Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

openssl is preferred over libgcrypt because the latter does not support
FIPS or crypto policies.

.gitignore

@@ -12,3 +12,16 @@
 /usbguard-0.7.0.tar.gz
 /usbguard-0.7.1.tar.gz
 /usbguard-0.7.2.tar.gz
+/usbguard-0.7.6.tar.gz
+/usbguard-selinux-0.0.1.tar.gz
+/usbguard-selinux-0.0.2.tar.gz
+/usbguard-0.7.7.tar.gz
+/usbguard-selinux-0.0.3.tar.gz
+/usbguard-0.7.8.tar.gz
+/usbguard-selinux-0.0.4.tar.gz
+/usbguard-1.0.0.tar.gz
+/usbguard-1.1.0.tar.gz
+/usbguard-1.1.2.tar.gz
+/usbguard-1.1.3.tar.gz
+/usbguard-selinux-0.0.5.tar.gz
+/usbguard-1.1.4.tar.gz

0001-Update-to-latest-PEGTL-API.patch

@@ -1,567 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index a135e01..f565b87 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -290,54 +290,28 @@ AC_SUBST([catch_LIBS])
- #
- AC_ARG_WITH([bundled-pegtl], AS_HELP_STRING([--with-bundled-pegtl], [Build using the bundled PEGTL library]), [with_bundled_pegtl=$withval], [with_bundled_pegtl=no])
- if test "x$with_bundled_pegtl" = xyes; then
--	pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL"
--	pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL"
-+	pegtl_CFLAGS="-I\$(top_srcdir)/src/ThirdParty/PEGTL/include"
-+	pegtl_AC_CFLAGS="-I$srcdir/src/ThirdParty/PEGTL/include"
- 	pegtl_LIBS=""
- 	AC_MSG_NOTICE([Using bundled PEGTL library])
- 	pegtl_summary="bundled; $pegtl_CFLAGS $pegtl_LIBS"
- else
--	SAVE_CPPFLAGS=$CPPFLAGS
--	CPPFLAGS="-std=c++11 $CPPFLAGS"
--	AC_LANG_PUSH([C++])
--	AC_CHECK_HEADER([pegtl.hh], [], [AC_MSG_FAILURE(pegtl.hh not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)])
--	AC_LANG_POP
- 	pegtl_CFLAGS=""
- 	pegtl_AC_CFLAGS=""
- 	pegtl_LIBS=""
--	CPPFLAGS=$SAVE_CPPFLAGS
- 	pegtl_summary="system-wide; $pegtl_CFLAGS $pegtl_LIBS"
- fi
- AC_SUBST([pegtl_CFLAGS])
- AC_SUBST([pegtl_AC_CFLAGS])
- AC_SUBST([pegtl_LIBS])
- 
--#
--# Check whether the available PEGTL library is compatible
--# with version 1.3.1 or older.
--#
- SAVE_CPPFLAGS=$CPPFLAGS
--CPPFLAGS="-std=c++11 $pegtl_AC_CFLAGS"
-+CPPFLAGS="-std=c++11 $CPPFLAGS $pegtl_AC_CFLAGS"
- AC_LANG_PUSH([C++])
--AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
--#include <pegtl.hh>
--#include <string>
--int main(void)
--{
--  struct grammar
--   : pegtl::one<'g'> {};
--  try {
--    pegtl::parse_string<grammar>(std::string(), std::string());
--  } catch(const pegtl::parse_error& ex) {
--    auto b = ex.positions[0].byte_in_line;
--  }
--  return 0;
--}
--]])],
--[have_pegtl_lte_131=no], [have_pegtl_lte_131=yes])
-+AC_CHECK_HEADER([tao/pegtl.hpp],
-+		[AC_DEFINE([HAVE_TAO_PEGTL_HPP], [1], [PEGTL header file with .hpp extension is present])],
-+		[AC_MSG_FAILURE(PEGTL header file not found or not usable. Re-run with --with-bundled-pegtl to use the bundled library.)])
- AC_LANG_POP
--if test "x$have_pegtl_lte_131" = xyes; then
--  AC_DEFINE([HAVE_PEGTL_LTE_1_3_1], [1], [PEGTL version less than or equal to 1.3.1])
--fi
- CPPFLAGS=$SAVE_CPPFLAGS
- 
- #
-diff --git a/src/Library/RuleParser/Actions.hpp b/src/Library/RuleParser/Actions.hpp
-index 3e185f4..2b21bd2 100644
---- a/src/Library/RuleParser/Actions.hpp
-+++ b/src/Library/RuleParser/Actions.hpp
-@@ -24,7 +24,7 @@
- #include "Utility.hpp"
- #include "Common/Utility.hpp"
- 
--#include <pegtl.hh>
-+#include <tao/pegtl.hpp>
- 
- namespace usbguard
- {
-@@ -47,7 +47,7 @@ namespace usbguard
-     struct str_if;
- 
-     template<typename Rule>
--    struct rule_parser_actions : pegtl::nothing<Rule> {};
-+    struct rule_parser_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct rule_parser_actions<target> {
-@@ -58,7 +58,7 @@ namespace usbguard
-           rule.setTarget(Rule::targetFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -75,7 +75,7 @@ namespace usbguard
-           rule.setDeviceID(device_id);
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -87,7 +87,7 @@ namespace usbguard
-     }
- 
-     template<typename Rule>
--    struct name_actions : pegtl::nothing<Rule> {};
-+    struct name_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct name_actions<str_name> {
-@@ -95,7 +95,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeName().empty()) {
--          throw pegtl::parse_error("name attribute already defined", in);
-+          throw tao::pegtl::parse_error("name attribute already defined", in);
-         }
-       }
-     };
-@@ -109,7 +109,7 @@ namespace usbguard
-           rule.attributeName().append(stringValueFromRule(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -123,13 +123,13 @@ namespace usbguard
-           rule.attributeName().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct id_actions : pegtl::nothing<Rule> {};
-+    struct id_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct id_actions<str_id> {
-@@ -137,7 +137,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeDeviceID().empty()) {
--          throw pegtl::parse_error("id attribute already defined", in);
-+          throw tao::pegtl::parse_error("id attribute already defined", in);
-         }
-       }
-     };
-@@ -154,7 +154,7 @@ namespace usbguard
-           rule.attributeDeviceID().append(device_id);
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -168,13 +168,13 @@ namespace usbguard
-           rule.attributeDeviceID().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct hash_actions : pegtl::nothing<Rule> {};
-+    struct hash_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct hash_actions<str_hash> {
-@@ -182,7 +182,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeHash().empty()) {
--          throw pegtl::parse_error("hash attribute already defined", in);
-+          throw tao::pegtl::parse_error("hash attribute already defined", in);
-         }
-       }
-     };
-@@ -196,7 +196,7 @@ namespace usbguard
-           rule.attributeHash().append(stringValueFromRule(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -210,13 +210,13 @@ namespace usbguard
-           rule.attributeHash().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct parent_hash_actions : pegtl::nothing<Rule> {};
-+    struct parent_hash_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct parent_hash_actions<str_parent_hash> {
-@@ -224,7 +224,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeParentHash().empty()) {
--          throw pegtl::parse_error("parent-hash attribute already defined", in);
-+          throw tao::pegtl::parse_error("parent-hash attribute already defined", in);
-         }
-       }
-     };
-@@ -238,7 +238,7 @@ namespace usbguard
-           rule.attributeParentHash().append(stringValueFromRule(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -252,13 +252,13 @@ namespace usbguard
-           rule.attributeParentHash().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct serial_actions : pegtl::nothing<Rule> {};
-+    struct serial_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct serial_actions<str_serial> {
-@@ -266,7 +266,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeSerial().empty()) {
--          throw pegtl::parse_error("serial attribute already defined", in);
-+          throw tao::pegtl::parse_error("serial attribute already defined", in);
-         }
-       }
-     };
-@@ -280,7 +280,7 @@ namespace usbguard
-           rule.attributeSerial().append(stringValueFromRule(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -294,13 +294,13 @@ namespace usbguard
-           rule.attributeSerial().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct via_port_actions : pegtl::nothing<Rule> {};
-+    struct via_port_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct via_port_actions<str_via_port> {
-@@ -308,7 +308,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeViaPort().empty()) {
--          throw pegtl::parse_error("via-port attribute already defined", in);
-+          throw tao::pegtl::parse_error("via-port attribute already defined", in);
-         }
-       }
-     };
-@@ -322,7 +322,7 @@ namespace usbguard
-           rule.attributeViaPort().append(stringValueFromRule(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -336,13 +336,13 @@ namespace usbguard
-           rule.attributeViaPort().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct with_interface_actions : pegtl::nothing<Rule> {};
-+    struct with_interface_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct with_interface_actions<str_with_interface> {
-@@ -350,7 +350,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeWithInterface().empty()) {
--          throw pegtl::parse_error("with-interface attribute already defined", in);
-+          throw tao::pegtl::parse_error("with-interface attribute already defined", in);
-         }
-       }
-     };
-@@ -365,7 +365,7 @@ namespace usbguard
-           rule.attributeWithInterface().append(interface_type);
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -379,13 +379,13 @@ namespace usbguard
-           rule.attributeWithInterface().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
- 
-     template<typename Rule>
--    struct condition_actions : pegtl::nothing<Rule> {};
-+    struct condition_actions : tao::pegtl::nothing<Rule> {};
- 
-     template<>
-     struct condition_actions<str_if> {
-@@ -393,7 +393,7 @@ namespace usbguard
-       static void apply(const Input& in, Rule& rule)
-       {
-         if (!rule.attributeConditions().empty()) {
--          throw pegtl::parse_error("conditions already defined", in);
-+          throw tao::pegtl::parse_error("conditions already defined", in);
-         }
-       }
-     };
-@@ -407,7 +407,7 @@ namespace usbguard
-           rule.attributeConditions().append(RuleCondition(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-@@ -421,7 +421,7 @@ namespace usbguard
-           rule.attributeConditions().setSetOperator(Rule::setOperatorFromString(in.string()));
-         }
-         catch (const std::exception& ex) {
--          throw pegtl::parse_error(ex.what(), in);
-+          throw tao::pegtl::parse_error(ex.what(), in);
-         }
-       }
-     };
-diff --git a/src/Library/RuleParser/Grammar.hpp b/src/Library/RuleParser/Grammar.hpp
-index 9bd4a15..4d785c0 100644
---- a/src/Library/RuleParser/Grammar.hpp
-+++ b/src/Library/RuleParser/Grammar.hpp
-@@ -22,37 +22,37 @@
- #endif
- 
- #include "Actions.hpp"
--#include <pegtl.hh>
- 
--using namespace pegtl;
-+#include <tao/pegtl.hpp>
- 
- namespace usbguard
- {
-   namespace RuleParser
-   {
-+    using namespace tao::pegtl;
-     /*
-      * Rule language keywords
-      */
--    struct str_allow : pegtl_string_t("allow") {};
--    struct str_block : pegtl_string_t("block") {};
--    struct str_reject : pegtl_string_t("reject") {};
--    struct str_match : pegtl_string_t("match") {};
--    struct str_device : pegtl_string_t("device") {};
--
--    struct str_name : pegtl_string_t("name") {};
--    struct str_hash : pegtl_string_t("hash") {};
--    struct str_parent_hash : pegtl_string_t("parent-hash") {};
--    struct str_via_port : pegtl_string_t("via-port") {};
--    struct str_with_interface : pegtl_string_t("with-interface") {};
--    struct str_serial : pegtl_string_t("serial") {};
--    struct str_if : pegtl_string_t("if") {};
--    struct str_id : pegtl_string_t("id") {};
--
--    struct str_all_of : pegtl_string_t("all-of") {};
--    struct str_one_of : pegtl_string_t("one-of") {};
--    struct str_none_of : pegtl_string_t("none-of") {};
--    struct str_equals : pegtl_string_t("equals") {};
--    struct str_equals_ordered : pegtl_string_t("equals-ordered") {};
-+    struct str_allow : TAOCPP_PEGTL_STRING("allow") {};
-+    struct str_block : TAOCPP_PEGTL_STRING("block") {};
-+    struct str_reject : TAOCPP_PEGTL_STRING("reject") {};
-+    struct str_match : TAOCPP_PEGTL_STRING("match") {};
-+    struct str_device : TAOCPP_PEGTL_STRING("device") {};
-+
-+    struct str_name : TAOCPP_PEGTL_STRING("name") {};
-+    struct str_hash : TAOCPP_PEGTL_STRING("hash") {};
-+    struct str_parent_hash : TAOCPP_PEGTL_STRING("parent-hash") {};
-+    struct str_via_port : TAOCPP_PEGTL_STRING("via-port") {};
-+    struct str_with_interface : TAOCPP_PEGTL_STRING("with-interface") {};
-+    struct str_serial : TAOCPP_PEGTL_STRING("serial") {};
-+    struct str_if : TAOCPP_PEGTL_STRING("if") {};
-+    struct str_id : TAOCPP_PEGTL_STRING("id") {};
-+
-+    struct str_all_of : TAOCPP_PEGTL_STRING("all-of") {};
-+    struct str_one_of : TAOCPP_PEGTL_STRING("one-of") {};
-+    struct str_none_of : TAOCPP_PEGTL_STRING("none-of") {};
-+    struct str_equals : TAOCPP_PEGTL_STRING("equals") {};
-+    struct str_equals_ordered : TAOCPP_PEGTL_STRING("equals-ordered") {};
- 
-     /*
-      * Generic rule attribute
-diff --git a/src/Library/UEventParser.cpp b/src/Library/UEventParser.cpp
-index 2e0ce39..aebe948 100644
---- a/src/Library/UEventParser.cpp
-+++ b/src/Library/UEventParser.cpp
-@@ -27,7 +27,9 @@
- #include "usbguard/Logger.hpp"
- 
- #include <fstream>
--#include <pegtl/trace.hh>
-+
-+#include <tao/pegtl/contrib/tracer.hpp>
-+using namespace tao;
- 
- namespace usbguard
- {
-@@ -114,25 +116,14 @@ namespace usbguard
-   void parseUEventFromString(const std::string& uevent_string, UEvent& uevent, bool trace)
-   {
-     try {
--#if HAVE_PEGTL_LTE_1_3_1
-+      tao::pegtl::string_input<> in(uevent_string, std::string());
- 
-       if (!trace) {
--        pegtl::parse<G, UEventParser::actions>(uevent_string, std::string(), uevent);
-+        tao::pegtl::parse<G, UEventParser::actions>(in, uevent);
-       }
-       else {
--        pegtl::parse<G, UEventParser::actions, pegtl::tracer>(uevent_string, std::string(), uevent);
--      }
--
--#else
--
--      if (!trace) {
--        pegtl::parse_string<G, UEventParser::actions>(uevent_string, std::string(), uevent);
-+        tao::pegtl::parse<G, UEventParser::actions, tao::pegtl::tracer>(in, uevent);
-       }
--      else {
--        pegtl::parse_string<G, UEventParser::actions, pegtl::tracer>(uevent_string, std::string(), uevent);
--      }
--
--#endif
-     }
-     catch (...) {
-       throw;
-diff --git a/src/Library/UEventParser.hpp b/src/Library/UEventParser.hpp
-index 856d5ff..4261bd5 100644
---- a/src/Library/UEventParser.hpp
-+++ b/src/Library/UEventParser.hpp
-@@ -23,9 +23,7 @@
- 
- #include "usbguard/Typedefs.hpp"
- 
--#include <pegtl.hh>
--
--using namespace pegtl;
-+#include <tao/pegtl.hpp>
- 
- namespace usbguard
- {
-@@ -33,6 +31,8 @@ namespace usbguard
- 
-   namespace UEventParser
-   {
-+    using namespace tao::pegtl;
-+
-     struct value
-       : seq<not_one<'\0', '\n'>, star<not_one<'\0', '\n'>>> {};
- 
-diff --git a/src/Library/public/usbguard/RuleParser.cpp b/src/Library/public/usbguard/RuleParser.cpp
-index 4061e01..140bf14 100644
---- a/src/Library/public/usbguard/RuleParser.cpp
-+++ b/src/Library/public/usbguard/RuleParser.cpp
-@@ -34,7 +34,7 @@
- #include <stdexcept>
- #include <stdlib.h>
- 
--#include <pegtl/trace.hh>
-+#include <tao/pegtl/contrib/tracer.hpp>
- 
- namespace usbguard
- {
-@@ -42,35 +42,21 @@ namespace usbguard
-   {
-     try {
-       Rule rule;
--#if HAVE_PEGTL_LTE_1_3_1
-+      tao::pegtl::string_input<> input(rule_spec, file);
- 
-       if (!trace) {
--        pegtl::parse<RuleParser::rule_grammar, RuleParser::rule_parser_actions>(rule_spec, file, rule);
-+        tao::pegtl::parse<RuleParser::rule_grammar, RuleParser::rule_parser_actions>(input, rule);
-       }
-       else {
--        pegtl::parse<RuleParser::rule_grammar, RuleParser::rule_parser_actions, pegtl::tracer>(rule_spec, file, rule);
-+        tao::pegtl::parse<RuleParser::rule_grammar, RuleParser::rule_parser_actions, tao::pegtl::tracer>(input, rule);
-       }
- 
--#else
--
--      if (!trace) {
--        pegtl::parse_string<RuleParser::rule_grammar, RuleParser::rule_parser_actions>(rule_spec, file, rule);
--      }
--      else {
--        pegtl::parse_string<RuleParser::rule_grammar, RuleParser::rule_parser_actions, pegtl::tracer>(rule_spec, file, rule);
--      }
--
--#endif
-       return rule;
-     }
--    catch (const pegtl::parse_error& ex) {
-+    catch (const tao::pegtl::parse_error& ex) {
-       RuleParserError error(rule_spec);
-       error.setHint(ex.what());
--#if HAVE_PEGTL_LTE_1_3_1
--      error.setOffset(ex.positions[0].column);
--#else
-       error.setOffset(ex.positions[0].byte_in_line);
--#endif
- 
-       if (!file.empty() || line != 0) {
-         error.setFileInfo(file, line);
--- 
-2.13.6
-

selinux-bin-sbin.patch

@@ -0,0 +1,14 @@
+diff --git a/usbguard.fc b/usbguard.fc
+index d8cfa45..3904962 100644
+--- a/usbguard.fc
++++ b/usbguard.fc
+@@ -18,7 +18,9 @@
+ /etc/usbguard/rules\.conf                  -- gen_context(system_u:object_r:usbguard_rules_t,s0)
+ /etc/usbguard(/.*)?                          gen_context(system_u:object_r:usbguard_conf_t,s0)
+ /usr/lib/systemd/system/usbguard.*        -- gen_context(system_u:object_r:usbguard_unit_file_t,s0)
++/usr/bin/usbguard-daemon                 -- gen_context(system_u:object_r:usbguard_exec_t,s0)
+ /usr/sbin/usbguard-daemon                 -- gen_context(system_u:object_r:usbguard_exec_t,s0)
++/usr/bin/usbguard-dbus                   -- gen_context(system_u:object_r:usbguard_exec_t,s0)
+ /usr/sbin/usbguard-dbus                   -- gen_context(system_u:object_r:usbguard_exec_t,s0)
+ /var/log/usbguard(/.*)?                      gen_context(system_u:object_r:usbguard_log_t,s0)
+ /run/usbguard.*                       -- gen_context(system_u:object_r:usbguard_var_run_t,s0)

selinux-homed.patch

@@ -0,0 +1,14 @@
+diff --git a/usbguard.te b/usbguard.te
+index 52d0090..f8e55bc 100644
+--- a/usbguard.te
++++ b/usbguard.te
+@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',`
+ 		systemd_userdbd_stream_connect(usbguard_t)
+         ')
+ ')
++
++ifdef(`systemd_homed_stream_connect',`
++	optional_policy(`
++		systemd_homed_stream_connect(usbguard_t)
++	')
++')

sources

@@ -1 +1,2 @@
-SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61
+SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61
+SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496

tests/tests.yml

@@ -0,0 +1,13 @@
+---
+# Test to run in classic context
+- hosts: localhost
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    repositories:
+    - repo: "https://github.com/RedHat-SP-Security/tests"
+      dest: "tests"
+      fmf_filter: "component: usbguard"
+    required_packages:
+    - beakerlib-libraries

usbguard-daemon.conf

@@ -9,6 +9,19 @@
 #
 RuleFile=/etc/usbguard/rules.conf
 
+#
+# Rule set folder path.
+#
+# The USBGuard daemon will use this folder to load the policy
+# rule set from it and to write new rules received via the
+# IPC interface.
+#
+# RuleFolder=/path/to/rulesfolder/
+#
+
+RuleFolder=/etc/usbguard/rules.d/
+
+
 #
 # Implicit policy target.
 #
@@ -171,3 +184,8 @@ AuditBackend=FileAudit
 #
 AuditFilePath=/var/log/usbguard/usbguard-audit.log
 
+#
+# Hides personally identifiable information such as device serial numbers and
+# hashes of descriptors (which include the serial number) from audit entries.
+#
+HidePII=false

usbguard.spec

@@ -1,20 +1,18 @@
-%global _hardened_build 1
-
-%define with_gui_qt5 1
-%define with_dbus    1
+%global selinuxtype targeted
+%global moduletype contrib
+%define semodule_version 0.0.5
 
 Name:           usbguard
-Version:        0.7.2
-Release:        7%{?dist}
+Version:        1.1.4
+Release:        6%{?dist}
 Summary:        A tool for implementing USB device usage policy
-License:        GPLv2+
+License:        GPL-2.0-or-later
 ## Not installed
 # src/ThirdParty/Catch: Boost Software License - Version 1.0
 URL:            https://usbguard.github.io/
 Source0:        https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
-Source1:        usbguard-daemon.conf
-
-Patch0: 0001-Update-to-latest-PEGTL-API.patch
+Source1:        https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz
+Source2:        usbguard-daemon.conf
 
 Requires: systemd
 Requires(post): systemd
@@ -23,31 +21,26 @@ Requires(postun): systemd
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
 
+Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
+Obsoletes: %{name}-applet-qt < 0.7.6
+
+BuildRequires: make
+BuildRequires: gcc
+BuildRequires: gcc-c++
 BuildRequires: libqb-devel
-BuildRequires: libgcrypt-devel
+BuildRequires: openssl-devel
 BuildRequires: libstdc++-devel
 BuildRequires: protobuf-devel protobuf-compiler
 BuildRequires: PEGTL-static
-BuildRequires: catch1-devel
 BuildRequires: autoconf automake libtool
 BuildRequires: bash-completion
-BuildRequires: asciidoctor
+BuildRequires: asciidoc
 BuildRequires: audit-libs-devel
 # For `pkg-config systemd` only
 BuildRequires: systemd
 
-%if 0%{with_gui_qt5}
-BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist
-%endif
-
-%if 0%{with_dbus}
-BuildRequires: dbus-glib-devel
-BuildRequires: dbus-devel
-BuildRequires: glib2-devel
-BuildRequires: polkit-devel
-BuildRequires: libxslt
-BuildRequires: libxml2
-%endif
+Patch0: selinux-bin-sbin.patch
+Patch1: selinux-homed.patch
 
 %description
 The USBGuard software framework helps to protect your computer against rogue USB
@@ -72,36 +65,47 @@ Requires:       %{name} = %{version}-%{release}
 The %{name}-tools package contains optional tools from the USBGuard
 software framework.
 
-%if 0%{with_gui_qt5}
-###
-%package        applet-qt
-Summary:        USBGuard Qt 5.x Applet
-Requires:       %{name} = %{version}-%{release}
-Obsoletes:      usbguard-applet-qt <= 0.3
-
-%description    applet-qt
-The %{name}-applet-qt package contains an optional Qt 5.x desktop applet
-for interacting with the USBGuard daemon component.
-###
-%endif
-
-%if 0%{with_dbus}
-###
+# dbus
 %package        dbus
 Summary:        USBGuard D-Bus Service
 Requires:       %{name} = %{version}-%{release}
+BuildRequires:	dbus-devel
+BuildRequires:	glib2-devel
+BuildRequires:	polkit-devel
+BuildRequires:	libxslt
+BuildRequires:	libxml2
 Requires:       dbus
 Requires:       polkit
 
 %description    dbus
 The %{name}-dbus package contains an optional component that provides
 a D-Bus interface to the USBGuard daemon component.
-###
-%endif
 
+%package        selinux
+Summary:        USBGuard selinux
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+Requires:       selinux-policy-%{selinuxtype}
+Requires(post): selinux-policy-%{selinuxtype}
+BuildRequires:  selinux-policy-devel
+BuildArch: noarch
+%{?selinux_requires}
+
+%description    selinux
+The %{name}-selinux package contains selinux policy for the USBGuard
+daemon.
+
+# usbguard
 %prep
 %setup -q
-%patch0 -p1
+
+# selinux
+%setup -q -D -T -a 1
+
+pushd %{name}-selinux-%{semodule_version}
+%patch -P 0 -p1
+%patch -P 1 -p1
+popd
 
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}
@@ -114,30 +118,36 @@ autoreconf -i -v --no-recursive ./
     --without-bundled-catch \
     --without-bundled-pegtl \
     --enable-systemd \
-%if 0%{with_gui_qt5}
-    --with-gui-qt=qt5 \
-%endif
-%if 0%{with_dbus}
     --with-dbus \
     --with-polkit \
-%else
-    --without-dbus \
-    --without-polkit \
-%endif
-    --with-crypto-library=gcrypt
+    --with-crypto-library=openssl \
+    --disable-catch
 
 make %{?_smp_mflags}
 
-%check
-make check
+# selinux
+pushd %{name}-selinux-%{semodule_version}
+make
+popd
+
+# selinux
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
 
 %install
 make install INSTALL='install -p' DESTDIR=%{buildroot}
 
 # Overwrite configuration with distribution defaults
 mkdir -p %{buildroot}%{_sysconfdir}/usbguard
+mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d
 mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d
-install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
+install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
+
+# selinux
+install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
 
 # Cleanup
 find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
@@ -161,6 +171,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 %{_bindir}/usbguard
 %dir %{_localstatedir}/log/usbguard
 %dir %{_sysconfdir}/usbguard
+%dir %{_sysconfdir}/usbguard/rules.d/
 %dir %{_sysconfdir}/usbguard/IPCAccessControl.d
 %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf
 %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf
@@ -170,6 +181,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 %{_datadir}/man/man5/usbguard-rules.conf.5.gz
 %{_datadir}/man/man1/usbguard.1.gz
 %{_datadir}/bash-completion/completions/usbguard
+%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf
 
 %files devel
 %{_includedir}/*
@@ -179,23 +191,12 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 %files tools
 %{_bindir}/usbguard-rule-parser
 
-%if 0%{with_gui_qt5}
-###
-%files applet-qt
-%{_bindir}/usbguard-applet-qt
-%{_mandir}/man1/usbguard-applet-qt.1.gz
-%{_datadir}/applications/usbguard-applet-qt.desktop
-%{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg
-###
-%endif
-
-%if 0%{with_dbus}
-###
+# dbus
 %files dbus
 %{_sbindir}/usbguard-dbus
-%{_datadir}/dbus-1/system-services/org.usbguard.service
-%{_datadir}/dbus-1/system.d/org.usbguard.conf
-%{_datadir}/polkit-1/actions/org.usbguard.policy
+%{_datadir}/dbus-1/system-services/org.usbguard1.service
+%{_datadir}/dbus-1/system.d/org.usbguard1.conf
+%{_datadir}/polkit-1/actions/org.usbguard1.policy
 %{_unitdir}/usbguard-dbus.service
 %{_mandir}/man8/usbguard-dbus.8.gz
 
@@ -207,10 +208,208 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 
 %postun dbus
 %systemd_postun_with_restart usbguard-dbus.service
-###
-%endif
+
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{name}
+fi
+
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
+
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.4-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Wed Jun 24 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 1.1.4-5
+- Rebuilt for abseil-cpp 20260526.0
+
+* Mon Jun 22 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.1.4-4
+- Rebuilt for openssl 4.0
+
+* Wed Jun 10 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.1.4-3
+- Use openssl for crypto
+
+* Fri May 29 2026 Miroslav Suchy <msuchy@redhat.com> - 1.1.4-2
+- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x
+
+* Wed Apr 15 2026 Attila Lakatos <alakatos@redhat.com> - 1.1.4-1
+- Rebase to 1.1.4
+- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2,
+  uninstall-ignore-error, ipc-privileges, protobuf-3.0,
+  catch2-support, disable-catch
+- Add SELinux policy fix for systemd-homed stream connect
+  Resolves: rhbz#2380396
+  Resolves: rhbz#2376283
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Thu Apr 24 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.3-5
+- Fix usbguard-tmpfiles.conf
+- Remove catch1 dependency
+- Adapt for protobuf api changes
+- Fix regression in specifying IPC privileges using UID
+- selinux subpackage update: unified bin and sbin
+Resolves: rhbz#2297169
+
+* Thu Feb 06 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.3-4
+- Install usbguard-tmpfles.conf
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Fri Jun 07 2024 Attila Lakatos <alakatos@redhat.com> - 1.1.3-1
+- Rebase to 1.1.3
+Resolves: rhbz#2290724
+- selinux package policy update
+Resolves: rhbz#2271330
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jul 27 2023 Attila Lakatos <alakatos@redhat.com> - 1.1.2-1
+- Rebase to 1.1.2
+Resolves: rhbz#2064543
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Wed May 10 2023 Tomas Popela <tpopela@redhat.com> - 1.1.0-7
+- Drop BR on dbus-glib as the requirement was dropped in 0.7.7
+
+* Mon Feb 20 2023 Attila Lakatos <alakatos@redhat.com> - 1.1.0-6
+- Rebuild
+Resolves: rhbz#2171749
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Mar 29 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-3
+- usbguard requires selinux subpackage
+- this ensures that the selinux package and all its dependencies are
+  not pulled into containers and other systems that do not use SELinux
+
+* Tue Mar 15 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-2
+- selinux: allow policykit dbus comunnication
+- restore support for access control filenames without a group
+
+* Thu Mar 03 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-1
+- rebase to 1.1.0
+Resolves: rhbz#2058450
+- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus
+Resolves: rhbz#2058466
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-8
+- Rebuilt for protobuf 3.19.0
+
+* Mon Oct 25 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-7
+- Rebuilt for protobuf 3.18.1
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Wed Mar 31 2021 Jonathan Wakely <jwakely@redhat.com> - 1.0.0-5
+- Rebuilt for removed libstdc++ symbols (#1937698)
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.0.0-4
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 12:49:32 CET 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-2
+- Rebuilt for protobuf 3.14
+
+* Thu Jan 14 2021 Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-1
+- rebase usbguard to 1.0.0
+- added support for rules covering combination of classes
+- fix usbguard being killed
+Resolves: rhbz#1916039
+Resolves: rhbz#1861330
+Resolves: rhbz#1905257
+
+* Wed Jan 13 14:43:57 CET 2021 Adrian Reber <adrian@lisas.de> - 0.7.8-6
+- Rebuilt for protobuf 3.14
+
+* Thu Sep 24 2020 Adrian Reber <adrian@lisas.de> - 0.7.8-5
+- Rebuilt for protobuf 3.13
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.8-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jun 24 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-3
+- rebase selinux tarball to v0.0.4
+- enable forking style in unit file
+- set DevicePolicy to closed in unit file
+- usbguard prevented from writing conf via dontaudit rule
+Resolves: rhbz#1804713
+Resolves: rhbz#1789923
+
+* Sun Jun 14 2020 Adrian Reber <adrian@lisas.de> - 0.7.8-2
+- Rebuilt for protobuf 3.12
+
+* Tue May 19 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-1
+- rebase usbguard to 0.7.8
+- rebase usbguard-selinux to 0.0.3
+- added rules.d/ directory
+Resolves: rhbz#1808527
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.6-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Dec 19 2019 Orion Poplawski <orion@nwra.com> - 0.7.6-7
+- Rebuild for protobuf 3.11
+
+* Wed Dec 18 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-6
+- fix selinux problems
+
+* Mon Dec 02 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-5
+- obsolete applet-qt subpackage
+
+* Mon Nov 25 2019 Attila Lakatos <alakatos@redhat.com> - 0.7.6-4
+- added patch for libqb related permission issues
+  resolves: rhbz#1776357
+- added patch to ensure that usbguard-daemons is still running after locked screen
+  resolves: rhbz#1751861
+- added patch to fix permanent device policy changes
+
+* Wed Nov 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-3
+- fixed typo in specfile
+- usbguard.conf was generated incorrectly
+
+* Wed Nov 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-2
+- added selinux subpackage
+
+* Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-1
+- rebase to 0.7.6
+- removed usbguard-applet subpackage which is not in upstream anymore
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild