Usbguard requires selinux subpackage

- this ensures that the selinux package and all its dependencies are
  not pulled into containers and other systems that do not use SELinux

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

.gitignore

@@ -20,3 +20,4 @@
 /usbguard-0.7.8.tar.gz
 /usbguard-selinux-0.0.4.tar.gz
 /usbguard-1.0.0.tar.gz
+/usbguard-1.1.0.tar.gz

policykit-dbus-chat-selinux.patch

@@ -0,0 +1,22 @@
+diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te
+--- ./usbguard-selinux-0.0.4/usbguard.te.policykit	2022-03-15 10:32:21.002852930 +0100
++++ ./usbguard-selinux-0.0.4/usbguard.te	2022-03-15 10:36:47.844040559 +0100
+@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua
+ 
+ logging_send_syslog_msg(usbguard_t)
+ 
+-dbus_system_domain(usbguard_t, usbguard_exec_t)
+ usbguard_ipc_access(usbguard_t)
+ 
++optional_policy(`
++	dbus_system_domain(usbguard_t, usbguard_exec_t)
++
++	optional_policy(`
++		policykit_dbus_chat(usbguard_t)
++	')
++')
++
++
+ tunable_policy(`usbguard_daemon_write_rules',`
+ 	rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t)
+ ')

sources

@@ -1,2 +1,2 @@
-SHA512 (usbguard-1.0.0.tar.gz) = 068a9be8bd5ea05efcdad79e2c4beb5e8b646b4703fbe1f8bb262e37ae9a6284a6eeb811a6bd441250a38bce1e45b7f44ad15726aa5963da2e1b56e85f5e16fd
+SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91
 SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0

usbguard-restore-support-access-control-names.patch

@@ -0,0 +1,44 @@
+From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sat, 5 Mar 2022 17:22:05 +0100
+Subject: [PATCH] Restore support for access control filenames without a group
+
+Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81
+of release 1.1.0, detailed analysis online at
+https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284
+---
+ src/Daemon/Daemon.cpp | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp
+index 45ddb76d..4ec2d934 100644
+--- a/src/Daemon/Daemon.cpp
++++ b/src/Daemon/Daemon.cpp
+@@ -446,12 +446,25 @@ namespace usbguard
+   void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user,
+     std::string* const ptr_group)
+   {
++    // There are five supported forms:
++    // - "<user>:<group>"
++    // - "<user>:"
++    // - "<user>"
++    // - ":<group>"
++    // - ":"
+     const auto ug_separator = basename.find_first_of(":");
+     const bool has_group = ug_separator != std::string::npos;
+     const std::string user = basename.substr(0, ug_separator);
+     const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string();
+-    checkIPCAccessControlName(user);
+-    checkIPCAccessControlName(group);
++
++    if (! user.empty()) {
++      checkIPCAccessControlName(user);
++    }
++
++    if (! group.empty()) {
++      checkIPCAccessControlName(group);
++    }
++
+     *ptr_user = user;
+     *ptr_group = group;
+   }

usbguard-revert-catch.patch

@@ -0,0 +1,17 @@
+diff -up ./configure.ac.fix ./configure.ac
+--- ./configure.ac.fix	2022-03-03 15:05:03.357194713 +0100
++++ ./configure.ac	2022-03-03 15:06:02.849787794 +0100
+@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t
+ 	catch_summary="bundled; $catch_CFLAGS $catch_LIBS"
+ else
+ 	SAVE_CPPFLAGS=$CPPFLAGS
+-	CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2"
++	CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch"
+ 	AC_LANG_PUSH([C++])
+ 	AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)])
+ 	AC_LANG_POP
+-	catch_CFLAGS="-I/usr/include/catch2"
++	catch_CFLAGS="-I/usr/include/catch"
+ 	catch_LIBS=""
+ 	CPPFLAGS=$SAVE_CPPFLAGS
+ 	catch_summary="system-wide; $catch_CFLAGS $catch_LIBS"

usbguard.spec

@@ -3,8 +3,8 @@
 %define semodule_version 0.0.4
 
 Name:           usbguard
-Version:        1.0.0
-Release:        6%{?dist}
+Version:        1.1.0
+Release:        3%{?dist}
 Summary:        A tool for implementing USB device usage policy
 License:        GPLv2+
 ## Not installed
@@ -20,7 +20,8 @@ Requires(preun): systemd
 Requires(postun): systemd
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
-Recommends: %{name}-selinux
+
+Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
 Obsoletes: %{name}-applet-qt < 0.7.6
 
 BuildRequires: make
@@ -39,6 +40,10 @@ BuildRequires: audit-libs-devel
 # For `pkg-config systemd` only
 BuildRequires: systemd
 
+Patch1: usbguard-revert-catch.patch
+Patch2: policykit-dbus-chat-selinux.patch
+Patch3: usbguard-restore-support-access-control-names.patch
+
 %description
 The USBGuard software framework helps to protect your computer against rogue USB
 devices by implementing basic whitelisting/blacklisting capabilities based on
@@ -62,7 +67,6 @@ Requires:       %{name} = %{version}-%{release}
 The %{name}-tools package contains optional tools from the USBGuard
 software framework.
 
-
 # dbus
 %package        dbus
 Summary:        USBGuard D-Bus Service
@@ -100,6 +104,10 @@ daemon.
 # selinux
 %setup -q -D -T -a 1
 
+%patch1 -p1 -b .catch
+%patch2 -p1 -b .policykit
+%patch3 -p1 -b .access-contol-names
+
 # Remove bundled library sources before build
 rm -rf src/ThirdParty/{Catch,PEGTL}
 
@@ -220,8 +228,22 @@ fi
 %selinux_relabel_post -s %{selinuxtype}
 
 
-
 %changelog
+* Tue Mar 29 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-3
+- usbguard requires selinux subpackage
+- this ensures that the selinux package and all its dependencies are
+  not pulled into containers and other systems that do not use SELinux
+
+* Tue Mar 15 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-2
+- selinux: allow policykit dbus comunnication
+- restore support for access control filenames without a group
+
+* Thu Mar 03 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-1
+- rebase to 1.1.0
+Resolves: rhbz#2058450
+- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus
+Resolves: rhbz#2058466
+
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild