Escape rpm macros mentioned in changelog section

Resolves: #1527956

.gitignore

@@ -7,3 +7,8 @@
 /usbguard-0.6.1.tar.gz
 /usbguard-0.6.2.tar.gz
 /dkopecek-usbguard-fcde518.tar.gz
+/dkopecek-usbguard-522c34c.tar.gz
+/dkopecek-usbguard-e528ff6.tar.gz
+/usbguard-0.7.0.tar.gz
+/usbguard-0.7.1.tar.gz
+/usbguard-0.7.2.tar.gz

sources

@@ -1 +1 @@
-SHA512 (dkopecek-usbguard-fcde518.tar.gz) = c795b0ea740ab5ab64807be1cbcf89c27e26caa163800f6b4b8ece9ed326130c2ab736bad377c10ef92fc5b435fb5db68235b3def3fde5a2134c3b3b5c87ffdd
+SHA512 (usbguard-0.7.2.tar.gz) = 2b2e0e2cb93f22c2e4111b4afe4e0d81e198e4540a6260f3f376bdd6dc4b5d062f3c20708f458ea5992b77742685c59e7e965ef42af49891547170ebb3f8cd61

usbguard-0.6.3-disable-cast-align-warning.patch

@@ -1,13 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index 6727391..51cef14 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -24,7 +24,7 @@ COMMON_WARNING_FLAGS+=" -Wall"
- COMMON_WARNING_FLAGS+=" -Wextra"
- COMMON_WARNING_FLAGS+=" -Wformat=2"
- COMMON_WARNING_FLAGS+=" -Wredundant-decls"
--COMMON_WARNING_FLAGS+=" -Wcast-align"
-+#COMMON_WARNING_FLAGS+=" -Wcast-align"
- COMMON_WARNING_FLAGS+=" -Wmissing-declarations"
- COMMON_WARNING_FLAGS+=" -Wmissing-include-dirs"
- COMMON_WARNING_FLAGS+=" -Wmissing-format-attribute"

usbguard-daemon.conf

@@ -34,7 +34,7 @@ ImplicitPolicyTarget=block
 # * apply-policy - evaluate the ruleset for every present
 #                  device
 #
-PresentDevicePolicy=keep
+PresentDevicePolicy=apply-policy
 
 #
 # Present controller policy.
@@ -51,6 +51,48 @@ PresentDevicePolicy=keep
 #
 PresentControllerPolicy=keep
 
+#
+# Inserted device policy.
+#
+# How to treat USB devices that are already connected
+# *after* the daemon starts. One of:
+#
+# * block        - deauthorize every present device
+# * reject       - remove every present device
+# * apply-policy - evaluate the ruleset for every present
+#                  device
+#
+InsertedDevicePolicy=apply-policy
+
+#
+# Restore controller device state.
+#
+# The USBGuard daemon modifies some attributes of controller
+# devices like the default authorization state of new child device
+# instances. Using this setting, you can controll whether the
+# daemon will try to restore the attribute values to the state
+# before modificaton on shutdown.
+#
+# SECURITY CONSIDERATIONS: If set to true, the USB authorization
+# policy could be bypassed by performing some sort of attack on the
+# daemon (via a local exploit or via a USB device) to make it shutdown
+# and restore to the operating-system default state (known to be permissive).
+#
+RestoreControllerDeviceState=false
+
+#
+# Device manager backend
+#
+# Which device manager backend implementation to use. One of:
+#
+# * uevent - Netlink based implementation which uses sysfs to scan for present
+#            devices and an uevent netlink socket for receiving USB device
+#            related events.
+# * dummy  - A dummy device manager which simulates several devices and device
+#            events. Useful for testing.
+#
+DeviceManagerBackend=uevent
+
 #!!! WARNING: It's good practice to set at least one of the !!!
 #!!!          two options bellow. If none of them are set,  !!!
 #!!!          the daemon will accept IPC connections from   !!!
@@ -77,6 +119,24 @@ IPCAllowedUsers=root
 #
 IPCAllowedGroups=wheel
 
+#
+# IPC access control definition files path.
+#
+# The files at this location will be interpreted by the daemon
+# as access control definition files. The (base)name of a file
+# should be in the form:
+#
+#   [user][:<group>]
+#
+# and should contain lines in the form:
+#
+#   <section>=[privilege] ...
+#
+# This way each file defines who is able to connect to the IPC
+# bus and what privileges he has.
+#
+IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/
+
 #
 # Generate device specific rules including the "via-port"
 # attribute.
@@ -93,3 +153,21 @@ IPCAllowedGroups=wheel
 # details.
 #
 DeviceRulesWithPort=false
+
+#
+# USBGuard Audit events log backend
+#
+# One of:
+#
+# * FileAudit - Log audit events into a file specified by
+#               AuditFilePath setting (see below)
+# * LinuxAudit - Log audit events using the Linux Audit
+#                subsystem (using audit_log_user_message)
+#
+AuditBackend=FileAudit
+
+#
+# USBGuard audit events log file path.
+#
+AuditFilePath=/var/log/usbguard/usbguard-audit.log
+

usbguard.spec

@@ -1,27 +1,20 @@
 %global _hardened_build 1
 
-%global gitdate 	20170301
-%global gittag  	fcde51810701b09adb68b37523c773eb190c19ee
-%global shorttag	%(c=%{gittag}; echo ${c:0:7})
-%global user 		dkopecek
+%define with_gui_qt5 1
+%define with_dbus    1
 
 Name:           usbguard
-Version:        0.6.3
-Release:        0.1.%{gitdate}git%{shorttag}%{?dist}
+Version:        0.7.2
+Release:        2%{?dist}
 Summary:        A tool for implementing USB device usage policy
 Group:          System Environment/Daemons
 License:        GPLv2+
 ## Not installed
 # src/ThirdParty/Catch: Boost Software License - Version 1.0
-URL:            https://dkopecek.github.io/usbguard
-# Regular source URL
-#Source0:        https://github.com/dkopecek/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
-# Snapshot source URL
-Source0:	https://github.com/%{user}/%{name}/tarball/%{gittag}/%{user}-%{name}-%{shorttag}.tar.gz
+URL:            https://usbguard.github.io/
+Source0:        https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
 Source1:        usbguard-daemon.conf
 
-Patch0: usbguard-0.6.3-disable-cast-align-warning.patch
-
 Requires: systemd
 Requires(post): systemd
 Requires(preun): systemd
@@ -31,20 +24,29 @@ Requires(postun): /sbin/ldconfig
 
 BuildRequires: libqb-devel
 BuildRequires: libgcrypt-devel
-BuildRequires: systemd systemd-devel
 BuildRequires: libstdc++-devel
 BuildRequires: protobuf-devel protobuf-compiler
 BuildRequires: PEGTL-static
+BuildRequires: catch-devel
+BuildRequires: autoconf automake libtool
+BuildRequires: bash-completion
+BuildRequires: asciidoctor
+BuildRequires: audit-libs-devel
+# For `pkg-config systemd` only
+BuildRequires: systemd
+
+%if 0%{with_gui_qt5}
 BuildRequires: qt5-qtbase-devel qt5-qtsvg-devel qt5-linguist
+%endif
+
+%if 0%{with_dbus}
 BuildRequires: dbus-glib-devel
 BuildRequires: dbus-devel
 BuildRequires: glib2-devel
 BuildRequires: polkit-devel
 BuildRequires: libxslt
 BuildRequires: libxml2
-BuildRequires: catch-devel
-BuildRequires: pandoc
-BuildRequires: autoconf automake libtool
+%endif
 
 %description
 The USBGuard software framework helps to protect your computer against rogue USB
@@ -71,6 +73,8 @@ Requires:       %{name} = %{version}-%{release}
 The %{name}-tools package contains optional tools from the USBGuard
 software framework.
 
+%if 0%{with_gui_qt5}
+###
 %package        applet-qt
 Summary:        USBGuard Qt 5.x Applet
 Group:          Applications/System
@@ -80,7 +84,11 @@ Obsoletes:      usbguard-applet-qt <= 0.3
 %description    applet-qt
 The %{name}-applet-qt package contains an optional Qt 5.x desktop applet
 for interacting with the USBGuard daemon component.
+###
+%endif
 
+%if 0%{with_dbus}
+###
 %package        dbus
 Summary:        USBGuard D-Bus Service
 Group:          Applications/System
@@ -91,14 +99,14 @@ Requires:       polkit
 %description    dbus
 The %{name}-dbus package contains an optional component that provides
 a D-Bus interface to the USBGuard daemon component.
+###
+%endif
 
 %prep
-%setup -q -n %{user}-%{name}-%{shorttag}
+%setup -q
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}
 
-%patch0 -p1
-
 %build
 mkdir -p ./m4
 autoreconf -i -v --no-recursive ./
@@ -107,9 +115,16 @@ autoreconf -i -v --no-recursive ./
     --without-bundled-catch \
     --without-bundled-pegtl \
     --enable-systemd \
+%if 0%{with_gui_qt5}
     --with-gui-qt=qt5 \
+%endif
+%if 0%{with_dbus}
     --with-dbus \
     --with-polkit \
+%else
+    --without-dbus \
+    --without-polkit \
+%endif
     --with-crypto-library=gcrypt
 
 make %{?_smp_mflags}
@@ -122,6 +137,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot}
 
 # Overwrite configuration with distribution defaults
 mkdir -p %{buildroot}%{_sysconfdir}/usbguard
+mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d
 install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
 
 # Cleanup
@@ -140,19 +156,22 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 
 %files
 %defattr(-,root,root,-)
-%doc README.md CHANGELOG.md
+%doc README.adoc CHANGELOG.md
 %license LICENSE
 %{_libdir}/*.so.*
 %{_sbindir}/usbguard-daemon
 %{_bindir}/usbguard
+%dir %{_localstatedir}/log/usbguard
 %dir %{_sysconfdir}/usbguard
-%config(noreplace) %{_sysconfdir}/usbguard/usbguard-daemon.conf
-%config(noreplace) %{_sysconfdir}/usbguard/rules.conf
+%dir %{_sysconfdir}/usbguard/IPCAccessControl.d
+%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf
+%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf
 %{_unitdir}/usbguard.service
 %{_datadir}/man/man8/usbguard-daemon.8.gz
 %{_datadir}/man/man5/usbguard-daemon.conf.5.gz
 %{_datadir}/man/man5/usbguard-rules.conf.5.gz
 %{_datadir}/man/man1/usbguard.1.gz
+%{_datadir}/bash-completion/completions/usbguard
 
 %files devel
 %defattr(-,root,root,-)
@@ -164,13 +183,19 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 %defattr(-,root,root,-)
 %{_bindir}/usbguard-rule-parser
 
+%if 0%{with_gui_qt5}
+###
 %files applet-qt
 %defattr(-,root,root,-)
 %{_bindir}/usbguard-applet-qt
 %{_mandir}/man1/usbguard-applet-qt.1.gz
 %{_datadir}/applications/usbguard-applet-qt.desktop
 %{_datadir}/icons/hicolor/scalable/apps/usbguard-icon.svg
+###
+%endif
 
+%if 0%{with_dbus}
+###
 %files dbus
 %defattr(-,root,root,-)
 %{_sbindir}/usbguard-dbus
@@ -188,9 +213,44 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 
 %postun dbus
 %systemd_postun_with_restart usbguard-dbus.service
-
+###
+%endif
 
 %changelog
+* Tue Jan 23 2018 Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-2
+- Escape rpm macros mentioned in changelog section
+
+* Tue Jan 23 2018 Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-1
+- Update to 0.7.2
+- Don't use --enable-werror downstream
+- Removed patches related to compiler warnings
+
+* Wed Dec 06 2017 Daniel Kopeček <dkopecek@redhat.com> - 0.7.1-1
+- Update to 0.7.1
+
+* Mon Oct 16 2017 Daniel Kopeček <dkopecek@redhat.com> 0.7.0-3
+- Fix enumeration timeout on kernel >= 4.13
+  Resolves: rhbz#1499052
+
+* Mon May 15 2017 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
+
+* Thu Apr 13 2017 Daniel Kopeček <dkopecek@redhat.com> 0.7.0-1
+- Update to 0.7.0
+  - changed PresentDevicePolicy setting from keep to apply-policy
+  - added AuditFilePath configuration option pointing to
+    /var/log/usbguard/usbguard-audit.log file
+  - install bash-completion script
+  - use 0600 file permissions for usbguard-daemon.conf and rules.conf
+
+* Sun Mar 19 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170319
+- Update to latest git snapshot
+
+* Fri Mar 17 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170317
+- Update to latest git snapshot
+- Use --enable-werror configure option as the upstream default
+  changed to not use -Werror.
+
 * Thu Mar 02 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170301
 - Update to latest git snapshot
 - Disabled upstream alignment warning compiler flag
@@ -253,7 +313,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
 
 * Tue Apr 14 2015 Daniel Kopecek <dkopecek@redhat.com> 0.3p3-1
 - Update to version 0.3p3
-- added %check section
+- added %%check section
 - removed explicit -devel requires on systemd, libqb and
   libsodium devel files
 - added -devel requires on libstdc++-devel