Compare commits
4 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
5831ff8c36 |
||
|
|
f295a50b38 |
||
|
|
b021d9099f | ||
|
1c76e005be |
8 changed files with 107 additions and 146 deletions
4
.gitignore
vendored
4
.gitignore
vendored
|
|
@ -21,7 +21,3 @@
|
|||
/usbguard-selinux-0.0.4.tar.gz
|
||||
/usbguard-1.0.0.tar.gz
|
||||
/usbguard-1.1.0.tar.gz
|
||||
/usbguard-1.1.2.tar.gz
|
||||
/usbguard-1.1.3.tar.gz
|
||||
/usbguard-selinux-0.0.5.tar.gz
|
||||
/usbguard-1.1.4.tar.gz
|
||||
|
|
|
|||
22
policykit-dbus-chat-selinux.patch
Normal file
22
policykit-dbus-chat-selinux.patch
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
diff -up ./usbguard-selinux-0.0.4/usbguard.te.policykit ./usbguard-selinux-0.0.4/usbguard.te
|
||||
--- ./usbguard-selinux-0.0.4/usbguard.te.policykit 2022-03-15 10:32:21.002852930 +0100
|
||||
+++ ./usbguard-selinux-0.0.4/usbguard.te 2022-03-15 10:36:47.844040559 +0100
|
||||
@@ -99,9 +99,17 @@ logging_log_filetrans(usbguard_t, usbgua
|
||||
|
||||
logging_send_syslog_msg(usbguard_t)
|
||||
|
||||
-dbus_system_domain(usbguard_t, usbguard_exec_t)
|
||||
usbguard_ipc_access(usbguard_t)
|
||||
|
||||
+optional_policy(`
|
||||
+ dbus_system_domain(usbguard_t, usbguard_exec_t)
|
||||
+
|
||||
+ optional_policy(`
|
||||
+ policykit_dbus_chat(usbguard_t)
|
||||
+ ')
|
||||
+')
|
||||
+
|
||||
+
|
||||
tunable_policy(`usbguard_daemon_write_rules',`
|
||||
rw_files_pattern(usbguard_t, usbguard_rules_t, usbguard_rules_t)
|
||||
')
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
diff --git a/usbguard.fc b/usbguard.fc
|
||||
index d8cfa45..3904962 100644
|
||||
--- a/usbguard.fc
|
||||
+++ b/usbguard.fc
|
||||
@@ -18,7 +18,9 @@
|
||||
/etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0)
|
||||
/etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0)
|
||||
/usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0)
|
||||
+/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0)
|
||||
/usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0)
|
||||
+/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0)
|
||||
/usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0)
|
||||
/var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0)
|
||||
/run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0)
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
diff --git a/usbguard.te b/usbguard.te
|
||||
index 52d0090..f8e55bc 100644
|
||||
--- a/usbguard.te
|
||||
+++ b/usbguard.te
|
||||
@@ -133,3 +133,9 @@ ifdef(`systemd_userdbd_stream_connect',`
|
||||
systemd_userdbd_stream_connect(usbguard_t)
|
||||
')
|
||||
')
|
||||
+
|
||||
+ifdef(`systemd_homed_stream_connect',`
|
||||
+ optional_policy(`
|
||||
+ systemd_homed_stream_connect(usbguard_t)
|
||||
+ ')
|
||||
+')
|
||||
4
sources
4
sources
|
|
@ -1,2 +1,2 @@
|
|||
SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61
|
||||
SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496
|
||||
SHA512 (usbguard-1.1.0.tar.gz) = f882e8ba38743c044984520d5514035e0e76e185328c2f16226ce8fb14b5dbde0c021327b3dabfdea36e18428be5fb23b559f6837ef7f81dabb5e9b4ed4e1e91
|
||||
SHA512 (usbguard-selinux-0.0.4.tar.gz) = b73b14396e40f847704511097bfed17c94b9b28cc70f3391a6effab763a315fe723aba37bb4c622d18ab691306c485fcd7632ccc8a837413f32c73cd9879c8b0
|
||||
|
|
|
|||
44
usbguard-restore-support-access-control-names.patch
Normal file
44
usbguard-restore-support-access-control-names.patch
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
From 22eb68cde27046c684e3ee2061b085b18fad863b Mon Sep 17 00:00:00 2001
|
||||
From: Sebastian Pipping <sebastian@pipping.org>
|
||||
Date: Sat, 5 Mar 2022 17:22:05 +0100
|
||||
Subject: [PATCH] Restore support for access control filenames without a group
|
||||
|
||||
Regression from commit b15ef713a9ac47e84525bbf829c7f444b84c3c81
|
||||
of release 1.1.0, detailed analysis online at
|
||||
https://github.com/USBGuard/usbguard/issues/540#issuecomment-1059784284
|
||||
---
|
||||
src/Daemon/Daemon.cpp | 17 +++++++++++++++--
|
||||
1 file changed, 15 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/Daemon/Daemon.cpp b/src/Daemon/Daemon.cpp
|
||||
index 45ddb76d..4ec2d934 100644
|
||||
--- a/src/Daemon/Daemon.cpp
|
||||
+++ b/src/Daemon/Daemon.cpp
|
||||
@@ -446,12 +446,25 @@ namespace usbguard
|
||||
void Daemon::parseIPCAccessControlFilename(const std::string& basename, std::string* const ptr_user,
|
||||
std::string* const ptr_group)
|
||||
{
|
||||
+ // There are five supported forms:
|
||||
+ // - "<user>:<group>"
|
||||
+ // - "<user>:"
|
||||
+ // - "<user>"
|
||||
+ // - ":<group>"
|
||||
+ // - ":"
|
||||
const auto ug_separator = basename.find_first_of(":");
|
||||
const bool has_group = ug_separator != std::string::npos;
|
||||
const std::string user = basename.substr(0, ug_separator);
|
||||
const std::string group = has_group ? basename.substr(ug_separator + 1) : std::string();
|
||||
- checkIPCAccessControlName(user);
|
||||
- checkIPCAccessControlName(group);
|
||||
+
|
||||
+ if (! user.empty()) {
|
||||
+ checkIPCAccessControlName(user);
|
||||
+ }
|
||||
+
|
||||
+ if (! group.empty()) {
|
||||
+ checkIPCAccessControlName(group);
|
||||
+ }
|
||||
+
|
||||
*ptr_user = user;
|
||||
*ptr_group = group;
|
||||
}
|
||||
17
usbguard-revert-catch.patch
Normal file
17
usbguard-revert-catch.patch
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
diff -up ./configure.ac.fix ./configure.ac
|
||||
--- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100
|
||||
+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100
|
||||
@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t
|
||||
catch_summary="bundled; $catch_CFLAGS $catch_LIBS"
|
||||
else
|
||||
SAVE_CPPFLAGS=$CPPFLAGS
|
||||
- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2"
|
||||
+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch"
|
||||
AC_LANG_PUSH([C++])
|
||||
AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)])
|
||||
AC_LANG_POP
|
||||
- catch_CFLAGS="-I/usr/include/catch2"
|
||||
+ catch_CFLAGS="-I/usr/include/catch"
|
||||
catch_LIBS=""
|
||||
CPPFLAGS=$SAVE_CPPFLAGS
|
||||
catch_summary="system-wide; $catch_CFLAGS $catch_LIBS"
|
||||
134
usbguard.spec
134
usbguard.spec
|
|
@ -1,17 +1,17 @@
|
|||
%global selinuxtype targeted
|
||||
%global moduletype contrib
|
||||
%define semodule_version 0.0.5
|
||||
%define semodule_version 0.0.4
|
||||
|
||||
Name: usbguard
|
||||
Version: 1.1.4
|
||||
Release: 6%{?dist}
|
||||
Version: 1.1.0
|
||||
Release: 3%{?dist}
|
||||
Summary: A tool for implementing USB device usage policy
|
||||
License: GPL-2.0-or-later
|
||||
License: GPLv2+
|
||||
## Not installed
|
||||
# src/ThirdParty/Catch: Boost Software License - Version 1.0
|
||||
URL: https://usbguard.github.io/
|
||||
Source0: https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
|
||||
Source1: https://github.com/USBGuard/usbguard-selinux/archive/refs/tags/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz
|
||||
Source1: https://github.com/USBGuard/usbguard/releases/download/%{name}-selinux-%{semodule_version}/%{name}-selinux-%{semodule_version}.tar.gz
|
||||
Source2: usbguard-daemon.conf
|
||||
|
||||
Requires: systemd
|
||||
|
|
@ -28,10 +28,11 @@ BuildRequires: make
|
|||
BuildRequires: gcc
|
||||
BuildRequires: gcc-c++
|
||||
BuildRequires: libqb-devel
|
||||
BuildRequires: openssl-devel
|
||||
BuildRequires: libgcrypt-devel
|
||||
BuildRequires: libstdc++-devel
|
||||
BuildRequires: protobuf-devel protobuf-compiler
|
||||
BuildRequires: PEGTL-static
|
||||
BuildRequires: catch1-devel
|
||||
BuildRequires: autoconf automake libtool
|
||||
BuildRequires: bash-completion
|
||||
BuildRequires: asciidoc
|
||||
|
|
@ -39,8 +40,9 @@ BuildRequires: audit-libs-devel
|
|||
# For `pkg-config systemd` only
|
||||
BuildRequires: systemd
|
||||
|
||||
Patch0: selinux-bin-sbin.patch
|
||||
Patch1: selinux-homed.patch
|
||||
Patch1: usbguard-revert-catch.patch
|
||||
Patch2: policykit-dbus-chat-selinux.patch
|
||||
Patch3: usbguard-restore-support-access-control-names.patch
|
||||
|
||||
%description
|
||||
The USBGuard software framework helps to protect your computer against rogue USB
|
||||
|
|
@ -69,6 +71,7 @@ software framework.
|
|||
%package dbus
|
||||
Summary: USBGuard D-Bus Service
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
BuildRequires: dbus-glib-devel
|
||||
BuildRequires: dbus-devel
|
||||
BuildRequires: glib2-devel
|
||||
BuildRequires: polkit-devel
|
||||
|
|
@ -85,8 +88,7 @@ a D-Bus interface to the USBGuard daemon component.
|
|||
Summary: USBGuard selinux
|
||||
Group: Applications/System
|
||||
Requires: %{name} = %{version}-%{release}
|
||||
Requires: selinux-policy-%{selinuxtype}
|
||||
Requires(post): selinux-policy-%{selinuxtype}
|
||||
BuildRequires: selinux-policy
|
||||
BuildRequires: selinux-policy-devel
|
||||
BuildArch: noarch
|
||||
%{?selinux_requires}
|
||||
|
|
@ -102,10 +104,9 @@ daemon.
|
|||
# selinux
|
||||
%setup -q -D -T -a 1
|
||||
|
||||
pushd %{name}-selinux-%{semodule_version}
|
||||
%patch -P 0 -p1
|
||||
%patch -P 1 -p1
|
||||
popd
|
||||
%patch1 -p1 -b .catch
|
||||
%patch2 -p1 -b .policykit
|
||||
%patch3 -p1 -b .access-contol-names
|
||||
|
||||
# Remove bundled library sources before build
|
||||
rm -rf src/ThirdParty/{Catch,PEGTL}
|
||||
|
|
@ -120,8 +121,7 @@ autoreconf -i -v --no-recursive ./
|
|||
--enable-systemd \
|
||||
--with-dbus \
|
||||
--with-polkit \
|
||||
--with-crypto-library=openssl \
|
||||
--disable-catch
|
||||
--with-crypto-library=gcrypt
|
||||
|
||||
make %{?_smp_mflags}
|
||||
|
||||
|
|
@ -130,6 +130,9 @@ pushd %{name}-selinux-%{semodule_version}
|
|||
make
|
||||
popd
|
||||
|
||||
%check
|
||||
make check
|
||||
|
||||
# selinux
|
||||
%pre selinux
|
||||
%selinux_relabel_pre -s %{selinuxtype}
|
||||
|
|
@ -181,7 +184,6 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
|
|||
%{_datadir}/man/man5/usbguard-rules.conf.5.gz
|
||||
%{_datadir}/man/man1/usbguard.1.gz
|
||||
%{_datadir}/bash-completion/completions/usbguard
|
||||
%attr(640,root,root) %{_tmpfilesdir}/usbguard.conf
|
||||
|
||||
%files devel
|
||||
%{_includedir}/*
|
||||
|
|
@ -211,7 +213,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
|
|||
|
||||
%files selinux
|
||||
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
||||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
|
||||
%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
|
||||
%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
|
||||
|
||||
%post selinux
|
||||
|
|
@ -227,82 +229,6 @@ fi
|
|||
|
||||
|
||||
%changelog
|
||||
* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.4-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
|
||||
|
||||
* Wed Jun 24 2026 Benjamin A. Beasley <code@musicinmybrain.net> - 1.1.4-5
|
||||
- Rebuilt for abseil-cpp 20260526.0
|
||||
|
||||
* Mon Jun 22 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.1.4-4
|
||||
- Rebuilt for openssl 4.0
|
||||
|
||||
* Wed Jun 10 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1.1.4-3
|
||||
- Use openssl for crypto
|
||||
|
||||
* Fri May 29 2026 Miroslav Suchy <msuchy@redhat.com> - 1.1.4-2
|
||||
- rebuild for https://fedoraproject.org/wiki/Changes/Protobuf_5.x/6.x
|
||||
|
||||
* Wed Apr 15 2026 Attila Lakatos <alakatos@redhat.com> - 1.1.4-1
|
||||
- Rebase to 1.1.4
|
||||
- Drop patches merged upstream: tmpfiles-v1, tmpfiles-v2,
|
||||
uninstall-ignore-error, ipc-privileges, protobuf-3.0,
|
||||
catch2-support, disable-catch
|
||||
- Add SELinux policy fix for systemd-homed stream connect
|
||||
Resolves: rhbz#2380396
|
||||
Resolves: rhbz#2376283
|
||||
|
||||
* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
|
||||
|
||||
* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Thu Apr 24 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.3-5
|
||||
- Fix usbguard-tmpfiles.conf
|
||||
- Remove catch1 dependency
|
||||
- Adapt for protobuf api changes
|
||||
- Fix regression in specifying IPC privileges using UID
|
||||
- selinux subpackage update: unified bin and sbin
|
||||
Resolves: rhbz#2297169
|
||||
|
||||
* Thu Feb 06 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.3-4
|
||||
- Install usbguard-tmpfles.conf
|
||||
|
||||
* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.3-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Fri Jun 07 2024 Attila Lakatos <alakatos@redhat.com> - 1.1.3-1
|
||||
- Rebase to 1.1.3
|
||||
Resolves: rhbz#2290724
|
||||
- selinux package policy update
|
||||
Resolves: rhbz#2271330
|
||||
|
||||
* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Thu Jul 27 2023 Attila Lakatos <alakatos@redhat.com> - 1.1.2-1
|
||||
- Rebase to 1.1.2
|
||||
Resolves: rhbz#2064543
|
||||
|
||||
* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-8
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Wed May 10 2023 Tomas Popela <tpopela@redhat.com> - 1.1.0-7
|
||||
- Drop BR on dbus-glib as the requirement was dropped in 0.7.7
|
||||
|
||||
* Mon Feb 20 2023 Attila Lakatos <alakatos@redhat.com> - 1.1.0-6
|
||||
- Rebuild
|
||||
Resolves: rhbz#2171749
|
||||
|
||||
* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.1.0-4
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Tue Mar 29 2022 Radovan Sroka <rsroka@redhat.com> - 1.1.0-3
|
||||
- usbguard requires selinux subpackage
|
||||
- this ensures that the selinux package and all its dependencies are
|
||||
|
|
@ -318,24 +244,8 @@ Resolves: rhbz#2058450
|
|||
- fixed CVE-2019-25058 usbguard: Fix unauthorized access via D-Bus
|
||||
Resolves: rhbz#2058466
|
||||
|
||||
* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-9
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Sat Nov 06 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-8
|
||||
- Rebuilt for protobuf 3.19.0
|
||||
|
||||
* Mon Oct 25 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-7
|
||||
- Rebuilt for protobuf 3.18.1
|
||||
|
||||
* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Wed Mar 31 2021 Jonathan Wakely <jwakely@redhat.com> - 1.0.0-5
|
||||
- Rebuilt for removed libstdc++ symbols (#1937698)
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.0.0-4
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
* Tue Mar 30 2021 Jonathan Wakely <jwakely@redhat.com> - 1.0.0-4
|
||||
- Rebuilt for removed libstdc++ symbol (#1937698)
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue