Rebase usbguard to 0.7.8

- rebase selinux tarball to v0.0.4
- enable forking style in unit file
- added rules.d/ directory
- set DevicePolicy to closed in unit file
- usbguard prevented from writing conf via dontaudit rule
Resolves: rhbz#1804713
Resolves: rhbz#1789923
Resolves: rhbz#1808527

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

.gitignore

@@ -15,3 +15,7 @@
 /usbguard-0.7.6.tar.gz
 /usbguard-selinux-0.0.1.tar.gz
 /usbguard-selinux-0.0.2.tar.gz
+/usbguard-0.7.7.tar.gz
+/usbguard-selinux-0.0.3.tar.gz
+/usbguard-0.7.8.tar.gz
+/usbguard-selinux-0.0.4.tar.gz

sources

@@ -1,2 +1,2 @@
-SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628
-SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec
+SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88
+SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0

usbguard-forking-style.patch

@@ -0,0 +1,34 @@
+diff -up ./usbguard.service.in.forking ./usbguard.service.in
+--- ./usbguard.service.in.forking	2020-06-17 20:07:04.720564149 +0200
++++ ./usbguard.service.in	2020-06-17 20:10:00.744063846 +0200
+@@ -8,11 +8,12 @@ AmbientCapabilities=
+ CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER
+ DeviceAllow=/dev/null rw
+ DevicePolicy=strict
+-ExecStart=%sbindir%/usbguard-daemon -k -c %sysconfdir%/usbguard/usbguard-daemon.conf
++ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf
+ IPAddressDeny=any
+ LockPersonality=yes
+ MemoryDenyWriteExecute=yes
+ NoNewPrivileges=yes
++PIDFile=/var/run/usbguard.pid
+ PrivateDevices=yes
+ PrivateTmp=yes
+ ProtectControlGroups=yes
+@@ -20,14 +21,14 @@ ProtectHome=yes
+ ProtectKernelModules=yes
+ ProtectSystem=yes
+ ReadOnlyPaths=-/
+-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/
++ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ -/var/run
+ Restart=on-failure
+ RestrictAddressFamilies=AF_UNIX AF_NETLINK
+ RestrictNamespaces=yes
+ RestrictRealtime=yes
+ SystemCallArchitectures=native
+ SystemCallFilter=@system-service
+-Type=simple
++Type=forking
+ UMask=0077
+ 
+ [Install]

usbguard-service-fips.patch

@@ -0,0 +1,13 @@
+diff -up ./usbguard.service.in.service-fips ./usbguard.service.in
+--- ./usbguard.service.in.service-fips	2020-06-22 10:44:44.815860376 +0200
++++ ./usbguard.service.in	2020-06-22 10:45:07.699135514 +0200
+@@ -6,8 +6,7 @@ Documentation=man:usbguard-daemon(8)
+ [Service]
+ AmbientCapabilities=
+ CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER
+-DeviceAllow=/dev/null rw
+-DevicePolicy=strict
++DevicePolicy=closed
+ ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf
+ IPAddressDeny=any
+ LockPersonality=yes

usbguard.spec

@@ -1,10 +1,10 @@
 %global selinuxtype targeted
 %global moduletype contrib
-%define semodule_version 0.0.2
+%define semodule_version 0.0.4
 
 Name:           usbguard
-Version:        0.7.6
-Release:        6%{?dist}
+Version:        0.7.8
+Release:        1%{?dist}
 Summary:        A tool for implementing USB device usage policy
 License:        GPLv2+
 ## Not installed
@@ -38,18 +38,9 @@ BuildRequires: audit-libs-devel
 # For `pkg-config systemd` only
 BuildRequires: systemd
 
-# dbus
-BuildRequires: dbus-glib-devel
-BuildRequires: dbus-devel
-BuildRequires: glib2-devel
-BuildRequires: polkit-devel
-BuildRequires: libxslt
-BuildRequires: libxml2
-
-Patch1: usbguard-0.7.6-libqb.patch
-Patch2: usbguard-0.7.6-sigwaitinfo.patch
-Patch3: usbguard-0.7.6-servicefile.patch
-Patch4: selinux.patch
+Patch1: usbguard-forking-style.patch
+Patch2: usbguard-service-fips.patch
+Patch3: usbguard-0.7.6-libqb.patch
 
 %description
 The USBGuard software framework helps to protect your computer against rogue USB
@@ -79,6 +70,12 @@ software framework.
 %package        dbus
 Summary:        USBGuard D-Bus Service
 Requires:       %{name} = %{version}-%{release}
+BuildRequires:	dbus-glib-devel
+BuildRequires:	dbus-devel
+BuildRequires:	glib2-devel
+BuildRequires:	polkit-devel
+BuildRequires:	libxslt
+BuildRequires:	libxml2
 Requires:       dbus
 Requires:       polkit
 
@@ -106,13 +103,13 @@ daemon.
 # selinux
 %setup -q -D -T -a 1
 
+%patch1 -p1 -b .service1
+%patch2 -p1 -b .service2
+%patch3 -p1 -b .libqb
+
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}
 
-%patch1 -p1 -b .libqb
-%patch2 -p1 -b .sigwaitinfo
-%patch3 -p1 -b .servicefile
-%patch4 -p1 -b .selinux
 
 %build
 mkdir -p ./m4
@@ -231,6 +228,17 @@ fi
 
 
 %changelog
+* Wed Jun 24 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-1
+- rebase usbguard to 0.7.8
+- rebase selinux tarball to v0.0.4
+- enable forking style in unit file
+- added rules.d/ directory
+- set DevicePolicy to closed in unit file
+- usbguard prevented from writing conf via dontaudit rule
+Resolves: rhbz#1804713
+Resolves: rhbz#1789923
+Resolves: rhbz#1808527
+
 * Wed Dec 18 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-6
 - fix selinux problems