Rebase usbguard to 1.0.0

Rebase usbguard to 0.7.8
- rebase selinux tarball to v0.0.4 - enable forking style in unit file - added rules.d/ directory - set DevicePolicy to closed in unit file - usbguard prevented from writing conf via dontaudit rule Resolves: rhbz#1804713 Resolves: rhbz#1789923 Resolves: rhbz#1808527 Signed-off-by: Radovan Sroka <rsroka@redhat.com>
2021-01-14 15:38:14 +01:00 · 2020-06-24 16:26:19 +02:00
6 changed files with 38 additions and 96 deletions
--- a/.gitignore
+++ b/.gitignore
@ -15,3 +15,8 @@
 /usbguard-0.7.6.tar.gz
 /usbguard-selinux-0.0.1.tar.gz
 /usbguard-selinux-0.0.2.tar.gz
+/usbguard-0.7.7.tar.gz
+/usbguard-selinux-0.0.3.tar.gz
+/usbguard-0.7.8.tar.gz
+/usbguard-selinux-0.0.4.tar.gz
+/usbguard-1.0.0.tar.gz
--- a/selinux.patch
+++ b/selinux.patch
@ -1,32 +0,0 @@
-diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te
--- ./usbguard-selinux-0.0.2/usbguard.te.selinux	2019-11-13 07:08:17.000000000 -0500
-+++ ./usbguard-selinux-0.0.2/usbguard.te	2019-12-18 11:21:36.725889798 -0500
-@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules,
- type usbguard_t;
- type usbguard_exec_t;
- init_daemon_domain(usbguard_t, usbguard_exec_t)
-+init_nnp_daemon_domain(usbguard_t)
- 
- type usbguard_unit_file_t;
- systemd_unit_file(usbguard_unit_file_t)
- 
- type usbguard_conf_t;
- files_config_file(usbguard_conf_t)
-+systemd_mount_dir(usbguard_conf_t)
- 
- type usbguard_log_t;
- logging_log_file(usbguard_log_t)
-+systemd_mount_dir(usbguard_log_t)
- 
- type usbguard_rules_t;
- files_config_file(usbguard_rules_t)
-@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar
- files_pid_filetrans(usbguard_t, usbguard_var_run_t, file)
- 
- manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
-fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file)
-+fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir })
-+manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
- allow usbguard_t usbguard_tmpfs_t:file map;
- 
- manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t)
--- a/4
+++ b/4
@ -1,2 +1,2 @@
-SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628
-SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec
+SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd
+SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0
--- a/usbguard-0.7.6-servicefile.patch
+++ b/usbguard-0.7.6-servicefile.patch
@ -1,12 +0,0 @@
-diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in
--- usbguard-0.7.6/usbguard.service.in.orig	2019-11-25 17:02:34.518355971 +0100
-+++ usbguard-0.7.6/usbguard.service.in	2019-11-25 17:04:38.753066258 +0100
-@@ -21,7 +21,7 @@ ProtectKernelModules=yes
- ProtectSystem=yes
- PIDFile=/run/usbguard.pid
- ReadOnlyPaths=-/
-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp
-+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/
- Restart=on-failure
- RestrictAddressFamilies=AF_UNIX AF_NETLINK
- RestrictNamespaces=yes
--- a/usbguard-0.7.6-sigwaitinfo.patch
+++ b/usbguard-0.7.6-sigwaitinfo.patch
@ -1,32 +0,0 @@
-diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp
--- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig	2019-11-25 15:45:50.869913293 +0100
-+++ usbguard-0.7.6/src/Daemon/Daemon.cpp	2019-11-25 15:47:37.722735108 +0100
-@@ -507,8 +507,14 @@ namespace usbguard
-       const int signal_num = sigwaitinfo(&signal_set, &signal_info);
- 
-       if (signal_num <= 0) {
-        USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down.";
-        break;
-+        if (errno == EINTR) {
-+          USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring.";
-+          continue;
-+        }
-+        else {
-+          USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down.";
-+          throw Exception("Daemon::run", "sigwaitinfo", "failed");
-+        }
-       }
- 
-       switch (signal_num) {
-@@ -523,8 +529,11 @@ namespace usbguard
-         exit_loop = false;
-         break;
- 
-+
-+      /* should not be reachable */
-       default:
-         USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!";
-+        continue;
-       }
-     }
-     while (!exit_loop);
--- a/usbguard.spec
+++ b/usbguard.spec
@ -1,10 +1,10 @@
 %global selinuxtype targeted
 %global moduletype contrib
-%define semodule_version 0.0.2
+%define semodule_version 0.0.4

 Name:           usbguard
-Version:        0.7.6
-Release:        8%{?dist}
+Version:        1.0.0
+Release:        1%{?dist}
 Summary:        A tool for implementing USB device usage policy
 License:        GPLv2+
 ## Not installed
@ -38,18 +38,7 @@ BuildRequires: audit-libs-devel
 # For `pkg-config systemd` only
 BuildRequires: systemd

-# dbus
-BuildRequires: dbus-glib-devel
-BuildRequires: dbus-devel
-BuildRequires: glib2-devel
-BuildRequires: polkit-devel
-BuildRequires: libxslt
-BuildRequires: libxml2
-
 Patch1: usbguard-0.7.6-libqb.patch
-Patch2: usbguard-0.7.6-sigwaitinfo.patch
-Patch3: usbguard-0.7.6-servicefile.patch
-Patch4: selinux.patch

 %description
 The USBGuard software framework helps to protect your computer against rogue USB
@ -62,6 +51,7 @@ Requires:       %{name} = %{version}-%{release}
 Requires:       pkgconfig
 Requires:       libstdc++-devel

+
 %description    devel
 The %{name}-devel package contains libraries and header files for
 developing applications that use %{name}.
@ -79,6 +69,12 @@ software framework.
 %package        dbus
 Summary:        USBGuard D-Bus Service
 Requires:       %{name} = %{version}-%{release}
+BuildRequires:	dbus-glib-devel
+BuildRequires:	dbus-devel
+BuildRequires:	glib2-devel
+BuildRequires:	polkit-devel
+BuildRequires:	libxslt
+BuildRequires:	libxml2
 Requires:       dbus
 Requires:       polkit

@ -106,13 +102,11 @@ daemon.
 # selinux
 %setup -q -D -T -a 1

+%patch1 -p1 -b .libqb
+
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}

-%patch1 -p1 -b .libqb
-%patch2 -p1 -b .sigwaitinfo
-%patch3 -p1 -b .servicefile
-%patch4 -p1 -b .selinux

 %build
 mkdir -p ./m4
@ -231,6 +225,25 @@ fi


 %changelog
+* Thu Jan 14 2021 Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-1
+- rebase usbguard to 1.0.0
+- added support for rules covering combination of classes
+- fix usbguard being killed
+Resolves: rhbz#1916039
+Resolves: rhbz#1861330
+Resolves: rhbz#1905257
+
+* Wed Jun 24 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-3
+- rebase usbguard to 0.7.8
+- rebase selinux tarball to v0.0.4
+- enable forking style in unit file
+- added rules.d/ directory
+- set DevicePolicy to closed in unit file
+- usbguard prevented from writing conf via dontaudit rule
+Resolves: rhbz#1804713
+Resolves: rhbz#1789923
+Resolves: rhbz#1808527
+
 * Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.6-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild