string(uevent_string, std::string(), uevent); ++ tao::pegtl::parse(in, uevent); + } +- else { +- pegtl::parse_string(uevent_string, std::string(), uevent); +- } +- +-#endif + } + catch (...) { + throw; +diff --git a/src/Library/UEventParser.hpp b/src/Library/UEventParser.hpp +index 856d5ff..4261bd5 100644 +--- a/src/Library/UEventParser.hpp ++++ b/src/Library/UEventParser.hpp +@@ -23,9 +23,7 @@ + + #include "usbguard/Typedefs.hpp" + +-#include +- +-using namespace pegtl; ++#include + + namespace usbguard + { +@@ -33,6 +31,8 @@ namespace usbguard + + namespace UEventParser + { ++ using namespace tao::pegtl; ++ + struct value + : seq, star>> {}; + +diff --git a/src/Library/public/usbguard/RuleParser.cpp b/src/Library/public/usbguard/RuleParser.cpp +index 4061e01..140bf14 100644 +--- a/src/Library/public/usbguard/RuleParser.cpp ++++ b/src/Library/public/usbguard/RuleParser.cpp +@@ -34,7 +34,7 @@ + #include + #include + +-#include ++#include + + namespace usbguard + { +@@ -42,35 +42,21 @@ namespace usbguard + { + try { + Rule rule; +-#if HAVE_PEGTL_LTE_1_3_1 ++ tao::pegtl::string_input<> input(rule_spec, file); + + if (!trace) { +- pegtl::parse(rule_spec, file, rule); ++ tao::pegtl::parse(input, rule); + } + else { +- pegtl::parse(rule_spec, file, rule); ++ tao::pegtl::parse(input, rule); + } + +-#else +- +- if (!trace) { +- pegtl::parse_string(rule_spec, file, rule); +- } +- else { +- pegtl::parse_string(rule_spec, file, rule); +- } +- +-#endif + return rule; + } +- catch (const pegtl::parse_error& ex) { ++ catch (const tao::pegtl::parse_error& ex) { + RuleParserError error(rule_spec); + error.setHint(ex.what()); +-#if HAVE_PEGTL_LTE_1_3_1 +- error.setOffset(ex.positions[0].column); +-#else + error.setOffset(ex.positions[0].byte_in_line); +-#endif + + if (!file.empty() || line != 0) { + error.setFileInfo(file, line); +-- +2.13.6 + diff --git a/usbguard.spec b/usbguard.spec index 0b91e7d..26f7dae 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -15,6 +15,8 @@ URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf +Patch0: 0001-Update-to-latest-PEGTL-API.patch + Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -104,6 +106,8 @@ a D-Bus interface to the USBGuard daemon component. %prep %setup -q +%patch0 -p1 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -217,6 +221,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Thu Apr 05 2018 Daniel Kopeček - 0.7.2-4 +- Update to latest PEGTL API + * Fri Feb 09 2018 Fedora Release Engineering - 0.7.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 2eb0a0111d0638f5957e4eaa0d14b7e6576c102c Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 01:43:21 -0500 Subject: [PATCH 28/85] Remove needless use of %defattr --- usbguard.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 26f7dae..75c623a 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -159,7 +159,6 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %systemd_postun usbguard.service %files -%defattr(-,root,root,-) %doc README.adoc CHANGELOG.md %license LICENSE %{_libdir}/*.so.* @@ -178,19 +177,16 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/bash-completion/completions/usbguard %files devel -%defattr(-,root,root,-) %{_includedir}/* %{_libdir}/*.so %{_libdir}/pkgconfig/*.pc %files tools -%defattr(-,root,root,-) %{_bindir}/usbguard-rule-parser %if 0%{with_gui_qt5} ### %files applet-qt -%defattr(-,root,root,-) %{_bindir}/usbguard-applet-qt %{_mandir}/man1/usbguard-applet-qt.1.gz %{_datadir}/applications/usbguard-applet-qt.desktop @@ -201,7 +197,6 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %if 0%{with_dbus} ### %files dbus -%defattr(-,root,root,-) %{_sbindir}/usbguard-dbus %{_datadir}/dbus-1/system-services/org.usbguard.service %{_datadir}/dbus-1/system.d/org.usbguard.conf From 2604785c2cd1cb037f4ec55aa95f5e381d22ae6a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 08:19:54 +0000 Subject: [PATCH 29/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 75c623a..028730b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -216,6 +216,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 0.7.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Thu Apr 05 2018 Daniel Kopeček - 0.7.2-4 - Update to latest PEGTL API From 98fe17828670c77ff191529209b159d89dd8989b Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 21 Nov 2018 17:16:20 +0100 Subject: [PATCH 30/85] Rebuild for protobuf 3.6 Signed-off-by: Igor Gnatenko --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 028730b..a367f6b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -216,6 +216,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Wed Nov 21 2018 Igor Gnatenko - 0.7.2-6 +- Rebuild for protobuf 3.6 + * Sat Jul 14 2018 Fedora Release Engineering - 0.7.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 7cccf00f6e42f7a3fa6790864a0cef86f190ec4d Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Tue, 22 Jan 2019 18:41:15 +0100 Subject: [PATCH 31/85] Remove obsolete ldconfig scriptlets References: https://fedoraproject.org/wiki/Changes/RemoveObsoleteScriptlets Signed-off-by: Igor Gnatenko --- usbguard.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index a367f6b..4eb2f64 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -151,11 +151,11 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %systemd_preun usbguard.service %post -/sbin/ldconfig +%{?ldconfig} %systemd_post usbguard.service %postun -/sbin/ldconfig +%{?ldconfig} %systemd_postun usbguard.service %files From 03d834279c6d9663a91a58c7f2e71251b52584f0 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:18:29 +0100 Subject: [PATCH 32/85] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- usbguard.spec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 4eb2f64..c283a6e 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -7,7 +7,6 @@ Name: usbguard Version: 0.7.2 Release: 6%{?dist} Summary: A tool for implementing USB device usage policy -Group: System Environment/Daemons License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 @@ -57,7 +56,6 @@ USB device attributes. %package devel Summary: Development files for %{name} -Group: Development/Libraries Requires: %{name} = %{version}-%{release} Requires: pkgconfig Requires: libstdc++-devel @@ -68,7 +66,6 @@ developing applications that use %{name}. %package tools Summary: USBGuard Tools -Group: Applications/System Requires: %{name} = %{version}-%{release} %description tools @@ -79,7 +76,6 @@ software framework. ### %package applet-qt Summary: USBGuard Qt 5.x Applet -Group: Applications/System Requires: %{name} = %{version}-%{release} Obsoletes: usbguard-applet-qt <= 0.3 @@ -93,7 +89,6 @@ for interacting with the USBGuard daemon component. ### %package dbus Summary: USBGuard D-Bus Service -Group: Applications/System Requires: %{name} = %{version}-%{release} Requires: dbus Requires: polkit From 264f7855761106a15097221dd0d5b849f9cd7681 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 3 Feb 2019 10:57:12 +0000 Subject: [PATCH 33/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c283a6e..8b18ddb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -211,6 +211,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sun Feb 03 2019 Fedora Release Engineering - 0.7.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Wed Nov 21 2018 Igor Gnatenko - 0.7.2-6 - Rebuild for protobuf 3.6 From f64e73a5d436ae0222958dccdee654275af719ac Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jul 2019 02:39:15 +0000 Subject: [PATCH 34/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8b18ddb..28894e8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,7 +5,7 @@ Name: usbguard Version: 0.7.2 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -211,6 +211,9 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %endif %changelog +* Sat Jul 27 2019 Fedora Release Engineering - 0.7.2-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sun Feb 03 2019 Fedora Release Engineering - 0.7.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 9bd7d56f115f24a477dd3107f45b22c84c75a051 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 11 Nov 2019 16:39:13 +0100 Subject: [PATCH 35/85] Rebase to 0.7.6 - removed usbguard-applet-qt subpackage - because it is not supported on upstream anymore --- .gitignore | 1 + 0001-Update-to-latest-PEGTL-API.patch | 567 -------------------------- sources | 2 +- usbguard.spec | 76 +--- 4 files changed, 20 insertions(+), 626 deletions(-) delete mode 100644 0001-Update-to-latest-PEGTL-API.patch diff --git a/.gitignore b/.gitignore index 4c6ae5f..85cfc2e 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /usbguard-0.7.0.tar.gz /usbguard-0.7.1.tar.gz /usbguard-0.7.2.tar.gz +/usbguard-0.7.6.tar.gz diff --git a/0001-Update-to-latest-PEGTL-API.patch b/0001-Update-to-latest-PEGTL-API.patch deleted file mode 100644 index 1ebfd1e..0000000 --- a/0001-Update-to-latest-PEGTL-API.patch +++ /dev/null @@ -1,567 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index a135e01..f565b87 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -290,54 +290,28 @@ AC_SUBST([catch_LIBS]) - # - AC_ARG_WITH([bundled-pegtl], AS_HELP_STRING([--with-bundled-pegtl], [Build using the bundled PEGTL library]), [with_bundled_pegtl=$withval], [with_bundled_pegtl=no]) - if test "x$with_bundled_pegtl" = xyes; then -- pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL" -- pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL" -+ pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL/include" -+ pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL/include" - pegtl_LIBS="" - AC_MSG_NOTICE([Using bundled PEGTL library]) - pegtl_summary="bundled; $pegtl_CFLAGS $pegtl_LIBS" - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++11 $CPPFLAGS" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([pegtl.hh], [], [AC_MSG_FAILURE(pegtl.hh not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) -- AC_LANG_POP - pegtl_CFLAGS="" - pegtl_AC_CFLAGS="" - pegtl_LIBS="" -- CPPFLAGS=$SAVE_CPPFLAGS - pegtl_summary="system-wide; $pegtl_CFLAGS $pegtl_LIBS" - fi - AC_SUBST([pegtl_CFLAGS]) - AC_SUBST([pegtl_AC_CFLAGS]) - AC_SUBST([pegtl_LIBS]) - --# --# Check whether the available PEGTL library is compatible --# with version 1.3.1 or older. --# - SAVE_CPPFLAGS=$CPPFLAGS --CPPFLAGS="-std=c++11 $pegtl_AC_CFLAGS" -+CPPFLAGS="-std=c++11 $CPPFLAGS $pegtl_AC_CFLAGS" - AC_LANG_PUSH([C++]) --AC_COMPILE_IFELSE([AC_LANG_SOURCE([[ --#include --#include --int main(void) --{ -- struct grammar -- : pegtl::one<'g'> {}; -- try { -- pegtl::parse_string(std::string(), std::string()); -- } catch(const pegtl::parse_error& ex) { -- auto b = ex.positions[0].byte_in_line; -- } -- return 0; --} --]])], --[have_pegtl_lte_131=no], [have_pegtl_lte_131=yes]) -+AC_CHECK_HEADER([tao/pegtl.hpp], -+ [AC_DEFINE([HAVE_TAO_PEGTL_HPP], [1], [PEGTL header file with .hpp extension is present])], -+ [AC_MSG_FAILURE(PEGTL header file not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)]) - AC_LANG_POP --if test "x$have_pegtl_lte_131" = xyes; then -- AC_DEFINE([HAVE_PEGTL_LTE_1_3_1], [1], [PEGTL version less than or equal to 1.3.1]) --fi - CPPFLAGS=$SAVE_CPPFLAGS - - # -diff --git a/src/Library/RuleParser/Actions.hpp b/src/Library/RuleParser/Actions.hpp -index 3e185f4..2b21bd2 100644 ---- a/src/Library/RuleParser/Actions.hpp -+++ b/src/Library/RuleParser/Actions.hpp -@@ -24,7 +24,7 @@ - #include "Utility.hpp" - #include "Common/Utility.hpp" - --#include -+#include - - namespace usbguard - { -@@ -47,7 +47,7 @@ namespace usbguard - struct str_if; - - template -- struct rule_parser_actions : pegtl::nothing {}; -+ struct rule_parser_actions : tao::pegtl::nothing {}; - - template<> - struct rule_parser_actions { -@@ -58,7 +58,7 @@ namespace usbguard - rule.setTarget(Rule::targetFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -75,7 +75,7 @@ namespace usbguard - rule.setDeviceID(device_id); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -87,7 +87,7 @@ namespace usbguard - } - - template -- struct name_actions : pegtl::nothing {}; -+ struct name_actions : tao::pegtl::nothing {}; - - template<> - struct name_actions { -@@ -95,7 +95,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeName().empty()) { -- throw pegtl::parse_error("name attribute already defined", in); -+ throw tao::pegtl::parse_error("name attribute already defined", in); - } - } - }; -@@ -109,7 +109,7 @@ namespace usbguard - rule.attributeName().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -123,13 +123,13 @@ namespace usbguard - rule.attributeName().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct id_actions : pegtl::nothing {}; -+ struct id_actions : tao::pegtl::nothing {}; - - template<> - struct id_actions { -@@ -137,7 +137,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeDeviceID().empty()) { -- throw pegtl::parse_error("id attribute already defined", in); -+ throw tao::pegtl::parse_error("id attribute already defined", in); - } - } - }; -@@ -154,7 +154,7 @@ namespace usbguard - rule.attributeDeviceID().append(device_id); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -168,13 +168,13 @@ namespace usbguard - rule.attributeDeviceID().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct hash_actions : pegtl::nothing {}; -+ struct hash_actions : tao::pegtl::nothing {}; - - template<> - struct hash_actions { -@@ -182,7 +182,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeHash().empty()) { -- throw pegtl::parse_error("hash attribute already defined", in); -+ throw tao::pegtl::parse_error("hash attribute already defined", in); - } - } - }; -@@ -196,7 +196,7 @@ namespace usbguard - rule.attributeHash().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -210,13 +210,13 @@ namespace usbguard - rule.attributeHash().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct parent_hash_actions : pegtl::nothing {}; -+ struct parent_hash_actions : tao::pegtl::nothing {}; - - template<> - struct parent_hash_actions { -@@ -224,7 +224,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeParentHash().empty()) { -- throw pegtl::parse_error("parent-hash attribute already defined", in); -+ throw tao::pegtl::parse_error("parent-hash attribute already defined", in); - } - } - }; -@@ -238,7 +238,7 @@ namespace usbguard - rule.attributeParentHash().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -252,13 +252,13 @@ namespace usbguard - rule.attributeParentHash().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct serial_actions : pegtl::nothing {}; -+ struct serial_actions : tao::pegtl::nothing {}; - - template<> - struct serial_actions { -@@ -266,7 +266,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeSerial().empty()) { -- throw pegtl::parse_error("serial attribute already defined", in); -+ throw tao::pegtl::parse_error("serial attribute already defined", in); - } - } - }; -@@ -280,7 +280,7 @@ namespace usbguard - rule.attributeSerial().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -294,13 +294,13 @@ namespace usbguard - rule.attributeSerial().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct via_port_actions : pegtl::nothing {}; -+ struct via_port_actions : tao::pegtl::nothing {}; - - template<> - struct via_port_actions { -@@ -308,7 +308,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeViaPort().empty()) { -- throw pegtl::parse_error("via-port attribute already defined", in); -+ throw tao::pegtl::parse_error("via-port attribute already defined", in); - } - } - }; -@@ -322,7 +322,7 @@ namespace usbguard - rule.attributeViaPort().append(stringValueFromRule(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -336,13 +336,13 @@ namespace usbguard - rule.attributeViaPort().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct with_interface_actions : pegtl::nothing {}; -+ struct with_interface_actions : tao::pegtl::nothing {}; - - template<> - struct with_interface_actions { -@@ -350,7 +350,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeWithInterface().empty()) { -- throw pegtl::parse_error("with-interface attribute already defined", in); -+ throw tao::pegtl::parse_error("with-interface attribute already defined", in); - } - } - }; -@@ -365,7 +365,7 @@ namespace usbguard - rule.attributeWithInterface().append(interface_type); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -379,13 +379,13 @@ namespace usbguard - rule.attributeWithInterface().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; - - template -- struct condition_actions : pegtl::nothing {}; -+ struct condition_actions : tao::pegtl::nothing {}; - - template<> - struct condition_actions { -@@ -393,7 +393,7 @@ namespace usbguard - static void apply(const Input& in, Rule& rule) - { - if (!rule.attributeConditions().empty()) { -- throw pegtl::parse_error("conditions already defined", in); -+ throw tao::pegtl::parse_error("conditions already defined", in); - } - } - }; -@@ -407,7 +407,7 @@ namespace usbguard - rule.attributeConditions().append(RuleCondition(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -@@ -421,7 +421,7 @@ namespace usbguard - rule.attributeConditions().setSetOperator(Rule::setOperatorFromString(in.string())); - } - catch (const std::exception& ex) { -- throw pegtl::parse_error(ex.what(), in); -+ throw tao::pegtl::parse_error(ex.what(), in); - } - } - }; -diff --git a/src/Library/RuleParser/Grammar.hpp b/src/Library/RuleParser/Grammar.hpp -index 9bd4a15..4d785c0 100644 ---- a/src/Library/RuleParser/Grammar.hpp -+++ b/src/Library/RuleParser/Grammar.hpp -@@ -22,37 +22,37 @@ - #endif - - #include "Actions.hpp" --#include - --using namespace pegtl; -+#include - - namespace usbguard - { - namespace RuleParser - { -+ using namespace tao::pegtl; - /* - * Rule language keywords - */ -- struct str_allow : pegtl_string_t("allow") {}; -- struct str_block : pegtl_string_t("block") {}; -- struct str_reject : pegtl_string_t("reject") {}; -- struct str_match : pegtl_string_t("match") {}; -- struct str_device : pegtl_string_t("device") {}; -- -- struct str_name : pegtl_string_t("name") {}; -- struct str_hash : pegtl_string_t("hash") {}; -- struct str_parent_hash : pegtl_string_t("parent-hash") {}; -- struct str_via_port : pegtl_string_t("via-port") {}; -- struct str_with_interface : pegtl_string_t("with-interface") {}; -- struct str_serial : pegtl_string_t("serial") {}; -- struct str_if : pegtl_string_t("if") {}; -- struct str_id : pegtl_string_t("id") {}; -- -- struct str_all_of : pegtl_string_t("all-of") {}; -- struct str_one_of : pegtl_string_t("one-of") {}; -- struct str_none_of : pegtl_string_t("none-of") {}; -- struct str_equals : pegtl_string_t("equals") {}; -- struct str_equals_ordered : pegtl_string_t("equals-ordered") {}; -+ struct str_allow : TAOCPP_PEGTL_STRING("allow") {}; -+ struct str_block : TAOCPP_PEGTL_STRING("block") {}; -+ struct str_reject : TAOCPP_PEGTL_STRING("reject") {}; -+ struct str_match : TAOCPP_PEGTL_STRING("match") {}; -+ struct str_device : TAOCPP_PEGTL_STRING("device") {}; -+ -+ struct str_name : TAOCPP_PEGTL_STRING("name") {}; -+ struct str_hash : TAOCPP_PEGTL_STRING("hash") {}; -+ struct str_parent_hash : TAOCPP_PEGTL_STRING("parent-hash") {}; -+ struct str_via_port : TAOCPP_PEGTL_STRING("via-port") {}; -+ struct str_with_interface : TAOCPP_PEGTL_STRING("with-interface") {}; -+ struct str_serial : TAOCPP_PEGTL_STRING("serial") {}; -+ struct str_if : TAOCPP_PEGTL_STRING("if") {}; -+ struct str_id : TAOCPP_PEGTL_STRING("id") {}; -+ -+ struct str_all_of : TAOCPP_PEGTL_STRING("all-of") {}; -+ struct str_one_of : TAOCPP_PEGTL_STRING("one-of") {}; -+ struct str_none_of : TAOCPP_PEGTL_STRING("none-of") {}; -+ struct str_equals : TAOCPP_PEGTL_STRING("equals") {}; -+ struct str_equals_ordered : TAOCPP_PEGTL_STRING("equals-ordered") {}; - - /* - * Generic rule attribute -diff --git a/src/Library/UEventParser.cpp b/src/Library/UEventParser.cpp -index 2e0ce39..aebe948 100644 ---- a/src/Library/UEventParser.cpp -+++ b/src/Library/UEventParser.cpp -@@ -27,7 +27,9 @@ - #include "usbguard/Logger.hpp" - - #include --#include -+ -+#include -+using namespace tao; - - namespace usbguard - { -@@ -114,25 +116,14 @@ namespace usbguard - void parseUEventFromString(const std::string& uevent_string, UEvent& uevent, bool trace) - { - try { --#if HAVE_PEGTL_LTE_1_3_1 -+ tao::pegtl::string_input<> in(uevent_string, std::string()); - - if (!trace) { -- pegtl::parse(uevent_string, std::string(), uevent); -+ tao::pegtl::parse(in, uevent); - } - else { -- pegtl::parse(uevent_string, std::string(), uevent); -- } -- --#else -- -- if (!trace) { -- pegtl::parse_string(uevent_string, std::string(), uevent); -+ tao::pegtl::parse(in, uevent); - } -- else { -- pegtl::parse_string(uevent_string, std::string(), uevent); -- } -- --#endif - } - catch (...) { - throw; -diff --git a/src/Library/UEventParser.hpp b/src/Library/UEventParser.hpp -index 856d5ff..4261bd5 100644 ---- a/src/Library/UEventParser.hpp -+++ b/src/Library/UEventParser.hpp -@@ -23,9 +23,7 @@ - - #include "usbguard/Typedefs.hpp" - --#include -- --using namespace pegtl; -+#include - - namespace usbguard - { -@@ -33,6 +31,8 @@ namespace usbguard - - namespace UEventParser - { -+ using namespace tao::pegtl; -+ - struct value - : seq, star>> {}; - -diff --git a/src/Library/public/usbguard/RuleParser.cpp b/src/Library/public/usbguard/RuleParser.cpp -index 4061e01..140bf14 100644 ---- a/src/Library/public/usbguard/RuleParser.cpp -+++ b/src/Library/public/usbguard/RuleParser.cpp -@@ -34,7 +34,7 @@ - #include - #include - --#include -+#include - - namespace usbguard - { -@@ -42,35 +42,21 @@ namespace usbguard - { - try { - Rule rule; --#if HAVE_PEGTL_LTE_1_3_1 -+ tao::pegtl::string_input<> input(rule_spec, file); - - if (!trace) { -- pegtl::parse(rule_spec, file, rule); -+ tao::pegtl::parse(input, rule); - } - else { -- pegtl::parse(rule_spec, file, rule); -+ tao::pegtl::parse(input, rule); - } - --#else -- -- if (!trace) { -- pegtl::parse_string(rule_spec, file, rule); -- } -- else { -- pegtl::parse_string(rule_spec, file, rule); -- } -- --#endif - return rule; - } -- catch (const pegtl::parse_error& ex) { -+ catch (const tao::pegtl::parse_error& ex) { - RuleParserError error(rule_spec); - error.setHint(ex.what()); --#if HAVE_PEGTL_LTE_1_3_1 -- error.setOffset(ex.positions[0].column); --#else - error.setOffset(ex.positions[0].byte_in_line); --#endif - - if (!file.empty() || line != 0) { - error.setFileInfo(file, line); --- -2.13.6 - diff --git a/sources b/sources index 1f06437..3f72679 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61 +SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 diff --git a/usbguard.spec b/usbguard.spec index 28894e8..14f0611 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,11 +1,6 @@ -%global _hardened_build 1 - -%define with_gui_qt5 1 -%define with_dbus 1 - Name: usbguard -Version: 0.7.2 -Release: 8%{?dist} +Version: 0.7.6 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -14,8 +9,6 @@ URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz Source1: usbguard-daemon.conf -Patch0: 0001-Update-to-latest-PEGTL-API.patch - Requires: systemd Requires(post): systemd Requires(preun): systemd @@ -23,6 +16,8 @@ Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig +BuildRequires: gcc +BuildRequires: gcc-c++ BuildRequires: libqb-devel BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel @@ -31,23 +26,19 @@ BuildRequires: PEGTL-static BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion -BuildRequires: asciidoctor +BuildRequires: asciidoc BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -%if 0%{with_gui_qt5} -BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist -%endif - -%if 0%{with_dbus} +# dbus BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -%endif + %description The USBGuard software framework helps to protect your computer against rogue USB @@ -72,21 +63,8 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. -%if 0%{with_gui_qt5} -### -%package applet-qt -Summary: USBGuard Qt 5.x Applet -Requires: %{name} = %{version}-%{release} -Obsoletes: usbguard-applet-qt <= 0.3 -%description applet-qt -The %{name}-applet-qt package contains an optional Qt 5.x desktop applet -for interacting with the USBGuard daemon component. -### -%endif - -%if 0%{with_dbus} -### +# dbus %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} @@ -96,12 +74,10 @@ Requires: polkit %description dbus The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. -### -%endif + %prep %setup -q -%patch0 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -114,16 +90,8 @@ autoreconf -i -v --no-recursive ./ --without-bundled-catch \ --without-bundled-pegtl \ --enable-systemd \ -%if 0%{with_gui_qt5} - --with-gui-qt=qt5 \ -%endif -%if 0%{with_dbus} --with-dbus \ --with-polkit \ -%else - --without-dbus \ - --without-polkit \ -%endif --with-crypto-library=gcrypt make %{?_smp_mflags} @@ -179,23 +147,12 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files tools %{_bindir}/usbguard-rule-parser -%if 0%{with_gui_qt5} -### -%files applet-qt -%{_bindir}/usbguard-applet-qt -%{_mandir}/man1/usbguard-applet-qt.1.gz -%{_datadir}/applications/usbguard-applet-qt.desktop -%{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg -### -%endif - -%if 0%{with_dbus} -### +# dbus %files dbus %{_sbindir}/usbguard-dbus -%{_datadir}/dbus-1/system-services/org.usbguard.service -%{_datadir}/dbus-1/system.d/org.usbguard.conf -%{_datadir}/polkit-1/actions/org.usbguard.policy +%{_datadir}/dbus-1/system-services/org.usbguard1.service +%{_datadir}/dbus-1/system.d/org.usbguard1.conf +%{_datadir}/polkit-1/actions/org.usbguard1.policy %{_unitdir}/usbguard-dbus.service %{_mandir}/man8/usbguard-dbus.8.gz @@ -207,10 +164,13 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service -### -%endif + %changelog +* Mon Nov 11 2019 Radovan Sroka - 0.7.6-1 +- rebase to 0.7.6 +- removed usbguard-applet subpackage which is not in upstream anymore + * Sat Jul 27 2019 Fedora Release Engineering - 0.7.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 6960471d528460454ab1656362c7b2a8a4b2a963 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 13 Nov 2019 13:33:17 +0100 Subject: [PATCH 36/85] Added selinux subpackage --- .gitignore | 2 ++ sources | 1 + usbguard.spec | 61 +++++++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 62 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 85cfc2e..1783a9f 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,5 @@ /usbguard-0.7.1.tar.gz /usbguard-0.7.2.tar.gz /usbguard-0.7.6.tar.gz +/usbguard-selinux-0.0.1.tar.gz +/usbguard-selinux-0.0.2.tar.gz diff --git a/sources b/sources index 3f72679..a2586cd 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 +SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec diff --git a/usbguard.spec b/usbguard.spec index 14f0611..3704900 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,13 +1,18 @@ +%global selinuxtype targeted +%global moduletype contrib +%define semodule_version 0.0.2 + Name: usbguard Version: 0.7.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: usbguard-daemon.conf +Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source2: usbguard-daemon.conf Requires: systemd Requires(post): systemd @@ -15,6 +20,7 @@ Requires(preun): systemd Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig +Recommends: %{name}-selinux BuildRequires: gcc BuildRequires: gcc-c++ @@ -75,10 +81,26 @@ Requires: polkit The %{name}-dbus package contains an optional component that provides a D-Bus interface to the USBGuard daemon component. +%package selinux +Summary: USBGuard selinux +Group: Applications/System +Requires: %{name} = %{version}-%{release} +BuildRequires: selinux-policy +BuildRequires: selinux-policy-devel +BuildArch: noarch +%{?selinux_requires} +%description selinux +The %{name}-selinux package contains selinux policy for the USBGuard +daemon. + +# usbguard %prep %setup -q +# selinux +%setup -q -D -T -a 1 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -96,9 +118,18 @@ autoreconf -i -v --no-recursive ./ make %{?_smp_mflags} +# selinux +pushd %{name}-selinux-%{semodule_version} +make +popd + %check make check +# selinux +%pre selinux +%selinux_relabel_pre -s %{selinuxtype} + %install make install INSTALL='install -p' DESTDIR=%{buildroot} @@ -107,6 +138,12 @@ mkdir -p %{buildroot}%{_sysconfdir}/usbguard mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf +# selinux +install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} +install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype} +install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if + # Cleanup find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' @@ -165,8 +202,28 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %postun dbus %systemd_postun_with_restart usbguard-dbus.service +%files selinux +%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 +%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if + +%post selinux +%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 + +%postun selinux +if [ $1 -eq 0 ]; then + %selinux_modules_uninstall -s %{selinuxtype} %{name} +fi + +%posttrans selinux +%selinux_relabel_post -s %{selinuxtype} + + %changelog +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-2 +- added selinux subpackage + * Mon Nov 11 2019 Radovan Sroka - 0.7.6-1 - rebase to 0.7.6 - removed usbguard-applet subpackage which is not in upstream anymore From 1228f42051a9a14bd02ce2eeb64a97959db1a9b6 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 13 Nov 2019 15:42:41 +0100 Subject: [PATCH 37/85] Fixed problem in spec - usbguard-daemon.conf was generated incorrectly Signed-off-by: Radovan Sroka --- usbguard.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 3704900..7651344 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -136,7 +136,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d -install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf +install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf # selinux install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype} @@ -221,6 +221,10 @@ fi %changelog +* Wed Nov 13 2019 Radovan Sroka - 0.7.6-3 +- fixed typo in specfile +- usbguard.conf was generated incorrectly + * Wed Nov 13 2019 Radovan Sroka - 0.7.6-2 - added selinux subpackage From 62377fbd34991902a17f1c04495395a2e04d9cc9 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 27 Nov 2019 08:51:40 +0100 Subject: [PATCH 38/85] Added 3 patches to fix 1.libqb permission inconsistencies, 2. permanent device policy changes and daemon signal handling. --- usbguard-0.7.6-libqb.patch | 118 +++++++++++++++++++++++++++++++ usbguard-0.7.6-servicefile.patch | 12 ++++ usbguard-0.7.6-sigwaitinfo.patch | 32 +++++++++ usbguard.spec | 16 ++++- 4 files changed, 177 insertions(+), 1 deletion(-) create mode 100644 usbguard-0.7.6-libqb.patch create mode 100644 usbguard-0.7.6-servicefile.patch create mode 100644 usbguard-0.7.6-sigwaitinfo.patch diff --git a/usbguard-0.7.6-libqb.patch b/usbguard-0.7.6-libqb.patch new file mode 100644 index 0000000..44b5f8d --- /dev/null +++ b/usbguard-0.7.6-libqb.patch @@ -0,0 +1,118 @@ +diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp +--- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100 ++++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100 +@@ -242,6 +242,22 @@ namespace usbguard + return stats->client_pid; + } + ++ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) ++ { ++ try { ++ std::string path = conn->description; ++ size_t last_slash = path.find_last_of("/"); ++ path = path.substr(0, last_slash); ++ chown(path.c_str(), uid, gid); ++ } ++ catch (const std::exception& exception) { ++ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what(); ++ } ++ catch (...) { ++ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits."; ++ } ++ } ++ + int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) + { + try { +@@ -259,6 +275,7 @@ namespace usbguard + << " gid=" << 0 + << " mode=0660"; + qb_ipcs_connection_auth_set(conn, uid, 0, 0660); ++ qbIPCConnectionAuthSet(conn, uid, 0); + return 0; + } + else { +diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp +--- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100 ++++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100 +@@ -39,6 +39,71 @@ + #include + #include + ++ ++/*libqb header starts*/ ++ #define CONNECTION_DESCRIPTION NAME_MAX ++ ++ enum qb_ipcs_connection_state { ++ QB_IPCS_CONNECTION_INACTIVE, ++ QB_IPCS_CONNECTION_ACTIVE, ++ QB_IPCS_CONNECTION_ESTABLISHED, ++ QB_IPCS_CONNECTION_SHUTTING_DOWN, ++ }; ++ ++ struct qb_ipcs_connection_auth { ++ uid_t uid; ++ gid_t gid; ++ mode_t mode; ++ }; ++ ++ struct qb_ringbuffer_s; ++ typedef struct qb_ringbuffer_s qb_ringbuffer_t; ++ ++ struct qb_ipc_one_way { ++ size_t max_msg_size; ++ enum qb_ipc_type type; ++ union { ++ struct { ++ int32_t sock; ++ char *sock_name; ++ void* shared_data; ++ char shared_file_name[NAME_MAX]; ++ } us; ++ struct { ++ qb_ringbuffer_t *rb; ++ } shm; ++ } u; ++ }; ++ ++ struct qb_list_head { ++ struct qb_list_head *next; ++ struct qb_list_head *prev; ++ }; ++ ++ ++ struct qb_ipcs_connection { ++ enum qb_ipcs_connection_state state; ++ int32_t refcount; ++ pid_t pid; ++ uid_t euid; ++ gid_t egid; ++ struct qb_ipcs_connection_auth auth; ++ struct qb_ipc_one_way setup; ++ struct qb_ipc_one_way request; ++ struct qb_ipc_one_way response; ++ struct qb_ipc_one_way event; ++ struct qb_ipcs_service *service; ++ struct qb_list_head list; ++ struct qb_ipc_request_header *receive_buf; ++ void *context; ++ int32_t fc_enabled; ++ int32_t poll_events; ++ int32_t outstanding_notifiers; ++ char description[CONNECTION_DESCRIPTION]; ++ struct qb_ipcs_connection_stats_2 stats; ++ }; ++/*libqb header ends*/ ++ + namespace usbguard + { + class IPCServerPrivate +@@ -107,6 +172,8 @@ namespace usbguard + bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; + bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const; + ++ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid); ++ + bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const; + bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const; + bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; diff --git a/usbguard-0.7.6-servicefile.patch b/usbguard-0.7.6-servicefile.patch new file mode 100644 index 0000000..63c462c --- /dev/null +++ b/usbguard-0.7.6-servicefile.patch @@ -0,0 +1,12 @@ +diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in +--- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100 ++++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100 +@@ -21,7 +21,7 @@ ProtectKernelModules=yes + ProtectSystem=yes + PIDFile=/run/usbguard.pid + ReadOnlyPaths=-/ +-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp ++ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ + Restart=on-failure + RestrictAddressFamilies=AF_UNIX AF_NETLINK + RestrictNamespaces=yes diff --git a/usbguard-0.7.6-sigwaitinfo.patch b/usbguard-0.7.6-sigwaitinfo.patch new file mode 100644 index 0000000..daf8aae --- /dev/null +++ b/usbguard-0.7.6-sigwaitinfo.patch @@ -0,0 +1,32 @@ +diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp +--- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100 ++++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100 +@@ -507,8 +507,14 @@ namespace usbguard + const int signal_num = sigwaitinfo(&signal_set, &signal_info); + + if (signal_num <= 0) { +- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; +- break; ++ if (errno == EINTR) { ++ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring."; ++ continue; ++ } ++ else { ++ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; ++ throw Exception("Daemon::run", "sigwaitinfo", "failed"); ++ } + } + + switch (signal_num) { +@@ -523,8 +529,11 @@ namespace usbguard + exit_loop = false; + break; + ++ ++ /* should not be reachable */ + default: + USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!"; ++ continue; + } + } + while (!exit_loop); diff --git a/usbguard.spec b/usbguard.spec index 7651344..c3f4637 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -45,6 +45,9 @@ BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 +Patch1: usbguard-0.7.6-libqb.patch +Patch2: usbguard-0.7.6-sigwaitinfo.patch +Patch3: usbguard-0.7.6-servicefile.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -104,6 +107,10 @@ daemon. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} +%patch1 -p1 -b .libqb +%patch2 -p1 -b .sigwaitinfo +%patch3 -p1 -b .servicefile + %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -221,6 +228,13 @@ fi %changelog +* Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 +- added patch for libqb related permission issues + resolves: rhbz#1776357 +- added patch to ensure that usbguard-daemons is still running after locked screen + resolves: rhbz#1751861 +- added patch to fix permanent device policy changes + * Wed Nov 13 2019 Radovan Sroka - 0.7.6-3 - fixed typo in specfile - usbguard.conf was generated incorrectly From eeccbd2e6ff3658c5145b4f28803917928a30195 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 2 Dec 2019 13:25:59 +0100 Subject: [PATCH 39/85] Added obsolete for applet-qt subpackage Signed-off-by: Radovan Sroka --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c3f4637..dfd5907 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -21,6 +21,7 @@ Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig Recommends: %{name}-selinux +Obsoletes: %{name}-applet-qt < 0.7.6 BuildRequires: gcc BuildRequires: gcc-c++ @@ -228,6 +229,9 @@ fi %changelog +* Mon Dec 02 2019 RAdovan Sroka - 0.7.6-5 +- added obsolete applet-qt subpackage + * Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 - added patch for libqb related permission issues resolves: rhbz#1776357 From 578d15f9f122cda9b6fde232a968c00082bc6bae Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 18 Dec 2019 18:04:25 +0100 Subject: [PATCH 40/85] Fixed selinux issue Signed-off-by: Radovan Sroka --- selinux.patch | 32 ++++++++++++++++++++++++++++++++ usbguard.spec | 11 ++++++++--- 2 files changed, 40 insertions(+), 3 deletions(-) create mode 100644 selinux.patch diff --git a/selinux.patch b/selinux.patch new file mode 100644 index 0000000..945878b --- /dev/null +++ b/selinux.patch @@ -0,0 +1,32 @@ +diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te +--- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500 ++++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500 +@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules, + type usbguard_t; + type usbguard_exec_t; + init_daemon_domain(usbguard_t, usbguard_exec_t) ++init_nnp_daemon_domain(usbguard_t) + + type usbguard_unit_file_t; + systemd_unit_file(usbguard_unit_file_t) + + type usbguard_conf_t; + files_config_file(usbguard_conf_t) ++systemd_mount_dir(usbguard_conf_t) + + type usbguard_log_t; + logging_log_file(usbguard_log_t) ++systemd_mount_dir(usbguard_log_t) + + type usbguard_rules_t; + files_config_file(usbguard_rules_t) +@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar + files_pid_filetrans(usbguard_t, usbguard_var_run_t, file) + + manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) +-fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file) ++fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir }) ++manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) + allow usbguard_t usbguard_tmpfs_t:file map; + + manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t) diff --git a/usbguard.spec b/usbguard.spec index dfd5907..8c3a745 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -49,6 +49,7 @@ BuildRequires: libxml2 Patch1: usbguard-0.7.6-libqb.patch Patch2: usbguard-0.7.6-sigwaitinfo.patch Patch3: usbguard-0.7.6-servicefile.patch +Patch4: selinux.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -111,6 +112,7 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch1 -p1 -b .libqb %patch2 -p1 -b .sigwaitinfo %patch3 -p1 -b .servicefile +%patch4 -p1 -b .selinux %build mkdir -p ./m4 @@ -229,8 +231,11 @@ fi %changelog -* Mon Dec 02 2019 RAdovan Sroka - 0.7.6-5 -- added obsolete applet-qt subpackage +* Wed Dec 18 2019 Radovan Sroka - 0.7.6-6 +- fix selinux problems + +* Mon Dec 02 2019 Radovan Sroka - 0.7.6-5 +- obsolete applet-qt subpackage * Mon Nov 25 2019 Attila Lakatos - 0.7.6-4 - added patch for libqb related permission issues From 4864eaae100bf4b8c0ccfc109e692ab07770a6d4 Mon Sep 17 00:00:00 2001 From: Orion Poplawski Date: Wed, 18 Dec 2019 20:42:12 -0700 Subject: [PATCH 41/85] Rebuild for protobuf 3.11 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8c3a745..216069c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -231,6 +231,9 @@ fi %changelog +* Thu Dec 19 2019 Orion Poplawski - 0.7.6-7 +- Rebuild for protobuf 3.11 + * Wed Dec 18 2019 Radovan Sroka - 0.7.6-6 - fix selinux problems From 7950a374867724a117eb20584291bf7e8e26b0a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 31 Jan 2020 02:46:40 +0000 Subject: [PATCH 42/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 216069c..8ef93ef 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.6 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -231,6 +231,9 @@ fi %changelog +* Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Thu Dec 19 2019 Orion Poplawski - 0.7.6-7 - Rebuild for protobuf 3.11 From bd6d626064a274d574fdc104eaca38b12c960255 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 20 May 2020 14:36:57 +0200 Subject: [PATCH 43/85] Rebase to 0.7.8 - added rules.d - rebased selinux subpackage Resolves: rhbz#1836146 --- .gitignore | 3 + selinux.patch | 32 --------- sources | 4 +- usbguard-0.7.6-libqb.patch | 118 ------------------------------- usbguard-0.7.6-servicefile.patch | 12 ---- usbguard-0.7.6-sigwaitinfo.patch | 32 --------- usbguard-daemon.conf | 18 +++++ usbguard.spec | 24 +++---- 8 files changed, 34 insertions(+), 209 deletions(-) delete mode 100644 selinux.patch delete mode 100644 usbguard-0.7.6-libqb.patch delete mode 100644 usbguard-0.7.6-servicefile.patch delete mode 100644 usbguard-0.7.6-sigwaitinfo.patch diff --git a/.gitignore b/.gitignore index 1783a9f..0e1053c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,6 @@ /usbguard-0.7.6.tar.gz /usbguard-selinux-0.0.1.tar.gz /usbguard-selinux-0.0.2.tar.gz +/usbguard-0.7.7.tar.gz +/usbguard-selinux-0.0.3.tar.gz +/usbguard-0.7.8.tar.gz diff --git a/selinux.patch b/selinux.patch deleted file mode 100644 index 945878b..0000000 --- a/selinux.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te ---- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500 -+++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500 -@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules, - type usbguard_t; - type usbguard_exec_t; - init_daemon_domain(usbguard_t, usbguard_exec_t) -+init_nnp_daemon_domain(usbguard_t) - - type usbguard_unit_file_t; - systemd_unit_file(usbguard_unit_file_t) - - type usbguard_conf_t; - files_config_file(usbguard_conf_t) -+systemd_mount_dir(usbguard_conf_t) - - type usbguard_log_t; - logging_log_file(usbguard_log_t) -+systemd_mount_dir(usbguard_log_t) - - type usbguard_rules_t; - files_config_file(usbguard_rules_t) -@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar - files_pid_filetrans(usbguard_t, usbguard_var_run_t, file) - - manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) --fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file) -+fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir }) -+manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) - allow usbguard_t usbguard_tmpfs_t:file map; - - manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t) diff --git a/sources b/sources index a2586cd..a8275fa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 -SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec +SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 +SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426 diff --git a/usbguard-0.7.6-libqb.patch b/usbguard-0.7.6-libqb.patch deleted file mode 100644 index 44b5f8d..0000000 --- a/usbguard-0.7.6-libqb.patch +++ /dev/null @@ -1,118 +0,0 @@ -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100 -@@ -242,6 +242,22 @@ namespace usbguard - return stats->client_pid; - } - -+ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) -+ { -+ try { -+ std::string path = conn->description; -+ size_t last_slash = path.find_last_of("/"); -+ path = path.substr(0, last_slash); -+ chown(path.c_str(), uid, gid); -+ } -+ catch (const std::exception& exception) { -+ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what(); -+ } -+ catch (...) { -+ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits."; -+ } -+ } -+ - int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) - { - try { -@@ -259,6 +275,7 @@ namespace usbguard - << " gid=" << 0 - << " mode=0660"; - qb_ipcs_connection_auth_set(conn, uid, 0, 0660); -+ qbIPCConnectionAuthSet(conn, uid, 0); - return 0; - } - else { -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100 -@@ -39,6 +39,71 @@ - #include - #include - -+ -+/*libqb header starts*/ -+ #define CONNECTION_DESCRIPTION NAME_MAX -+ -+ enum qb_ipcs_connection_state { -+ QB_IPCS_CONNECTION_INACTIVE, -+ QB_IPCS_CONNECTION_ACTIVE, -+ QB_IPCS_CONNECTION_ESTABLISHED, -+ QB_IPCS_CONNECTION_SHUTTING_DOWN, -+ }; -+ -+ struct qb_ipcs_connection_auth { -+ uid_t uid; -+ gid_t gid; -+ mode_t mode; -+ }; -+ -+ struct qb_ringbuffer_s; -+ typedef struct qb_ringbuffer_s qb_ringbuffer_t; -+ -+ struct qb_ipc_one_way { -+ size_t max_msg_size; -+ enum qb_ipc_type type; -+ union { -+ struct { -+ int32_t sock; -+ char *sock_name; -+ void* shared_data; -+ char shared_file_name[NAME_MAX]; -+ } us; -+ struct { -+ qb_ringbuffer_t *rb; -+ } shm; -+ } u; -+ }; -+ -+ struct qb_list_head { -+ struct qb_list_head *next; -+ struct qb_list_head *prev; -+ }; -+ -+ -+ struct qb_ipcs_connection { -+ enum qb_ipcs_connection_state state; -+ int32_t refcount; -+ pid_t pid; -+ uid_t euid; -+ gid_t egid; -+ struct qb_ipcs_connection_auth auth; -+ struct qb_ipc_one_way setup; -+ struct qb_ipc_one_way request; -+ struct qb_ipc_one_way response; -+ struct qb_ipc_one_way event; -+ struct qb_ipcs_service *service; -+ struct qb_list_head list; -+ struct qb_ipc_request_header *receive_buf; -+ void *context; -+ int32_t fc_enabled; -+ int32_t poll_events; -+ int32_t outstanding_notifiers; -+ char description[CONNECTION_DESCRIPTION]; -+ struct qb_ipcs_connection_stats_2 stats; -+ }; -+/*libqb header ends*/ -+ - namespace usbguard - { - class IPCServerPrivate -@@ -107,6 +172,8 @@ namespace usbguard - bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const; - -+ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid); -+ - bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; diff --git a/usbguard-0.7.6-servicefile.patch b/usbguard-0.7.6-servicefile.patch deleted file mode 100644 index 63c462c..0000000 --- a/usbguard-0.7.6-servicefile.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in ---- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100 -+++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100 -@@ -21,7 +21,7 @@ ProtectKernelModules=yes - ProtectSystem=yes - PIDFile=/run/usbguard.pid - ReadOnlyPaths=-/ --ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ - Restart=on-failure - RestrictAddressFamilies=AF_UNIX AF_NETLINK - RestrictNamespaces=yes diff --git a/usbguard-0.7.6-sigwaitinfo.patch b/usbguard-0.7.6-sigwaitinfo.patch deleted file mode 100644 index daf8aae..0000000 --- a/usbguard-0.7.6-sigwaitinfo.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp ---- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100 -+++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100 -@@ -507,8 +507,14 @@ namespace usbguard - const int signal_num = sigwaitinfo(&signal_set, &signal_info); - - if (signal_num <= 0) { -- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -- break; -+ if (errno == EINTR) { -+ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring."; -+ continue; -+ } -+ else { -+ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -+ throw Exception("Daemon::run", "sigwaitinfo", "failed"); -+ } - } - - switch (signal_num) { -@@ -523,8 +529,11 @@ namespace usbguard - exit_loop = false; - break; - -+ -+ /* should not be reachable */ - default: - USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!"; -+ continue; - } - } - while (!exit_loop); diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index e9800b2..d8806a1 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -9,6 +9,19 @@ # RuleFile=/etc/usbguard/rules.conf +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFolder=/path/to/rulesfolder/ +# + +RuleFolder=/etc/usbguard/rules.d/ + + # # Implicit policy target. # @@ -171,3 +184,8 @@ AuditBackend=FileAudit # AuditFilePath=/var/log/usbguard/usbguard-audit.log +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false diff --git a/usbguard.spec b/usbguard.spec index 8ef93ef..1189ed8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.2 +%define semodule_version 0.0.3 Name: usbguard -Version: 0.7.6 -Release: 8%{?dist} +Version: 0.7.8 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -46,11 +46,6 @@ BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -Patch1: usbguard-0.7.6-libqb.patch -Patch2: usbguard-0.7.6-sigwaitinfo.patch -Patch3: usbguard-0.7.6-servicefile.patch -Patch4: selinux.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -109,11 +104,6 @@ daemon. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} -%patch1 -p1 -b .libqb -%patch2 -p1 -b .sigwaitinfo -%patch3 -p1 -b .servicefile -%patch4 -p1 -b .selinux - %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -145,6 +135,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf @@ -176,6 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_bindir}/usbguard %dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard +%dir %{_sysconfdir}/usbguard/rules.d/ %dir %{_sysconfdir}/usbguard/IPCAccessControl.d %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf @@ -231,6 +223,12 @@ fi %changelog +* Tue May 19 2020 Radovan Sroka - 0.7.8-1 +- rebase usbguard to 0.7.8 +- rebase usbguard-selinux to 0.0.3 +- added rules.d/ directory +Resolves: rhbz#1808527 + * Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From a1fb6977df1a6da2b3f13b2414e69fa567e1ce2a Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sun, 21 Jun 2020 17:45:31 +0200 Subject: [PATCH 44/85] Rebuilt for protobuf 3.12 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 1189ed8..76da765 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -223,6 +223,9 @@ fi %changelog +* Sun Jun 14 2020 Adrian Reber - 0.7.8-2 +- Rebuilt for protobuf 3.12 + * Tue May 19 2020 Radovan Sroka - 0.7.8-1 - rebase usbguard to 0.7.8 - rebase usbguard-selinux to 0.0.3 From d327155d9f3761802e28f72bffb359b0b5d89aed Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Wed, 24 Jun 2020 16:08:10 +0200 Subject: [PATCH 45/85] Rebase selinux tarball to v0.0.4 - enable forking style in unit file - set DevicePolicy to closed in unit file - usbguard prevented from writing conf via dontaudit rule Resolves: rhbz#1804713 Resolves: rhbz#1789923 Signed-off-by: Radovan Sroka --- .gitignore | 1 + sources | 2 +- usbguard-forking-style.patch | 34 ++++++++++++++++++++++++++++++++++ usbguard-service-fips.patch | 13 +++++++++++++ usbguard.spec | 30 +++++++++++++++++++++--------- 5 files changed, 70 insertions(+), 10 deletions(-) create mode 100644 usbguard-forking-style.patch create mode 100644 usbguard-service-fips.patch diff --git a/.gitignore b/.gitignore index 0e1053c..037ab40 100644 --- a/.gitignore +++ b/.gitignore @@ -18,3 +18,4 @@ /usbguard-0.7.7.tar.gz /usbguard-selinux-0.0.3.tar.gz /usbguard-0.7.8.tar.gz +/usbguard-selinux-0.0.4.tar.gz diff --git a/sources b/sources index a8275fa..8c31e08 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 -SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426 +SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-forking-style.patch b/usbguard-forking-style.patch new file mode 100644 index 0000000..8a6500a --- /dev/null +++ b/usbguard-forking-style.patch @@ -0,0 +1,34 @@ +diff -up ./usbguard.service.in.forking ./usbguard.service.in +--- ./usbguard.service.in.forking 2020-06-17 20:07:04.720564149 +0200 ++++ ./usbguard.service.in 2020-06-17 20:10:00.744063846 +0200 +@@ -8,11 +8,12 @@ AmbientCapabilities= + CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER + DeviceAllow=/dev/null rw + DevicePolicy=strict +-ExecStart=%sbindir%/usbguard-daemon -k -c %sysconfdir%/usbguard/usbguard-daemon.conf ++ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf + IPAddressDeny=any + LockPersonality=yes + MemoryDenyWriteExecute=yes + NoNewPrivileges=yes ++PIDFile=/var/run/usbguard.pid + PrivateDevices=yes + PrivateTmp=yes + ProtectControlGroups=yes +@@ -20,14 +21,14 @@ ProtectHome=yes + ProtectKernelModules=yes + ProtectSystem=yes + ReadOnlyPaths=-/ +-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ ++ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -/var/run + Restart=on-failure + RestrictAddressFamilies=AF_UNIX AF_NETLINK + RestrictNamespaces=yes + RestrictRealtime=yes + SystemCallArchitectures=native + SystemCallFilter=@system-service +-Type=simple ++Type=forking + UMask=0077 + + [Install] diff --git a/usbguard-service-fips.patch b/usbguard-service-fips.patch new file mode 100644 index 0000000..fce50c9 --- /dev/null +++ b/usbguard-service-fips.patch @@ -0,0 +1,13 @@ +diff -up ./usbguard.service.in.service-fips ./usbguard.service.in +--- ./usbguard.service.in.service-fips 2020-06-22 10:44:44.815860376 +0200 ++++ ./usbguard.service.in 2020-06-22 10:45:07.699135514 +0200 +@@ -6,8 +6,7 @@ Documentation=man:usbguard-daemon(8) + [Service] + AmbientCapabilities= + CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER +-DeviceAllow=/dev/null rw +-DevicePolicy=strict ++DevicePolicy=closed + ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf + IPAddressDeny=any + LockPersonality=yes diff --git a/usbguard.spec b/usbguard.spec index 76da765..bfc4f67 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.3 +%define semodule_version 0.0.4 Name: usbguard Version: 0.7.8 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -38,13 +38,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -# dbus -BuildRequires: dbus-glib-devel -BuildRequires: dbus-devel -BuildRequires: glib2-devel -BuildRequires: polkit-devel -BuildRequires: libxslt -BuildRequires: libxml2 +Patch1: usbguard-forking-style.patch +Patch2: usbguard-service-fips.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -74,6 +69,12 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} +BuildRequires: dbus-glib-devel +BuildRequires: dbus-devel +BuildRequires: glib2-devel +BuildRequires: polkit-devel +BuildRequires: libxslt +BuildRequires: libxml2 Requires: dbus Requires: polkit @@ -101,6 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +%patch1 -p1 -b .service1 +%patch2 -p1 -b .service2 + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -223,6 +227,14 @@ fi %changelog +* Wed Jun 24 2020 Radovan Sroka - 0.7.8-3 +- rebase selinux tarball to v0.0.4 +- enable forking style in unit file +- set DevicePolicy to closed in unit file +- usbguard prevented from writing conf via dontaudit rule +Resolves: rhbz#1804713 +Resolves: rhbz#1789923 + * Sun Jun 14 2020 Adrian Reber - 0.7.8-2 - Rebuilt for protobuf 3.12 From 44f50872ecfcd3fc6fff9a62b75b6bc0984b76a3 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 13:25:25 +0000 Subject: [PATCH 46/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index bfc4f67..ff12143 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 0.7.8-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Wed Jun 24 2020 Radovan Sroka - 0.7.8-3 - rebase selinux tarball to v0.0.4 - enable forking style in unit file From 95d53e17ef51bfd3dfc7255d3190acf33c6cf344 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Mon, 14 Sep 2020 15:55:35 +0200 Subject: [PATCH 47/85] enable tests Signed-off-by: Radovan Sroka --- tests/tests.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 tests/tests.yml diff --git a/tests/tests.yml b/tests/tests.yml new file mode 100644 index 0000000..294bc61 --- /dev/null +++ b/tests/tests.yml @@ -0,0 +1,13 @@ +--- +# Test to run in classic context +- hosts: localhost + roles: + - role: standard-test-beakerlib + tags: + - classic + repositories: + - repo: "https://github.com/RedHat-SP-Security/tests" + dest: "tests" + fmf_filter: "component: usbguard" + required_packages: + - beakerlib-libraries From 4f397875d0f8d572f3e8713572af02c6361fe3d0 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Thu, 24 Sep 2020 16:59:40 +0200 Subject: [PATCH 48/85] Rebuilt for protobuf 3.13 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index ff12143..4bf2999 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Thu Sep 24 2020 Adrian Reber - 0.7.8-5 +- Rebuilt for protobuf 3.13 + * Wed Jul 29 2020 Fedora Release Engineering - 0.7.8-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From 89b4a43921993cd4f8f651fdd4bd0d1b39a0a04a Mon Sep 17 00:00:00 2001 From: Tom Stellard Date: Sat, 9 Jan 2021 00:28:50 +0000 Subject: [PATCH 49/85] Add BuildRequires: make https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot --- usbguard.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/usbguard.spec b/usbguard.spec index 4bf2999..33ff39a 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -23,6 +23,7 @@ Requires(postun): /sbin/ldconfig Recommends: %{name}-selinux Obsoletes: %{name}-applet-qt < 0.7.6 +BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel From 100a7d4dbbec11d9ed98fe4417bf9889bd6b3328 Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Wed, 13 Jan 2021 14:43:58 +0100 Subject: [PATCH 50/85] Rebuilt for protobuf 3.14 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 33ff39a..bdec093 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 0.7.8 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -228,6 +228,9 @@ fi %changelog +* Wed Jan 13 14:43:57 CET 2021 Adrian Reber - 0.7.8-6 +- Rebuilt for protobuf 3.14 + * Thu Sep 24 2020 Adrian Reber - 0.7.8-5 - Rebuilt for protobuf 3.13 From d41c0811d4efe7ca8a62a730ca90d60b2b2c3288 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Thu, 14 Jan 2021 12:16:31 +0100 Subject: [PATCH 51/85] Rebase usbguard to 1.0.0 --- .gitignore | 1 + sources | 2 +- usbguard-forking-style.patch | 34 ---------------------------------- usbguard-service-fips.patch | 13 ------------- usbguard.spec | 18 ++++++++++-------- 5 files changed, 12 insertions(+), 56 deletions(-) delete mode 100644 usbguard-forking-style.patch delete mode 100644 usbguard-service-fips.patch diff --git a/.gitignore b/.gitignore index 037ab40..ed26253 100644 --- a/.gitignore +++ b/.gitignore @@ -19,3 +19,4 @@ /usbguard-selinux-0.0.3.tar.gz /usbguard-0.7.8.tar.gz /usbguard-selinux-0.0.4.tar.gz +/usbguard-1.0.0.tar.gz diff --git a/sources b/sources index 8c31e08..6b48e8e 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 +SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-forking-style.patch b/usbguard-forking-style.patch deleted file mode 100644 index 8a6500a..0000000 --- a/usbguard-forking-style.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff -up ./usbguard.service.in.forking ./usbguard.service.in ---- ./usbguard.service.in.forking 2020-06-17 20:07:04.720564149 +0200 -+++ ./usbguard.service.in 2020-06-17 20:10:00.744063846 +0200 -@@ -8,11 +8,12 @@ AmbientCapabilities= - CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER - DeviceAllow=/dev/null rw - DevicePolicy=strict --ExecStart=%sbindir%/usbguard-daemon -k -c %sysconfdir%/usbguard/usbguard-daemon.conf -+ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf - IPAddressDeny=any - LockPersonality=yes - MemoryDenyWriteExecute=yes - NoNewPrivileges=yes -+PIDFile=/var/run/usbguard.pid - PrivateDevices=yes - PrivateTmp=yes - ProtectControlGroups=yes -@@ -20,14 +21,14 @@ ProtectHome=yes - ProtectKernelModules=yes - ProtectSystem=yes - ReadOnlyPaths=-/ --ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -/var/run - Restart=on-failure - RestrictAddressFamilies=AF_UNIX AF_NETLINK - RestrictNamespaces=yes - RestrictRealtime=yes - SystemCallArchitectures=native - SystemCallFilter=@system-service --Type=simple -+Type=forking - UMask=0077 - - [Install] diff --git a/usbguard-service-fips.patch b/usbguard-service-fips.patch deleted file mode 100644 index fce50c9..0000000 --- a/usbguard-service-fips.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up ./usbguard.service.in.service-fips ./usbguard.service.in ---- ./usbguard.service.in.service-fips 2020-06-22 10:44:44.815860376 +0200 -+++ ./usbguard.service.in 2020-06-22 10:45:07.699135514 +0200 -@@ -6,8 +6,7 @@ Documentation=man:usbguard-daemon(8) - [Service] - AmbientCapabilities= - CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER --DeviceAllow=/dev/null rw --DevicePolicy=strict -+DevicePolicy=closed - ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf - IPAddressDeny=any - LockPersonality=yes diff --git a/usbguard.spec b/usbguard.spec index bdec093..9060c5b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 0.7.8 -Release: 6%{?dist} +Version: 1.0.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -39,9 +39,6 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-forking-style.patch -Patch2: usbguard-service-fips.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -103,9 +100,6 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .service1 -%patch2 -p1 -b .service2 - # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -228,6 +222,14 @@ fi %changelog +* Thu Jan 14 2021 Zoltan Fridrich - 1.0.0-1 +- rebase usbguard to 1.0.0 +- added support for rules covering combination of classes +- fix usbguard being killed +Resolves: rhbz#1916039 +Resolves: rhbz#1861330 +Resolves: rhbz#1905257 + * Wed Jan 13 14:43:57 CET 2021 Adrian Reber - 0.7.8-6 - Rebuilt for protobuf 3.14 From ee065e6f6937c5daf9485c791880e38dc0faa08d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 16 Jan 2021 12:49:34 +0100 Subject: [PATCH 52/85] Rebuilt for protobuf 3.14 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9060c5b..b0074e7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Jan 16 12:49:32 CET 2021 Adrian Reber - 1.0.0-2 +- Rebuilt for protobuf 3.14 + * Thu Jan 14 2021 Zoltan Fridrich - 1.0.0-1 - rebase usbguard to 1.0.0 - added support for rules covering combination of classes From 5d6d9020901ecbee5ebb697886f2e711523f664e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 22:47:30 +0000 Subject: [PATCH 53/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b0074e7..7a5e489 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 1.0.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Jan 16 12:49:32 CET 2021 Adrian Reber - 1.0.0-2 - Rebuilt for protobuf 3.14 From 72f58ad74806fcaf693791d2dc8e2c6dee100ece Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 2 Mar 2021 16:12:04 +0100 Subject: [PATCH 54/85] Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 7a5e489..2237abe 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,10 @@ fi %changelog +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.0-4 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + * Wed Jan 27 2021 Fedora Release Engineering - 1.0.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 5a02b5043f6fad0207d5279352f51b1f76a70de9 Mon Sep 17 00:00:00 2001 From: Jonathan Wakely Date: Wed, 31 Mar 2021 17:38:38 +0100 Subject: [PATCH 55/85] Rebuilt for removed libstdc++ symbols (#1937698) --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 2237abe..76e10e0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Wed Mar 31 2021 Jonathan Wakely - 1.0.0-5 +- Rebuilt for removed libstdc++ symbols (#1937698) + * Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 1.0.0-4 - Rebuilt for updated systemd-rpm-macros See https://pagure.io/fesco/issue/2583. From 05697feceba1312735df239d62f213cd080379b0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 20:10:21 +0000 Subject: [PATCH 56/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 76e10e0..9d2ee4e 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 1.0.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Wed Mar 31 2021 Jonathan Wakely - 1.0.0-5 - Rebuilt for removed libstdc++ symbols (#1937698) From 2a01830eea407cfe4ad653d5728c548a84f4380d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Mon, 25 Oct 2021 17:38:24 +0200 Subject: [PATCH 57/85] Rebuilt for protobuf 3.18.1 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9d2ee4e..8408175 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Mon Oct 25 2021 Adrian Reber - 1.0.0-7 +- Rebuilt for protobuf 3.18.1 + * Fri Jul 23 2021 Fedora Release Engineering - 1.0.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 0574b88f1858bb8932e2aac3b483bab083e3a56a Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 6 Nov 2021 13:03:33 +0100 Subject: [PATCH 58/85] Rebuilt for protobuf 3.19.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8408175..87ce209 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Nov 06 2021 Adrian Reber - 1.0.0-8 +- Rebuilt for protobuf 3.19.0 + * Mon Oct 25 2021 Adrian Reber - 1.0.0-7 - Rebuilt for protobuf 3.18.1 From 44200f7461e9f8d4be96e8cca364afa1c255201e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jan 2022 03:39:29 +0000 Subject: [PATCH 59/85] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 87ce209..d07c449 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.0.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -222,6 +222,9 @@ fi %changelog +* Sat Jan 22 2022 Fedora Release Engineering - 1.0.0-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 06 2021 Adrian Reber - 1.0.0-8 - Rebuilt for protobuf 3.19.0 From 80738463b0a47da3fa096b70f204c7000570b9b1 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Thu, 3 Mar 2022 15:13:50 +0100 Subject: [PATCH 60/85] Rebase to 1.1.0 Resolves: rhbz#2058450 - fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus Resolves: rhbz#2058466 --- .gitignore | 1 + sources | 2 +- usbguard-revert-catch.patch | 17 +++++++++++++++++ usbguard.spec | 17 ++++++++++++++--- 4 files changed, 33 insertions(+), 4 deletions(-) create mode 100644 usbguard-revert-catch.patch diff --git a/.gitignore b/.gitignore index ed26253..0bb9727 100644 --- a/.gitignore +++ b/.gitignore @@ -20,3 +20,4 @@ /usbguard-0.7.8.tar.gz /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz +/usbguard-1.1.0.tar.gz diff --git a/sources b/sources index 6b48e8e..f4811e8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd +SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch new file mode 100644 index 0000000..d75cb85 --- /dev/null +++ b/usbguard-revert-catch.patch @@ -0,0 +1,17 @@ +diff -up ./configure.ac.fix ./configure.ac +--- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 ++++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 +@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t + catch_summary="bundled; $catch_CFLAGS $catch_LIBS" + else + SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" + AC_LANG_PUSH([C++]) + AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" ++ catch_CFLAGS="-I/usr/include/catch" + catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index d07c449..0aa5e23 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 1.0.0 -Release: 9%{?dist} +Version: 1.1.0 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -39,6 +39,10 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd +Patch1: usbguard-revert-catch.patch + + + %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -62,7 +66,6 @@ Requires: %{name} = %{version}-%{release} The %{name}-tools package contains optional tools from the USBGuard software framework. - # dbus %package dbus Summary: USBGuard D-Bus Service @@ -100,6 +103,8 @@ daemon. # selinux %setup -q -D -T -a 1 +%patch1 -p1 -b .catch + # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -222,6 +227,12 @@ fi %changelog +* Thu Mar 03 2022 Radovan Sroka - 1.1.0-1 +- rebase to 1.1.0 +Resolves: rhbz#2058450 +- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus +Resolves: rhbz#2058466 + * Sat Jan 22 2022 Fedora Release Engineering - 1.0.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 2eb6b48d69a40eb701477325736dd4bea5304f86 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Tue, 15 Mar 2022 10:41:50 +0100 Subject: [PATCH 61/85] Backported two patches - selinux: allow policykit dbus comunnication - restore support for access control filenames without a group Signed-off-by: Radovan Sroka --- policykit-dbus-chat-selinux.patch | 22 ++++++++++ ...restore-support-access-control-names.patch | 44 +++++++++++++++++++ usbguard.spec | 12 +++-- 3 files changed, 75 insertions(+), 3 deletions(-) create mode 100644 policykit-dbus-chat-selinux.patch create mode 100644 usbguard-restore-support-access-control-names.patch diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch new file mode 100644 index 0000000..8f0200e --- /dev/null +++ b/policykit-dbus-chat-selinux.patch @@ -0,0 +1,22 @@ +diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te +--- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 ++++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 +@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua + + logging_send_syslog_msg(usbguard_t) + +-dbus_system_domain(usbguard_t, usbguard_exec_t) + usbguard_ipc_access(usbguard_t) + ++optional_policy(` ++ dbus_system_domain(usbguard_t, usbguard_exec_t) ++ ++ optional_policy(` ++ policykit_dbus_chat(usbguard_t) ++ ') ++') ++ ++ + tunable_policy(`usbguard_daemon_write_rules',` + rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) + ') diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch new file mode 100644 index 0000000..5f4bed2 --- /dev/null +++ b/usbguard-restore-support-access-control-names.patch @@ -0,0 +1,44 @@ +From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Sat, 5 Mar 2022 17:22:05 +0100 +Subject: [PATCH] Restore support for access control filenames without a group + +Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 +of release 1.1.0, detailed analysis online at +https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 +--- + src/Daemon/Daemon.cpp | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp +index 45ddb76d..4ec2d934 100644 +--- a/src/Daemon/Daemon.cpp ++++ b/src/Daemon/Daemon.cpp +@@ -446,12 +446,25 @@ namespace usbguard + void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, + std::string* const ptr_group) + { ++ // There are five supported forms: ++ // - ":" ++ // - ":" ++ // - "" ++ // - ":" ++ // - ":" + const auto ug_separator = basename.find_first_of(":"); + const bool has_group = ug_separator != std::string::npos; + const std::string user = basename.substr(0, ug_separator); + const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); +- checkIPCAccessControlName(user); +- checkIPCAccessControlName(group); ++ ++ if (! user.empty()) { ++ checkIPCAccessControlName(user); ++ } ++ ++ if (! group.empty()) { ++ checkIPCAccessControlName(group); ++ } ++ + *ptr_user = user; + *ptr_group = group; + } diff --git a/usbguard.spec b/usbguard.spec index 0aa5e23..f3efa4f 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -40,8 +40,8 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch - - +Patch2: policykit-dbus-chat-selinux.patch +Patch3: usbguard-restore-support-access-control-names.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -104,6 +104,8 @@ daemon. %setup -q -D -T -a 1 %patch1 -p1 -b .catch +%patch2 -p1 -b .policykit +%patch3 -p1 -b .access-contol-names # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -227,6 +229,10 @@ fi %changelog +* Tue Mar 15 2022 Radovan Sroka - 1.1.0-2 +- selinux: allow policykit dbus comunnication +- restore support for access control filenames without a group + * Thu Mar 03 2022 Radovan Sroka - 1.1.0-1 - rebase to 1.1.0 Resolves: rhbz#2058450 From 1c3f2c8ee7aca9e552e87e84eee7b756205f30a8 Mon Sep 17 00:00:00 2001 From: Radovan Sroka Date: Tue, 29 Mar 2022 10:55:18 +0200 Subject: [PATCH 62/85] Usbguard requires selinux subpackage - this ensures that the selinux package and all its dependencies are not pulled into containers and other systems that do not use SELinux Signed-off-by: Radovan Sroka --- usbguard.spec | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index f3efa4f..8fdc0c8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -20,7 +20,8 @@ Requires(preun): systemd Requires(postun): systemd Requires(post): /sbin/ldconfig Requires(postun): /sbin/ldconfig -Recommends: %{name}-selinux + +Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) Obsoletes: %{name}-applet-qt < 0.7.6 BuildRequires: make @@ -227,8 +228,12 @@ fi %selinux_relabel_post -s %{selinuxtype} - %changelog +* Tue Mar 29 2022 Radovan Sroka - 1.1.0-3 +- usbguard requires selinux subpackage +- this ensures that the selinux package and all its dependencies are + not pulled into containers and other systems that do not use SELinux + * Tue Mar 15 2022 Radovan Sroka - 1.1.0-2 - selinux: allow policykit dbus comunnication - restore support for access control filenames without a group From 0ae94a6ee8b9629e5a7779190aa2979985d4f2c0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 11:32:28 +0000 Subject: [PATCH 63/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 8fdc0c8..7eb0353 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -229,6 +229,9 @@ fi %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Tue Mar 29 2022 Radovan Sroka - 1.1.0-3 - usbguard requires selinux subpackage - this ensures that the selinux package and all its dependencies are From ca389b9dcd7c7c64d8db90eb9ad9b6550b0fd3cd Mon Sep 17 00:00:00 2001 From: Nikola Knazekova Date: Mon, 26 Sep 2022 13:51:02 +0200 Subject: [PATCH 64/85] selinux: Update based on latest packaging guide https://fedoraproject.org/wiki/SELinux/IndependentPolicy Add dependency on selinux-policy-targeted Exclude installed policy module file from RPM verification Signed-off-by: Nikola Knazekova --- usbguard.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 7eb0353..e74cfcb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -88,7 +88,8 @@ a D-Bus interface to the USBGuard daemon component. Summary: USBGuard selinux Group: Applications/System Requires: %{name} = %{version}-%{release} -BuildRequires: selinux-policy +Requires: selinux-policy-%{selinuxtype} +Requires(post): selinux-policy-%{selinuxtype} BuildRequires: selinux-policy-devel BuildArch: noarch %{?selinux_requires} @@ -213,7 +214,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if %post selinux From a7b34bb53f5498e72ebd4cf26ccab9b5e26eb13c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 05:57:42 +0000 Subject: [PATCH 65/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e74cfcb..d26b3bd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -230,6 +230,9 @@ fi %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 1.1.0-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 6763ed0496d9e12cf0071f9dec2e40b01bfda8dd Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 24 Jan 2023 15:01:59 -0500 Subject: [PATCH 66/85] Fix build with GCC 13 --- usbguard-gcc13.patch | 12 ++++++++++++ usbguard.spec | 3 +++ 2 files changed, 15 insertions(+) create mode 100644 usbguard-gcc13.patch diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch new file mode 100644 index 0000000..2229079 --- /dev/null +++ b/usbguard-gcc13.patch @@ -0,0 +1,12 @@ +diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp +index 0947f21..aa76311 100644 +--- a/src/Library/Base64.hpp ++++ b/src/Library/Base64.hpp +@@ -24,6 +24,7 @@ + + #include + #include ++#include + + namespace usbguard + { diff --git a/usbguard.spec b/usbguard.spec index d26b3bd..50552b0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -43,6 +43,8 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch Patch3: usbguard-restore-support-access-control-names.patch +# https://github.com/USBGuard/usbguard/pull/582 +Patch4: usbguard-gcc13.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,6 +110,7 @@ daemon. %patch1 -p1 -b .catch %patch2 -p1 -b .policykit %patch3 -p1 -b .access-contol-names +%patch4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 301862791baeeb84463d0d59998517d6d9959692 Mon Sep 17 00:00:00 2001 From: alakatos Date: Mon, 20 Feb 2023 14:14:12 +0100 Subject: [PATCH 67/85] Rebuild Resolves: rhbz#2171749 --- usbguard.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 50552b0..2adf917 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -233,6 +233,10 @@ fi %changelog +* Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 +- Rebuild +Resolves: rhbz#2171749 + * Sat Jan 21 2023 Fedora Release Engineering - 1.1.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 97ffebda9664433933e976da02f06cf9b4d8c97c Mon Sep 17 00:00:00 2001 From: Tomas Popela Date: Wed, 10 May 2023 15:11:04 +0200 Subject: [PATCH 68/85] Drop BR on dbus-glib as the requirement was dropped in 0.7.7 --- usbguard.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 2adf917..12ce1c1 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -73,7 +73,6 @@ software framework. %package dbus Summary: USBGuard D-Bus Service Requires: %{name} = %{version}-%{release} -BuildRequires: dbus-glib-devel BuildRequires: dbus-devel BuildRequires: glib2-devel BuildRequires: polkit-devel @@ -233,6 +232,9 @@ fi %changelog +* Wed May 10 2023 Tomas Popela - 1.1.0-7 +- Drop BR on dbus-glib as the requirement was dropped in 0.7.7 + * Mon Feb 20 2023 Attila Lakatos - 1.1.0-6 - Rebuild Resolves: rhbz#2171749 From b38cc691dbb5f07b75e40739ccd73407953621d1 Mon Sep 17 00:00:00 2001 From: alakatos Date: Wed, 31 May 2023 10:32:34 +0200 Subject: [PATCH 69/85] Update License tag for SPDX and fix deprecated %patchN --- usbguard.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index 12ce1c1..9ccacb7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -6,7 +6,7 @@ Name: usbguard Version: 1.1.0 Release: 7%{?dist} Summary: A tool for implementing USB device usage policy -License: GPLv2+ +License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ @@ -106,10 +106,10 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch1 -p1 -b .catch -%patch2 -p1 -b .policykit -%patch3 -p1 -b .access-contol-names -%patch4 -p1 -b .gcc13 +%patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .policykit +%patch -P 3 -p1 -b .access-contol-names +%patch -P 4 -p1 -b .gcc13 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} From 5aa21e5bdcd82588be6dd790086bccf277182a34 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 17:15:47 +0000 Subject: [PATCH 70/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9ccacb7..c602254 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed May 10 2023 Tomas Popela - 1.1.0-7 - Drop BR on dbus-glib as the requirement was dropped in 0.7.7 From b0c20efcc06c5f8ad94389b64e7ae576cdf46a96 Mon Sep 17 00:00:00 2001 From: alakatos Date: Thu, 27 Jul 2023 10:56:48 +0200 Subject: [PATCH 71/85] Rebase to 1.1.2 Resolves: rhbz#2064543 --- .gitignore | 1 + sources | 2 +- ...restore-support-access-control-names.patch | 44 ------------------- usbguard-selinux-audit-write.patch | 12 +++++ usbguard.spec | 16 ++++--- 5 files changed, 24 insertions(+), 51 deletions(-) delete mode 100644 usbguard-restore-support-access-control-names.patch create mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 0bb9727..37047d1 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,4 @@ /usbguard-selinux-0.0.4.tar.gz /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz +/usbguard-1.1.2.tar.gz diff --git a/sources b/sources index f4811e8..c5d8006 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91 +SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 diff --git a/usbguard-restore-support-access-control-names.patch b/usbguard-restore-support-access-control-names.patch deleted file mode 100644 index 5f4bed2..0000000 --- a/usbguard-restore-support-access-control-names.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001 -From: Sebastian Pipping -Date: Sat, 5 Mar 2022 17:22:05 +0100 -Subject: [PATCH] Restore support for access control filenames without a group - -Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81 -of release 1.1.0, detailed analysis online at -https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284 ---- - src/Daemon/Daemon.cpp | 17 +++++++++++++++-- - 1 file changed, 15 insertions(+), 2 deletions(-) - -diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp -index 45ddb76d..4ec2d934 100644 ---- a/src/Daemon/Daemon.cpp -+++ b/src/Daemon/Daemon.cpp -@@ -446,12 +446,25 @@ namespace usbguard - void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user, - std::string* const ptr_group) - { -+ // There are five supported forms: -+ // - ":" -+ // - ":" -+ // - "" -+ // - ":" -+ // - ":" - const auto ug_separator = basename.find_first_of(":"); - const bool has_group = ug_separator != std::string::npos; - const std::string user = basename.substr(0, ug_separator); - const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string(); -- checkIPCAccessControlName(user); -- checkIPCAccessControlName(group); -+ -+ if (! user.empty()) { -+ checkIPCAccessControlName(user); -+ } -+ -+ if (! group.empty()) { -+ checkIPCAccessControlName(group); -+ } -+ - *ptr_user = user; - *ptr_group = group; - } diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch new file mode 100644 index 0000000..4d8b376 --- /dev/null +++ b/usbguard-selinux-audit-write.patch @@ -0,0 +1,12 @@ +diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te +--- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 ++++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 +@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) + # Local policy + # + +-allow usbguard_t self:capability { chown fowner }; ++allow usbguard_t self:capability { chown fowner audit_write }; + allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; + allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; + diff --git a/usbguard.spec b/usbguard.spec index c602254..9c13cf0 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.4 Name: usbguard -Version: 1.1.0 -Release: 8%{?dist} +Version: 1.1.2 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -42,9 +42,9 @@ BuildRequires: systemd Patch1: usbguard-revert-catch.patch Patch2: policykit-dbus-chat-selinux.patch -Patch3: usbguard-restore-support-access-control-names.patch # https://github.com/USBGuard/usbguard/pull/582 -Patch4: usbguard-gcc13.patch +Patch3: usbguard-gcc13.patch +Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,8 +108,8 @@ daemon. %patch -P 1 -p1 -b .catch %patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .access-contol-names -%patch -P 4 -p1 -b .gcc13 +%patch -P 3 -p1 -b .gcc13 +%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +232,10 @@ fi %changelog +* Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 +- Rebase to 1.1.2 +Resolves: rhbz#2064543 + * Sat Jul 22 2023 Fedora Release Engineering - 1.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 5015f2bbcb4b0ee3847683f8a79b901640740d27 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 07:16:53 +0000 Subject: [PATCH 72/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 9c13cf0..09bae0b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -232,6 +232,9 @@ fi %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jul 27 2023 Attila Lakatos - 1.1.2-1 - Rebase to 1.1.2 Resolves: rhbz#2064543 From 13ea59fa5a3488307c30075ed79ede40726a2aa5 Mon Sep 17 00:00:00 2001 From: alakatos Date: Fri, 7 Jun 2024 09:00:59 +0200 Subject: [PATCH 73/85] Rebase to 1.1.3 Resolves: rhbz#2290724 selinux package policy update Resolves: rhbz#2271330 --- .gitignore | 2 ++ policykit-dbus-chat-selinux.patch | 22 ---------------------- sources | 4 ++-- usbguard-gcc13.patch | 12 ------------ usbguard-selinux-audit-write.patch | 12 ------------ usbguard.spec | 21 ++++++++++----------- 6 files changed, 14 insertions(+), 59 deletions(-) delete mode 100644 policykit-dbus-chat-selinux.patch delete mode 100644 usbguard-gcc13.patch delete mode 100644 usbguard-selinux-audit-write.patch diff --git a/.gitignore b/.gitignore index 37047d1..884279b 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,5 @@ /usbguard-1.0.0.tar.gz /usbguard-1.1.0.tar.gz /usbguard-1.1.2.tar.gz +/usbguard-1.1.3.tar.gz +/usbguard-selinux-0.0.5.tar.gz diff --git a/policykit-dbus-chat-selinux.patch b/policykit-dbus-chat-selinux.patch deleted file mode 100644 index 8f0200e..0000000 --- a/policykit-dbus-chat-selinux.patch +++ /dev/null @@ -1,22 +0,0 @@ -diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te ---- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100 -+++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100 -@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua - - logging_send_syslog_msg(usbguard_t) - --dbus_system_domain(usbguard_t, usbguard_exec_t) - usbguard_ipc_access(usbguard_t) - -+optional_policy(` -+ dbus_system_domain(usbguard_t, usbguard_exec_t) -+ -+ optional_policy(` -+ policykit_dbus_chat(usbguard_t) -+ ') -+') -+ -+ - tunable_policy(`usbguard_daemon_write_rules',` - rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t) - ') diff --git a/sources b/sources index c5d8006..6fead78 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.2.tar.gz) = 03b6dd026a0fe6a7a055208f09a56e2cc86985570388e33fde08671b8aa2d60ea4a0e59505e9646ddf50f42f5b6310d1b230379f9c26ec99c7ca736f3b4ad850 -SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0 +SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/usbguard-gcc13.patch b/usbguard-gcc13.patch deleted file mode 100644 index 2229079..0000000 --- a/usbguard-gcc13.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff --git a/src/Library/Base64.hpp b/src/Library/Base64.hpp -index 0947f21..aa76311 100644 ---- a/src/Library/Base64.hpp -+++ b/src/Library/Base64.hpp -@@ -24,6 +24,7 @@ - - #include - #include -+#include - - namespace usbguard - { diff --git a/usbguard-selinux-audit-write.patch b/usbguard-selinux-audit-write.patch deleted file mode 100644 index 4d8b376..0000000 --- a/usbguard-selinux-audit-write.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te ---- usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te.orig 2023-07-27 10:41:25.540984667 +0200 -+++ usbguard-1.1.0/usbguard-selinux-0.0.4/usbguard.te 2023-07-27 10:41:59.970006413 +0200 -@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t) - # Local policy - # - --allow usbguard_t self:capability { chown fowner }; -+allow usbguard_t self:capability { chown fowner audit_write }; - allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read }; - allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms }; - diff --git a/usbguard.spec b/usbguard.spec index 09bae0b..e1fb9bb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,17 +1,17 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.4 +%define semodule_version 0.0.5 Name: usbguard -Version: 1.1.2 -Release: 2%{?dist} +Version: 1.1.3 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed # src/ThirdParty/Catch: Boost Software License - Version 1.0 URL: https://usbguard.github.io/ Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz -Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz +Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz Source2: usbguard-daemon.conf Requires: systemd @@ -41,10 +41,6 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch -Patch2: policykit-dbus-chat-selinux.patch -# https://github.com/USBGuard/usbguard/pull/582 -Patch3: usbguard-gcc13.patch -Patch4: usbguard-selinux-audit-write.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -107,9 +103,6 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .policykit -%patch -P 3 -p1 -b .gcc13 -%patch -P 4 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -232,6 +225,12 @@ fi %changelog +* Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 +- Rebase to 1.1.3 +Resolves: rhbz#2290724 +- selinux package policy update +Resolves: rhbz#2271330 + * Sat Jan 27 2024 Fedora Release Engineering - 1.1.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 5fe2cc1565aa287b660deca31154afc0dc0b4a12 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 08:24:46 +0000 Subject: [PATCH 74/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e1fb9bb..da720a7 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jun 07 2024 Attila Lakatos - 1.1.3-1 - Rebase to 1.1.3 Resolves: rhbz#2290724 From f1ffa2655608f13954d0b87cda19107e572253d7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 13:55:52 +0000 Subject: [PATCH 75/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index da720a7..94ebf10 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -225,6 +225,9 @@ fi %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sat Jul 20 2024 Fedora Release Engineering - 1.1.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 5d01f96eab2bb003f1c35319396205bc43b4971b Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 6 Feb 2025 09:31:12 +0100 Subject: [PATCH 76/85] Add usbguard-tmpfles.conf --- tmpfiles.patch | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++ usbguard.spec | 8 ++++++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 tmpfiles.patch diff --git a/tmpfiles.patch b/tmpfiles.patch new file mode 100644 index 0000000..4eb6b0f --- /dev/null +++ b/tmpfiles.patch @@ -0,0 +1,58 @@ +From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Thu, 6 Feb 2025 08:00:59 +0100 +Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= + =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= + =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= + =?UTF-8?q?y.?= +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +--- + Makefile.am | 13 +++++++++++-- + usbguard-tmpfiles.conf | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + create mode 100644 usbguard-tmpfiles.conf + +diff --git a/Makefile.am b/Makefile.am +index 7dc6849..2a8bfeb 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc + $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ + endif + +-install-data-hook: install-daemon-conf install-systemd-service install-data-dbus +-uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus ++install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles ++uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles + + CLEANFILES+=\ + $(top_builddir)/usbguard-daemon.conf +@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard + + distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print + ++EXTRA_DIST+=usbguard-tmpfiles.conf ++ ++install-tmpfiles: ++ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ ++ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ ++uninstall-tmpfiles: ++ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf ++ + install-daemon-conf: $(top_builddir)/usbguard-daemon.conf + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) + $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +new file mode 100644 +index 0000000..e90908f +--- /dev/null ++++ b/usbguard-tmpfiles.conf +@@ -0,0 +1 @@ ++d /var/log/usbguard 0700 root root - - +-- +2.48.1 + diff --git a/usbguard.spec b/usbguard.spec index 94ebf10..aac3acd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -41,6 +41,7 @@ BuildRequires: audit-libs-devel BuildRequires: systemd Patch1: usbguard-revert-catch.patch +Patch2: tmpfiles.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,6 +104,7 @@ daemon. %setup -q -D -T -a 1 %patch -P 1 -p1 -b .catch +%patch -P 2 -p1 -b .tmpfiles # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -180,6 +182,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_datadir}/man/man5/usbguard-rules.conf.5.gz %{_datadir}/man/man1/usbguard.1.gz %{_datadir}/bash-completion/completions/usbguard +%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf %files devel %{_includedir}/* @@ -225,6 +228,9 @@ fi %changelog +* Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 +- Install usbguard-tmpfles.conf + * Sun Jan 19 2025 Fedora Release Engineering - 1.1.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 4125b6a0ad5aefa12690edd2deacb65c36a99a3c Mon Sep 17 00:00:00 2001 From: Cropi Date: Thu, 24 Apr 2025 10:12:16 +0200 Subject: [PATCH 77/85] Fix usbguard-tmpfiles.conf Remove catch1 dependency Adapt for protobuf api changes Fix regression in specifying IPC privileges using UID selinux subpackage update: unified bin and sbin Resolves: rhbz#2297169 --- catch2-support.patch | 281 ++++++++++++++++++++++++++++ disable-catch.patch | 153 +++++++++++++++ ipc-privileges.patch | 88 +++++++++ protobuf-3.0.patch | 70 +++++++ selinux-bin-sbin.patch | 14 ++ tmpfiles.patch => tmpfiles-v1.patch | 24 +-- tmpfiles-v2.patch | 7 + uninstall-ignore-error.patch | 34 ++++ usbguard-revert-catch.patch | 17 -- usbguard.spec | 40 +++- 10 files changed, 679 insertions(+), 49 deletions(-) create mode 100644 catch2-support.patch create mode 100644 disable-catch.patch create mode 100644 ipc-privileges.patch create mode 100644 protobuf-3.0.patch create mode 100644 selinux-bin-sbin.patch rename tmpfiles.patch => tmpfiles-v1.patch (66%) create mode 100644 tmpfiles-v2.patch create mode 100644 uninstall-ignore-error.patch delete mode 100644 usbguard-revert-catch.patch diff --git a/catch2-support.patch b/catch2-support.patch new file mode 100644 index 0000000..49ae059 --- /dev/null +++ b/catch2-support.patch @@ -0,0 +1,281 @@ +diff --git a/configure.ac b/configure.ac +index 1f5be3a3..617d3bcf 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -396,10 +396,15 @@ else + SAVE_CPPFLAGS=$CPPFLAGS + CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" + AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) + AC_LANG_POP +- catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS="" + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" + fi +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index e10e8456..2efbb509 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ + + test_unit_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + + test_unit_LDFLAGS=\ +@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ + + test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ ++ $(catch_LIBS) \ + $(PTHREAD_LIBS) + +diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp +index 73b536a3..6f6e350c 100644 +--- a/src/Tests/Regression/github-PR209-config-parser.cpp ++++ b/src/Tests/Regression/github-PR209-config-parser.cpp +@@ -18,7 +18,11 @@ + // + + #include "usbguard/ConfigFile.hpp" +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + #include + #include +diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp +index f3d9b82d..24b84935 100644 +--- a/src/Tests/Regression/test_Rule_ghi113.cpp ++++ b/src/Tests/Regression/test_Rule_ghi113.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp +index 2056102d..72483bb1 100644 +--- a/src/Tests/Regression/test_Rule_ghi247.cpp ++++ b/src/Tests/Regression/test_Rule_ghi247.cpp +@@ -19,7 +19,11 @@ + #include "usbguard/Rule.hpp" + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp +index f240c8b5..df2ef637 100644 +--- a/src/Tests/Regression/test_Rule_ghi37.cpp ++++ b/src/Tests/Regression/test_Rule_ghi37.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp +index 3f87093f..113b0633 100644 +--- a/src/Tests/Unit/test_Base64.cpp ++++ b/src/Tests/Unit/test_Base64.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +index 4ed4167b..f85a4ccb 100644 +--- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp ++++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/IPCServer.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp +index cafc8cca..015ce1bc 100644 +--- a/src/Tests/Unit/test_Rule.cpp ++++ b/src/Tests/Unit/test_Rule.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp +index ddb93dec..2aff77b6 100644 +--- a/src/Tests/Unit/test_RuleAttribute_id.cpp ++++ b/src/Tests/Unit/test_RuleAttribute_id.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp +index e9bc21e2..e310de81 100644 +--- a/src/Tests/Unit/test_RuleParser.cpp ++++ b/src/Tests/Unit/test_RuleParser.cpp +@@ -18,7 +18,11 @@ + // + #include "usbguard/Rule.hpp" + +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + + using namespace usbguard; + +diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp +index 759ee2cd..cbfd554c 100644 +--- a/src/Tests/Unit/test_UEvent.cpp ++++ b/src/Tests/Unit/test_UEvent.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp +index cefbc3bd..205a6885 100644 +--- a/src/Tests/Unit/test_UEventParser.cpp ++++ b/src/Tests/Unit/test_UEventParser.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +index fbe8bbdc..4a2e9612 100644 +--- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp ++++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + #include "test_UMockdevDeviceDefinition.data.hpp" +diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp +index 6d3e188f..a85fa362 100644 +--- a/src/Tests/Unit/test_Utility.cpp ++++ b/src/Tests/Unit/test_Utility.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #include ++#endif + #include + + using namespace usbguard; +diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp +index 4e3e8760..1b001998 100644 +--- a/src/Tests/main.cpp ++++ b/src/Tests/main.cpp +@@ -16,7 +16,11 @@ + // + // Authors: Daniel Kopecek + // +-#define CATCH_CONFIG_MAIN +-#include ++#ifdef HAVE_CATCH2_V3 ++ #include ++#else ++ #define CATCH_CONFIG_MAIN ++ #include ++#endif + + /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch new file mode 100644 index 0000000..3a7219a --- /dev/null +++ b/disable-catch.patch @@ -0,0 +1,153 @@ +diff --git a/configure.ac b/configure.ac +index 617d3bcf..56bbe9e3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -386,27 +386,38 @@ fi + # + # Catch C++ library + # ++AC_ARG_ENABLE([catch], ++ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], ++ [enable_catch=$enableval], [enable_catch=yes]) ++ + AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) +-if test "x$with_bundled_catch" = xyes; then +- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" +- catch_LIBS="" +- AC_MSG_NOTICE([Using bundled Catch library]) +- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ ++if test "x$enable_catch" = xyes; then ++ if test "x$with_bundled_catch" = xyes; then ++ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" ++ catch_LIBS="" ++ AC_MSG_NOTICE([Using bundled Catch library]) ++ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" ++ else ++ SAVE_CPPFLAGS=$CPPFLAGS ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ AC_LANG_PUSH([C++]) ++ AC_CHECK_HEADER([catch_test_macros.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" ++ catch_LIBS="-lCatch2Main -lCatch2"], ++ [AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch2" ++ catch_LIBS=""], ++ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ )]) ++ AC_LANG_POP ++ CPPFLAGS=$SAVE_CPPFLAGS ++ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ fi + else +- SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" +- AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch_test_macros.hpp], +- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" +- catch_LIBS="-lCatch2Main -lCatch2"], +- [AC_CHECK_HEADER([catch.hpp], +- [catch_CFLAGS="-I/usr/include/catch2" +- catch_LIBS=""], +- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] +- )]) +- AC_LANG_POP +- CPPFLAGS=$SAVE_CPPFLAGS +- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" ++ catch_CFLAGS="" ++ catch_LIBS="" ++ catch_summary="disabled; not checking for Catch2" + fi + AC_SUBST([catch_CFLAGS]) + AC_SUBST([catch_LIBS]) +@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) + AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) + AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) + AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) ++AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) + + CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" + CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index b84d2480..aa504bc9 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -583,7 +583,8 @@ namespace usbguard + return true; + } + +- bool isValidNameOrUID(const std::string& input) { ++ bool isValidNameOrUID(const std::string& input) ++ { + return isValidName(input) || isValidUID(input); + } + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index b75df136..555d113e 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,7 +36,7 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidNameOrUID(name)) { ++ if (!isValidNameOrUID(name)) { + throw Exception("IPC access control", "invalid name or UID format", name); + } + } +diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am +index 2efbb509..435a4264 100644 +--- a/src/Tests/Makefile.am ++++ b/src/Tests/Makefile.am +@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ + + + TESTS=\ +- test-unit \ +- test-regression \ + USB/test-descriptor-parser.sh \ + Rules/test-rules.sh + ++if CATCH_ENABLED ++TESTS+=\ ++ test-unit \ ++ test-regression ++endif ++ + if FULL_TEST_SUITE_ENABLED + TESTS+=\ + Source/check-driver.sh \ +@@ -101,10 +105,15 @@ TESTS+=\ + + endif + +-check_PROGRAMS=\ ++check_PROGRAMS= ++ ++if CATCH_ENABLED ++check_PROGRAMS+=\ + test-unit \ + test-regression ++endif + ++if CATCH_ENABLED + test_unit_SOURCES=\ + main.cpp \ + Unit/test_Rule.cpp \ +@@ -128,7 +137,9 @@ test_unit_LDADD=\ + + test_unit_LDFLAGS=\ + -static ++endif + ++if CATCH_ENABLED + test_regression_SOURCES=\ + main.cpp \ + Regression/test_Rule_ghi37.cpp \ +@@ -143,4 +154,4 @@ test_regression_LDADD=\ + $(top_builddir)/libusbguard.la \ + $(catch_LIBS) \ + $(PTHREAD_LIBS) +- ++endif +\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch new file mode 100644 index 0000000..bf0f65d --- /dev/null +++ b/ipc-privileges.patch @@ -0,0 +1,88 @@ +diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp +index aee50ce0..b84d2480 100644 +--- a/src/Common/Utility.cpp ++++ b/src/Common/Utility.cpp +@@ -543,7 +543,22 @@ namespace usbguard + return rulefile_list; + } + +- bool isValidName(const std::string& name) ++ static bool isValidUID(const std::string& uid) ++ { ++ if (uid.empty()) { ++ return false; ++ } ++ ++ for (char c : uid) { ++ if (!std::isdigit(c)) { ++ return false; ++ } ++ } ++ ++ return true; ++ } ++ ++ static bool isValidName(const std::string& name) + { + const char* s = name.data(); + +@@ -568,6 +583,10 @@ namespace usbguard + return true; + } + ++ bool isValidNameOrUID(const std::string& input) { ++ return isValidName(input) || isValidUID(input); ++ } ++ + } /* namespace usbguard */ + + /* vim: set ts=2 sw=2 et */ +diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp +index d49e24dc..ac0bae4f 100644 +--- a/src/Common/Utility.hpp ++++ b/src/Common/Utility.hpp +@@ -319,12 +319,11 @@ namespace usbguard + /** + * @brief Checks whether a given name is a valid group/user name + * +- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] + * + * @param name Name to check + * @return True if given name is valid, false otherwise + */ +- bool isValidName(const std::string& name); ++ bool isValidNameOrUID(const std::string& name); + + } /* namespace usbguard */ + +diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +index 973eb8bd..b75df136 100644 +--- a/src/Library/public/usbguard/IPCServer.cpp ++++ b/src/Library/public/usbguard/IPCServer.cpp +@@ -36,8 +36,8 @@ namespace usbguard + throw Exception("IPC access control", "name too long", name); + } + +- if (!isValidName(name)) { +- throw Exception("IPC access control", "invalid name format", name); ++ if (!isValidNameOrUID(name)) { ++ throw Exception("IPC access control", "invalid name or UID format", name); + } + } + +diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp +index ddb1d8a7..0ba6f93d 100644 +--- a/src/Library/public/usbguard/IPCServer.hpp ++++ b/src/Library/public/usbguard/IPCServer.hpp +@@ -50,9 +50,9 @@ namespace usbguard + /** + * @brief Checks whether given name is a valid access control name. + * +- * Name is a valid access control name iff: ++ * Name is a valid access control name if: + * 1. it is not longer then 32 characters +- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] ++ * 2. it is aligned with the syntax of useradd(8) + * + * @param name Name to be verified. + * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch new file mode 100644 index 0000000..ce12d9f --- /dev/null +++ b/protobuf-3.0.patch @@ -0,0 +1,70 @@ +diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp +index 6aa52013..452ecd41 100644 +--- a/src/Library/IPCClientPrivate.cpp ++++ b/src/Library/IPCClientPrivate.cpp +@@ -225,7 +225,7 @@ namespace usbguard + std::string payload; + message.SerializeToString(&payload); + struct qb_ipc_request_header hdr; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + struct iovec iov[2]; + iov[0].iov_base = &hdr; +diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp +index d92a1d47..a33022e2 100644 +--- a/src/Library/IPCClientPrivate.hpp ++++ b/src/Library/IPCClientPrivate.hpp +@@ -84,7 +84,7 @@ namespace usbguard + template + void registerHandler(MessageHandler::HandlerType method) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method)); + } + +diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp +index 548a7261..b976f025 100644 +--- a/src/Library/IPCServerPrivate.cpp ++++ b/src/Library/IPCServerPrivate.cpp +@@ -311,7 +311,7 @@ namespace usbguard + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr; + struct iovec iov[2]; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + iov[0].iov_base = &hdr; +@@ -555,7 +555,7 @@ namespace usbguard + std::string payload; + message->SerializeToString(&payload); + struct qb_ipc_response_header hdr = { }; +- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); ++ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); + hdr.size = sizeof hdr + payload.size(); + hdr.error = 0; + struct iovec iov[2]; +@@ -563,7 +563,7 @@ namespace usbguard + iov[0].iov_len = sizeof hdr; + iov[1].iov_base = (void*)payload.data(); + iov[1].iov_len = payload.size(); +- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); ++ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); + iov[0].iov_base = nullptr; + iov[1].iov_base = nullptr; + } +diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp +index 25f9ac38..3b3dcc51 100644 +--- a/src/Library/IPCServerPrivate.hpp ++++ b/src/Library/IPCServerPrivate.hpp +@@ -134,7 +134,7 @@ namespace usbguard + void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, + IPCServer::AccessControl::Privilege privilege) + { +- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); ++ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); + _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); + } + diff --git a/selinux-bin-sbin.patch b/selinux-bin-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-bin-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/tmpfiles.patch b/tmpfiles-v1.patch similarity index 66% rename from tmpfiles.patch rename to tmpfiles-v1.patch index 4eb6b0f..21e1468 100644 --- a/tmpfiles.patch +++ b/tmpfiles-v1.patch @@ -1,22 +1,5 @@ -From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 -From: Cropi -Date: Thu, 6 Feb 2025 08:00:59 +0100 -Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= - =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= - =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= - =?UTF-8?q?y.?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - ---- - Makefile.am | 13 +++++++++++-- - usbguard-tmpfiles.conf | 1 + - 2 files changed, 12 insertions(+), 2 deletions(-) - create mode 100644 usbguard-tmpfiles.conf - diff --git a/Makefile.am b/Makefile.am -index 7dc6849..2a8bfeb 100644 +index 7dc6849d..2a8bfebd 100644 --- a/Makefile.am +++ b/Makefile.am @@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc @@ -48,11 +31,8 @@ index 7dc6849..2a8bfeb 100644 $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf new file mode 100644 -index 0000000..e90908f +index 00000000..e90908f9 --- /dev/null +++ b/usbguard-tmpfiles.conf @@ -0,0 +1 @@ +d /var/log/usbguard 0700 root root - - --- -2.48.1 - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch new file mode 100644 index 0000000..069ee15 --- /dev/null +++ b/tmpfiles-v2.patch @@ -0,0 +1,7 @@ +diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf +index e90908f9..aff00c56 100644 +--- a/usbguard-tmpfiles.conf ++++ b/usbguard-tmpfiles.conf +@@ -1 +1 @@ +-d /var/log/usbguard 0700 root root - - ++d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch new file mode 100644 index 0000000..c05d50a --- /dev/null +++ b/uninstall-ignore-error.patch @@ -0,0 +1,34 @@ +diff --git a/Makefile.am b/Makefile.am +index 2a8bfebd..74a08cb7 100644 +--- a/Makefile.am ++++ b/Makefile.am +@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit + + uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service + rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service +- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) ++ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) + rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf +- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) ++ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) + + dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml + # +@@ -563,7 +563,7 @@ install-polkit-policy: + + uninstall-polkit-policy: + rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy +- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) ++ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) + + else + install-polkit-policy: +@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service + + uninstall-systemd-dbus-service: + rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service +- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) ++ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) + + else + install-systemd-dbus-service: diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index aac3acd..c65991c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -32,7 +32,6 @@ BuildRequires: libgcrypt-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static -BuildRequires: catch1-devel BuildRequires: autoconf automake libtool BuildRequires: bash-completion BuildRequires: asciidoc @@ -40,8 +39,14 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch -Patch2: tmpfiles.patch +Patch0: tmpfiles-v1.patch +Patch1: tmpfiles-v2.patch +Patch2: uninstall-ignore-error.patch +Patch3: ipc-privileges.patch +Patch4: protobuf-3.0.patch +Patch5: catch2-support.patch +Patch6: disable-catch.patch +Patch7: selinux-bin-sbin.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -103,8 +108,17 @@ daemon. # selinux %setup -q -D -T -a 1 -%patch -P 1 -p1 -b .catch -%patch -P 2 -p1 -b .tmpfiles +%patch -P 0 -p1 +%patch -P 1 -p1 +%patch -P 2 -p1 +%patch -P 3 -p1 +%patch -P 4 -p1 +%patch -P 5 -p1 +%patch -P 6 -p1 + +pushd %{name}-selinux-%{semodule_version} +%patch -P 7 -p1 +popd # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -119,7 +133,8 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt + --with-crypto-library=gcrypt \ + --disable-catch make %{?_smp_mflags} @@ -128,9 +143,6 @@ pushd %{name}-selinux-%{semodule_version} make popd -%check -make check - # selinux %pre selinux %selinux_relabel_pre -s %{selinuxtype} @@ -228,6 +240,14 @@ fi %changelog +* Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 +- Fix usbguard-tmpfiles.conf +- Remove catch1 dependency +- Adapt for protobuf api changes +- Fix regression in specifying IPC privileges using UID +- selinux subpackage update: unified bin and sbin +Resolves: rhbz#2297169 + * Thu Feb 06 2025 Attila Lakatos - 1.1.3-4 - Install usbguard-tmpfles.conf From 1da2d8dacd5f9bb2eb88b34901c8afe0d8b89a51 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 19:52:18 +0000 Subject: [PATCH 78/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index c65991c..5b108c2 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 24 2025 Attila Lakatos - 1.1.3-5 - Fix usbguard-tmpfiles.conf - Remove catch1 dependency From 7f57f2807aee176da5e4c7a030726cde72e5aa0f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 19:41:27 +0000 Subject: [PATCH 79/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 5b108c2..0e68fcd 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.3 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -240,6 +240,9 @@ fi %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1.1.3-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From f7c30b9e6b99a9f17c77357b056f0c9061a1c834 Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 15 Apr 2026 09:53:56 +0200 Subject: [PATCH 80/85] Rebase usbguard to 1.1.4 Rebased from 1.1.3 to 1.1.4. Dropped patches merged upstream: - tmpfiles-v1.patch - tmpfiles-v2.patch - uninstall-ignore-error.patch - ipc-privileges.patch - protobuf-3.0.patch - catch2-support.patch - disable-catch.patch Added selinux-homed.patch for systemd-homed stream connect. Resolves: rhbz#2380396 Resolves: rhbz#2376283 --- .gitignore | 1 + catch2-support.patch | 281 ----------------------------------- disable-catch.patch | 153 ------------------- ipc-privileges.patch | 88 ----------- protobuf-3.0.patch | 70 --------- selinux-homed.patch | 14 ++ sources | 2 +- tmpfiles-v1.patch | 38 ----- tmpfiles-v2.patch | 7 - uninstall-ignore-error.patch | 34 ----- usbguard.spec | 32 ++-- 11 files changed, 30 insertions(+), 690 deletions(-) delete mode 100644 catch2-support.patch delete mode 100644 disable-catch.patch delete mode 100644 ipc-privileges.patch delete mode 100644 protobuf-3.0.patch create mode 100644 selinux-homed.patch delete mode 100644 tmpfiles-v1.patch delete mode 100644 tmpfiles-v2.patch delete mode 100644 uninstall-ignore-error.patch diff --git a/.gitignore b/.gitignore index 884279b..b548d6c 100644 --- a/.gitignore +++ b/.gitignore @@ -24,3 +24,4 @@ /usbguard-1.1.2.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch2-support.patch b/catch2-support.patch deleted file mode 100644 index 49ae059..0000000 --- a/catch2-support.patch +++ /dev/null @@ -1,281 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 1f5be3a3..617d3bcf 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -396,10 +396,15 @@ else - SAVE_CPPFLAGS=$CPPFLAGS - CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" - AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" - fi -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index e10e8456..2efbb509 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -123,6 +123,7 @@ test_unit_CXXFLAGS=\ - - test_unit_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - - test_unit_LDFLAGS=\ -@@ -140,5 +141,6 @@ test_regression_CXXFLAGS=\ - - test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ -+ $(catch_LIBS) \ - $(PTHREAD_LIBS) - -diff --git a/src/Tests/Regression/github-PR209-config-parser.cpp b/src/Tests/Regression/github-PR209-config-parser.cpp -index 73b536a3..6f6e350c 100644 ---- a/src/Tests/Regression/github-PR209-config-parser.cpp -+++ b/src/Tests/Regression/github-PR209-config-parser.cpp -@@ -18,7 +18,11 @@ - // - - #include "usbguard/ConfigFile.hpp" --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - #include - #include -diff --git a/src/Tests/Regression/test_Rule_ghi113.cpp b/src/Tests/Regression/test_Rule_ghi113.cpp -index f3d9b82d..24b84935 100644 ---- a/src/Tests/Regression/test_Rule_ghi113.cpp -+++ b/src/Tests/Regression/test_Rule_ghi113.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi247.cpp b/src/Tests/Regression/test_Rule_ghi247.cpp -index 2056102d..72483bb1 100644 ---- a/src/Tests/Regression/test_Rule_ghi247.cpp -+++ b/src/Tests/Regression/test_Rule_ghi247.cpp -@@ -19,7 +19,11 @@ - #include "usbguard/Rule.hpp" - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Regression/test_Rule_ghi37.cpp b/src/Tests/Regression/test_Rule_ghi37.cpp -index f240c8b5..df2ef637 100644 ---- a/src/Tests/Regression/test_Rule_ghi37.cpp -+++ b/src/Tests/Regression/test_Rule_ghi37.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_Base64.cpp b/src/Tests/Unit/test_Base64.cpp -index 3f87093f..113b0633 100644 ---- a/src/Tests/Unit/test_Base64.cpp -+++ b/src/Tests/Unit/test_Base64.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_IPCServer_AccessControl.cpp b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -index 4ed4167b..f85a4ccb 100644 ---- a/src/Tests/Unit/test_IPCServer_AccessControl.cpp -+++ b/src/Tests/Unit/test_IPCServer_AccessControl.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/IPCServer.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_Rule.cpp b/src/Tests/Unit/test_Rule.cpp -index cafc8cca..015ce1bc 100644 ---- a/src/Tests/Unit/test_Rule.cpp -+++ b/src/Tests/Unit/test_Rule.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleAttribute_id.cpp b/src/Tests/Unit/test_RuleAttribute_id.cpp -index ddb93dec..2aff77b6 100644 ---- a/src/Tests/Unit/test_RuleAttribute_id.cpp -+++ b/src/Tests/Unit/test_RuleAttribute_id.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_RuleParser.cpp b/src/Tests/Unit/test_RuleParser.cpp -index e9bc21e2..e310de81 100644 ---- a/src/Tests/Unit/test_RuleParser.cpp -+++ b/src/Tests/Unit/test_RuleParser.cpp -@@ -18,7 +18,11 @@ - // - #include "usbguard/Rule.hpp" - --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - - using namespace usbguard; - -diff --git a/src/Tests/Unit/test_UEvent.cpp b/src/Tests/Unit/test_UEvent.cpp -index 759ee2cd..cbfd554c 100644 ---- a/src/Tests/Unit/test_UEvent.cpp -+++ b/src/Tests/Unit/test_UEvent.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UEventParser.cpp b/src/Tests/Unit/test_UEventParser.cpp -index cefbc3bd..205a6885 100644 ---- a/src/Tests/Unit/test_UEventParser.cpp -+++ b/src/Tests/Unit/test_UEventParser.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -index fbe8bbdc..4a2e9612 100644 ---- a/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -+++ b/src/Tests/Unit/test_UMockdevDeviceDefinition.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - #include "test_UMockdevDeviceDefinition.data.hpp" -diff --git a/src/Tests/Unit/test_Utility.cpp b/src/Tests/Unit/test_Utility.cpp -index 6d3e188f..a85fa362 100644 ---- a/src/Tests/Unit/test_Utility.cpp -+++ b/src/Tests/Unit/test_Utility.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #include -+#endif - #include - - using namespace usbguard; -diff --git a/src/Tests/main.cpp b/src/Tests/main.cpp -index 4e3e8760..1b001998 100644 ---- a/src/Tests/main.cpp -+++ b/src/Tests/main.cpp -@@ -16,7 +16,11 @@ - // - // Authors: Daniel Kopecek - // --#define CATCH_CONFIG_MAIN --#include -+#ifdef HAVE_CATCH2_V3 -+ #include -+#else -+ #define CATCH_CONFIG_MAIN -+ #include -+#endif - - /* vim: set ts=2 sw=2 et */ diff --git a/disable-catch.patch b/disable-catch.patch deleted file mode 100644 index 3a7219a..0000000 --- a/disable-catch.patch +++ /dev/null @@ -1,153 +0,0 @@ -diff --git a/configure.ac b/configure.ac -index 617d3bcf..56bbe9e3 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -386,27 +386,38 @@ fi - # - # Catch C++ library - # -+AC_ARG_ENABLE([catch], -+ [AS_HELP_STRING([--enable-catch], [Enable Catch testing framework support (default=yes)])], -+ [enable_catch=$enableval], [enable_catch=yes]) -+ - AC_ARG_WITH([bundled-catch], AS_HELP_STRING([--with-bundled-catch], [Build using the bundled Catch library]), [with_bundled_catch=$withval], [with_bundled_catch=no]) --if test "x$with_bundled_catch" = xyes; then -- catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -- catch_LIBS="" -- AC_MSG_NOTICE([Using bundled Catch library]) -- catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ -+if test "x$enable_catch" = xyes; then -+ if test "x$with_bundled_catch" = xyes; then -+ catch_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/Catch/single_include/catch2" -+ catch_LIBS="" -+ AC_MSG_NOTICE([Using bundled Catch library]) -+ catch_summary="bundled; $catch_CFLAGS $catch_LIBS" -+ else -+ SAVE_CPPFLAGS=$CPPFLAGS -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ AC_LANG_PUSH([C++]) -+ AC_CHECK_HEADER([catch_test_macros.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -+ catch_LIBS="-lCatch2Main -lCatch2"], -+ [AC_CHECK_HEADER([catch.hpp], -+ [catch_CFLAGS="-I/usr/include/catch2" -+ catch_LIBS=""], -+ [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -+ )]) -+ AC_LANG_POP -+ CPPFLAGS=$SAVE_CPPFLAGS -+ catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ fi - else -- SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -- AC_LANG_PUSH([C++]) -- AC_CHECK_HEADER([catch_test_macros.hpp], -- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" -- catch_LIBS="-lCatch2Main -lCatch2"], -- [AC_CHECK_HEADER([catch.hpp], -- [catch_CFLAGS="-I/usr/include/catch2" -- catch_LIBS=""], -- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] -- )]) -- AC_LANG_POP -- CPPFLAGS=$SAVE_CPPFLAGS -- catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" -+ catch_CFLAGS="" -+ catch_LIBS="" -+ catch_summary="disabled; not checking for Catch2" - fi - AC_SUBST([catch_CFLAGS]) - AC_SUBST([catch_LIBS]) -@@ -798,6 +809,7 @@ AM_CONDITIONAL([POLICYKIT_ENABLED], [test "x$with_polkit" = xyes]) - AM_CONDITIONAL([FULL_TEST_SUITE_ENABLED], [test "x$full_test_suite" = xyes]) - AM_CONDITIONAL([WITH_LDAP], [test "x$with_ldap" = xyes]) - AM_CONDITIONAL([BASH_COMPLETION_ENABLED], [test "x$bash_completion" != xno]) -+AM_CONDITIONAL([CATCH_ENABLED], [test "x$enable_catch" = xyes ]) - - CXXFLAGS="$CXXFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CXXFLAGS" - CFLAGS="$CFLAGS -fvisibility=hidden $COMMON_WARNING_FLAGS $WARNING_CFLAGS" -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index b84d2480..aa504bc9 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -583,7 +583,8 @@ namespace usbguard - return true; - } - -- bool isValidNameOrUID(const std::string& input) { -+ bool isValidNameOrUID(const std::string& input) -+ { - return isValidName(input) || isValidUID(input); - } - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index b75df136..555d113e 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,7 +36,7 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidNameOrUID(name)) { -+ if (!isValidNameOrUID(name)) { - throw Exception("IPC access control", "invalid name or UID format", name); - } - } -diff --git a/src/Tests/Makefile.am b/src/Tests/Makefile.am -index 2efbb509..435a4264 100644 ---- a/src/Tests/Makefile.am -+++ b/src/Tests/Makefile.am -@@ -74,11 +74,15 @@ TESTS_ENVIRONMENT=\ - - - TESTS=\ -- test-unit \ -- test-regression \ - USB/test-descriptor-parser.sh \ - Rules/test-rules.sh - -+if CATCH_ENABLED -+TESTS+=\ -+ test-unit \ -+ test-regression -+endif -+ - if FULL_TEST_SUITE_ENABLED - TESTS+=\ - Source/check-driver.sh \ -@@ -101,10 +105,15 @@ TESTS+=\ - - endif - --check_PROGRAMS=\ -+check_PROGRAMS= -+ -+if CATCH_ENABLED -+check_PROGRAMS+=\ - test-unit \ - test-regression -+endif - -+if CATCH_ENABLED - test_unit_SOURCES=\ - main.cpp \ - Unit/test_Rule.cpp \ -@@ -128,7 +137,9 @@ test_unit_LDADD=\ - - test_unit_LDFLAGS=\ - -static -+endif - -+if CATCH_ENABLED - test_regression_SOURCES=\ - main.cpp \ - Regression/test_Rule_ghi37.cpp \ -@@ -143,4 +154,4 @@ test_regression_LDADD=\ - $(top_builddir)/libusbguard.la \ - $(catch_LIBS) \ - $(PTHREAD_LIBS) -- -+endif -\ No newline at end of file diff --git a/ipc-privileges.patch b/ipc-privileges.patch deleted file mode 100644 index bf0f65d..0000000 --- a/ipc-privileges.patch +++ /dev/null @@ -1,88 +0,0 @@ -diff --git a/src/Common/Utility.cpp b/src/Common/Utility.cpp -index aee50ce0..b84d2480 100644 ---- a/src/Common/Utility.cpp -+++ b/src/Common/Utility.cpp -@@ -543,7 +543,22 @@ namespace usbguard - return rulefile_list; - } - -- bool isValidName(const std::string& name) -+ static bool isValidUID(const std::string& uid) -+ { -+ if (uid.empty()) { -+ return false; -+ } -+ -+ for (char c : uid) { -+ if (!std::isdigit(c)) { -+ return false; -+ } -+ } -+ -+ return true; -+ } -+ -+ static bool isValidName(const std::string& name) - { - const char* s = name.data(); - -@@ -568,6 +583,10 @@ namespace usbguard - return true; - } - -+ bool isValidNameOrUID(const std::string& input) { -+ return isValidName(input) || isValidUID(input); -+ } -+ - } /* namespace usbguard */ - - /* vim: set ts=2 sw=2 et */ -diff --git a/src/Common/Utility.hpp b/src/Common/Utility.hpp -index d49e24dc..ac0bae4f 100644 ---- a/src/Common/Utility.hpp -+++ b/src/Common/Utility.hpp -@@ -319,12 +319,11 @@ namespace usbguard - /** - * @brief Checks whether a given name is a valid group/user name - * -- * User/group names must match [A-Za-z_][A-Za-z0-9_-]*[$] - * - * @param name Name to check - * @return True if given name is valid, false otherwise - */ -- bool isValidName(const std::string& name); -+ bool isValidNameOrUID(const std::string& name); - - } /* namespace usbguard */ - -diff --git a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp -index 973eb8bd..b75df136 100644 ---- a/src/Library/public/usbguard/IPCServer.cpp -+++ b/src/Library/public/usbguard/IPCServer.cpp -@@ -36,8 +36,8 @@ namespace usbguard - throw Exception("IPC access control", "name too long", name); - } - -- if (!isValidName(name)) { -- throw Exception("IPC access control", "invalid name format", name); -+ if (!isValidNameOrUID(name)) { -+ throw Exception("IPC access control", "invalid name or UID format", name); - } - } - -diff --git a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp -index ddb1d8a7..0ba6f93d 100644 ---- a/src/Library/public/usbguard/IPCServer.hpp -+++ b/src/Library/public/usbguard/IPCServer.hpp -@@ -50,9 +50,9 @@ namespace usbguard - /** - * @brief Checks whether given name is a valid access control name. - * -- * Name is a valid access control name iff: -+ * Name is a valid access control name if: - * 1. it is not longer then 32 characters -- * 2. it matches regex [A-Za-z_][A-Za-z0-9_-]*[$] -+ * 2. it is aligned with the syntax of useradd(8) - * - * @param name Name to be verified. - * @throw Exception If \p name is not a valid access control name. diff --git a/protobuf-3.0.patch b/protobuf-3.0.patch deleted file mode 100644 index ce12d9f..0000000 --- a/protobuf-3.0.patch +++ /dev/null @@ -1,70 +0,0 @@ -diff --git a/src/Library/IPCClientPrivate.cpp b/src/Library/IPCClientPrivate.cpp -index 6aa52013..452ecd41 100644 ---- a/src/Library/IPCClientPrivate.cpp -+++ b/src/Library/IPCClientPrivate.cpp -@@ -225,7 +225,7 @@ namespace usbguard - std::string payload; - message.SerializeToString(&payload); - struct qb_ipc_request_header hdr; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message.GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message.GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - struct iovec iov[2]; - iov[0].iov_base = &hdr; -diff --git a/src/Library/IPCClientPrivate.hpp b/src/Library/IPCClientPrivate.hpp -index d92a1d47..a33022e2 100644 ---- a/src/Library/IPCClientPrivate.hpp -+++ b/src/Library/IPCClientPrivate.hpp -@@ -84,7 +84,7 @@ namespace usbguard - template - void registerHandler(MessageHandler::HandlerType method) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method)); - } - -diff --git a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp -index 548a7261..b976f025 100644 ---- a/src/Library/IPCServerPrivate.cpp -+++ b/src/Library/IPCServerPrivate.cpp -@@ -311,7 +311,7 @@ namespace usbguard - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr; - struct iovec iov[2]; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - iov[0].iov_base = &hdr; -@@ -555,7 +555,7 @@ namespace usbguard - std::string payload; - message->SerializeToString(&payload); - struct qb_ipc_response_header hdr = { }; -- hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(message->GetTypeName()); -+ hdr.id = QB_IPC_MSG_USER_START + IPC::messageTypeNameToNumber(std::string(message->GetTypeName())); - hdr.size = sizeof hdr + payload.size(); - hdr.error = 0; - struct iovec iov[2]; -@@ -563,7 +563,7 @@ namespace usbguard - iov[0].iov_len = sizeof hdr; - iov[1].iov_base = (void*)payload.data(); - iov[1].iov_len = payload.size(); -- qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(message->GetTypeName())); -+ qbIPCBroadcastData(iov, 2, messageTypeNameToAccessControlSection(std::string(message->GetTypeName()))); - iov[0].iov_base = nullptr; - iov[1].iov_base = nullptr; - } -diff --git a/src/Library/IPCServerPrivate.hpp b/src/Library/IPCServerPrivate.hpp -index 25f9ac38..3b3dcc51 100644 ---- a/src/Library/IPCServerPrivate.hpp -+++ b/src/Library/IPCServerPrivate.hpp -@@ -134,7 +134,7 @@ namespace usbguard - void registerHandler(MessageHandler::HandlerType method, IPCServer::AccessControl::Section section, - IPCServer::AccessControl::Privilege privilege) - { -- const uint32_t type_number = IPC::messageTypeNameToNumber(T::default_instance().GetTypeName()); -+ const uint32_t type_number = IPC::messageTypeNameToNumber(std::string(T::default_instance().GetTypeName())); - _handlers.emplace(type_number, MessageHandler::create(*this, method, section, privilege)); - } - diff --git a/selinux-homed.patch b/selinux-homed.patch new file mode 100644 index 0000000..a90d027 --- /dev/null +++ b/selinux-homed.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.te b/usbguard.te +index 52d0090..f8e55bc 100644 +--- a/usbguard.te ++++ b/usbguard.te +@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',` + systemd_userdbd_stream_connect(usbguard_t) + ') + ') ++ ++ifdef(`systemd_homed_stream_connect',` ++ optional_policy(` ++ systemd_homed_stream_connect(usbguard_t) ++ ') ++') diff --git a/sources b/sources index 6fead78..7f52001 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 diff --git a/tmpfiles-v1.patch b/tmpfiles-v1.patch deleted file mode 100644 index 21e1468..0000000 --- a/tmpfiles-v1.patch +++ /dev/null @@ -1,38 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 7dc6849d..2a8bfebd 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 00000000..e90908f9 ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - diff --git a/tmpfiles-v2.patch b/tmpfiles-v2.patch deleted file mode 100644 index 069ee15..0000000 --- a/tmpfiles-v2.patch +++ /dev/null @@ -1,7 +0,0 @@ -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -index e90908f9..aff00c56 100644 ---- a/usbguard-tmpfiles.conf -+++ b/usbguard-tmpfiles.conf -@@ -1 +1 @@ --d /var/log/usbguard 0700 root root - - -+d /var/log/usbguard 0755 root root - - diff --git a/uninstall-ignore-error.patch b/uninstall-ignore-error.patch deleted file mode 100644 index c05d50a..0000000 --- a/uninstall-ignore-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -diff --git a/Makefile.am b/Makefile.am -index 2a8bfebd..74a08cb7 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -535,9 +535,9 @@ install-data-dbus: $(top_builddir)/src/DBus/org.usbguard1.service install-polkit - - uninstall-data-dbus: uninstall-polkit-policy uninstall-systemd-dbus-service - rm -f $(DESTDIR)$(DBUS_SERVICES_DIR)/org.usbguard1.service -- rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) -+ -rmdir $(DESTDIR)$(DBUS_SERVICES_DIR) - rm -f $(DESTDIR)$(DBUS_BUSCONFIG_DIR)/org.usbguard1.conf -- rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) -+ -rmdir $(DESTDIR)$(DBUS_BUSCONFIG_DIR) - - dbus-docs: $(top_srcdir)/src/DBus/DBusInterface.xml - # -@@ -563,7 +563,7 @@ install-polkit-policy: - - uninstall-polkit-policy: - rm -f $(DESTDIR)$(POLKIT_POLICY_DIR)/org.usbguard1.policy -- rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) -+ -rmdir $(DESTDIR)$(POLKIT_POLICY_DIR) - - else - install-polkit-policy: -@@ -577,7 +577,7 @@ install-systemd-dbus-service: $(top_builddir)/src/DBus/usbguard-dbus.service - - uninstall-systemd-dbus-service: - rm -f $(DESTDIR)$(SYSTEMD_UNIT_DIR)/usbguard-dbus.service -- rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) -+ -rmdir $(DESTDIR)$(SYSTEMD_UNIT_DIR) - - else - install-systemd-dbus-service: diff --git a/usbguard.spec b/usbguard.spec index 0e68fcd..e31109c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -3,8 +3,8 @@ %define semodule_version 0.0.5 Name: usbguard -Version: 1.1.3 -Release: 7%{?dist} +Version: 1.1.4 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -39,14 +39,8 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch0: tmpfiles-v1.patch -Patch1: tmpfiles-v2.patch -Patch2: uninstall-ignore-error.patch -Patch3: ipc-privileges.patch -Patch4: protobuf-3.0.patch -Patch5: catch2-support.patch -Patch6: disable-catch.patch -Patch7: selinux-bin-sbin.patch +Patch0: selinux-bin-sbin.patch +Patch1: selinux-homed.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -108,16 +102,9 @@ daemon. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} %patch -P 0 -p1 %patch -P 1 -p1 -%patch -P 2 -p1 -%patch -P 3 -p1 -%patch -P 4 -p1 -%patch -P 5 -p1 -%patch -P 6 -p1 - -pushd %{name}-selinux-%{semodule_version} -%patch -P 7 -p1 popd # Remove bundled library sources before build @@ -240,6 +227,15 @@ fi %changelog +* Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, + uninstall-ignore-error, ipc-privileges, protobuf-3.0, + catch2-support, disable-catch +- Add SELinux policy fix for systemd-homed stream connect + Resolves: rhbz#2380396 + Resolves: rhbz#2376283 + * Sat Jan 17 2026 Fedora Release Engineering - 1.1.3-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 4678a493473ffa43f5b513724b7e86fb54fdfd85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 29 May 2026 22:38:59 +0200 Subject: [PATCH 81/85] rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index e31109c..d0013cb 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri May 29 2026 Miroslav Suchy - 1.1.4-2 +- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x + * Wed Apr 15 2026 Attila Lakatos - 1.1.4-1 - Rebase to 1.1.4 - Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2, From d8c5d46563d9e227ddeff80ba2b2929e804edb7d Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Wed, 10 Jun 2026 17:01:34 -0400 Subject: [PATCH 82/85] Use openssl for crypto openssl is preferred over libgcrypt because the latter does not support FIPS or crypto policies. --- usbguard.spec | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/usbguard.spec b/usbguard.spec index d0013cb..70d0d0c 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -28,7 +28,7 @@ BuildRequires: make BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: libqb-devel -BuildRequires: libgcrypt-devel +BuildRequires: openssl-devel BuildRequires: libstdc++-devel BuildRequires: protobuf-devel protobuf-compiler BuildRequires: PEGTL-static @@ -120,7 +120,7 @@ autoreconf -i -v --no-recursive ./ --enable-systemd \ --with-dbus \ --with-polkit \ - --with-crypto-library=gcrypt \ + --with-crypto-library=openssl \ --disable-catch make %{?_smp_mflags} @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 +- Use openssl for crypto + * Fri May 29 2026 Miroslav Suchy - 1.1.4-2 - rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x From 9dc2db7571bfc681d193e2bacb78b8ce662c4118 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Sun, 21 Jun 2026 23:03:27 -0400 Subject: [PATCH 83/85] Rebuilt for openssl 4.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 70d0d0c..408a85b 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 +- Rebuilt for openssl 4.0 + * Wed Jun 10 2026 Yaakov Selkowitz - 1.1.4-3 - Use openssl for crypto From d0db16e23688fe489d1b553843cc1f17c604015f Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Wed, 24 Jun 2026 06:55:37 +0100 Subject: [PATCH 84/85] Rebuilt for abseil-cpp 20260526.0 --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index 408a85b..b5c21c6 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 +- Rebuilt for abseil-cpp 20260526.0 + * Mon Jun 22 2026 Yaakov Selkowitz - 1.1.4-4 - Rebuilt for openssl 4.0 From c3a58aca9edcba6676dcdc785129c099be1d0b08 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 08:16:04 +0000 Subject: [PATCH 85/85] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- usbguard.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/usbguard.spec b/usbguard.spec index b5c21c6..bc73333 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -4,7 +4,7 @@ Name: usbguard Version: 1.1.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -227,6 +227,9 @@ fi %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.1.4-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Wed Jun 24 2026 Benjamin A. Beasley - 1.1.4-5 - Rebuilt for abseil-cpp 20260526.0