diff --git a/.gitignore b/.gitignore index e69de29..127d32a 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1 @@ +/usbguard-0.3p3.tar.gz diff --git a/sources b/sources index e69de29..4d1e291 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +312b61483da7e41c3203249ef3b37df2 usbguard-0.3p3.tar.gz diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf new file mode 100644 index 0000000..3fcbe75 --- /dev/null +++ b/usbguard-daemon.conf @@ -0,0 +1,35 @@ +# +# Rule set file path. +# +# The USBGuard daemon will use this file to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFile=/path/to/rules.conf +# +RuleFile=/etc/usbguard/rules.conf + +#!!! WARNING: It's good practice to set at least one of the !!! +#!!! two options bellow. If none of them are set, !!! +#!!! the daemon will accept IPC connections from !!! +#!!! anyone, thus allowing anyone to modify the !!! +#!!! rule set and (de)authorize USB devices. !!! + +# +# Users allowed to use the IPC interface. +# +# A space delimited list of usernames that the daemon will +# accept IPC connections from. +# +# IPCAllowedUsers=username1 username2 ... +# + +# +# Groups allowed to use the IPC interface. +# +# A space delimited list of groupnames that the daemon will +# accept IPC connections from. +# +# IPCAllowedGroups=groupname1 groupname2 ... +# +IPCAllowedGroups=wheel diff --git a/usbguard.service b/usbguard.service new file mode 100644 index 0000000..4a51113 --- /dev/null +++ b/usbguard.service @@ -0,0 +1,11 @@ +[Unit] +Description=USBGuard daemon +Wants=systemd-udevd.service local-fs.target + +[Service] +Type=simple +ExecStart=/usr/sbin/usbguard-daemon -k -c /etc/usbguard/usbguard-daemon.conf +Restart=on-failure + +[Install] +WantedBy=base.target diff --git a/usbguard.spec b/usbguard.spec new file mode 100644 index 0000000..30e93cd --- /dev/null +++ b/usbguard.spec @@ -0,0 +1,138 @@ +%global _hardened_build 1 + +Name: usbguard +Version: 0.3p3 +Release: 1%{?dist} +Summary: A tool for implementing USB device usage policy +Group: System Environment/Daemons +License: GPLv2+ +## Not installed +# src/ThirdParty/Catch: Boost Software License - Version 1.0 +URL: https://dkopecek.github.io/usbguard +Source0: https://dkopecek.github.io/usbguard/dist/%{name}-%{version}.tar.gz +Source1: usbguard-daemon.conf +Source2: usbguard.service + +Requires: systemd +Requires(post): systemd +Requires(preun): systemd +Requires(postun): systemd +Requires(post): /sbin/ldconfig +Requires(postun): /sbin/ldconfig + +BuildRequires: libqb-devel +BuildRequires: libsodium-devel +BuildRequires: systemd systemd-devel +BuildRequires: libstdc++-devel +BuildRequires: json-static +BuildRequires: spdlog-static + +%description +The USBGuard software framework helps to protect your computer against rogue USB +devices by implementing basic whitelisting/blacklisting capabilities based on +USB device attributes. + +%package devel +Summary: Development files for %{name} +Group: Development/Libraries +Requires: %{name} = %{version}-%{release} +Requires: pkgconfig +Requires: libstdc++-devel + +%description devel +The %{name}-devel package contains libraries and header files for +developing applications that use %{name}. + +%prep +%setup -q +# Remove bundled library sources before build +rm -rf src/ThirdParty/{json,spdlog} + +%build +%configure \ + --disable-silent-rules \ + --disable-static \ + --without-bundled-json \ + --without-bundled-spdlog + +make %{?_smp_mflags} + +%check +make check + +%install +make install INSTALL='install -p' DESTDIR=%{buildroot} + +# Install configuration +mkdir -p %{buildroot}%{_sysconfdir}/usbguard +install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf + +# Install systemd unit +mkdir -p %{buildroot}%{_unitdir} +install -p -m 644 %{SOURCE2} %{buildroot}%{_unitdir}/usbguard.service + +# Cleanup +find %{buildroot} -name '*.la' -exec rm -f {} ';' + +%preun +%systemd_preun usbguard.service + +%post +/sbin/ldconfig +%systemd_post usbguard.service + +%postun +/sbin/ldconfig +%systemd_postun_with_restart usbguard.service + +%files +%defattr(-,root,root,-) +%doc README.md +%license LICENSE +%{_libdir}/*.so.* +%{_sbindir}/usbguard-daemon +%dir %{_sysconfdir}/usbguard +%config(noreplace) %{_sysconfdir}/usbguard/usbguard-daemon.conf +%{_unitdir}/usbguard.service +%{_datadir}/man/man8/usbguard-daemon.8.gz +%{_datadir}/man/man5/usbguard-daemon.conf.5.gz +%{_datadir}/man/man5/usbguard-rules.conf.5.gz + +%files devel +%defattr(-,root,root,-) +%{_includedir}/* +%{_libdir}/*.so +%{_libdir}/pkgconfig/*.pc + +%changelog +* Tue Apr 14 2015 Daniel Kopecek 0.3p3-1 +- Update to version 0.3p3 +- added %check section +- removed explicit -devel requires on systemd, libqb and + libsodium devel files +- added -devel requires on libstdc++-devel + +* Sat Apr 11 2015 Daniel Kopecek 0.3p2-1 +- Update to version 0.3p2 +- use system-wide json and spdlog packages + +* Fri Apr 10 2015 Daniel Kopecek 0.3p1-1 +- Update to version 0.3p1 +- removed bundled cppformat copylib + +* Thu Apr 09 2015 Daniel Kopecek 0.3-1 +- Update to version 0.3 +- disabled silent rules +- install license file +- added man pages +- use _hardened_build 1 instead of custom compilation flags +- fix file permissions on files in /etc +- do not install an empty rule set file + +* Fri Apr 03 2015 Daniel Kopecek 0.2-1 +- Update to version 0.2 +- Updated description +- Corrected package group + +* Tue Mar 17 2015 Daniel Kopecek 0.1-1 +- Initial package