rpms/usbguard
7
0
Fork 0
Code Issues Pull Requests Releases Activity

RHEL 10.2 ERRATUM

Browse Source 
Rebase to 1.1.4
selinux: comply with with the "Unify bin and sbin" change
Resolves: RHEL-113206
Restore permissions of the log directory
Resolves: RHEL-92260
This commit is contained in:
Cropi 2025-11-04 09:44:49 +01:00
parent a3455444d2
commit 547cc9791a
8 changed files with 70 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -25,3 +25,4 @@
/usbguard-notifier-0.1.1.tar.gz
/usbguard-1.1.3.tar.gz
/usbguard-selinux-0.0.5.tar.gz
/usbguard-1.1.4.tar.gz

34
catch1-devel.patch Normal file
View File

@ -0,0 +1,34 @@
diff -up usbguard-1.1.4/configure.ac.orig usbguard-1.1.4/configure.ac
--- usbguard-1.1.4/configure.ac.orig 2025-11-04 09:27:33.016736712 +0100
+++ usbguard-1.1.4/configure.ac 2025-11-04 09:27:54.843249396 +0100
@@ -400,16 +400,13 @@ if test "x$enable_catch" = xyes; then
catch_summary="bundled; $catch_CFLAGS $catch_LIBS"
else
SAVE_CPPFLAGS=$CPPFLAGS
- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2"
+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch"
AC_LANG_PUSH([C++])
- AC_CHECK_HEADER([catch_test_macros.hpp],
- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3"
- catch_LIBS="-lCatch2Main -lCatch2"],
- [AC_CHECK_HEADER([catch.hpp],
- [catch_CFLAGS="-I/usr/include/catch2"
+ AC_CHECK_HEADER([catch.hpp],
+ [catch_CFLAGS="-I/usr/include/catch"
catch_LIBS=""],
- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]
- )])
+ [AC_MSG_FAILURE(Catch not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]
+ )
AC_LANG_POP
CPPFLAGS=$SAVE_CPPFLAGS
catch_summary="system-wide; $catch_CFLAGS $catch_LIBS"
@@ -417,7 +414,7 @@ if test "x$enable_catch" = xyes; then
else
catch_CFLAGS=""
catch_LIBS=""
- catch_summary="disabled; not checking for Catch2"
+ catch_summary="disabled; not checking for Catch"
fi
AC_SUBST([catch_CFLAGS])
AC_SUBST([catch_LIBS])

8
disable-console-logging.patch
View File

@ -1,9 +1,9 @@
diff -up usbguard-1.1.3/usbguard.service.in.orig usbguard-1.1.3/usbguard.service.in
--- usbguard-1.1.3/usbguard.service.in.orig 2024-06-12 14:36:13.192536970 +0200
+++ usbguard-1.1.3/usbguard.service.in 2024-06-12 14:36:21.110609346 +0200
diff -up usbguard-1.1.4/usbguard.service.in.orig usbguard-1.1.4/usbguard.service.in
--- usbguard-1.1.4/usbguard.service.in.orig 2025-11-04 09:30:06.066901646 +0100
+++ usbguard-1.1.4/usbguard.service.in 2025-11-04 09:30:08.179271961 +0100
@@ -8,7 +8,7 @@ OOMScoreAdjust=-1000
AmbientCapabilities=
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE CAP_DAC_READ_SEARCH
DevicePolicy=closed
-ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf
+ExecStart=%sbindir%/usbguard-daemon -f -s -K -c %sysconfdir%/usbguard/usbguard-daemon.conf

14
selinux-sbin.patch Normal file
View File

@ -0,0 +1,14 @@
diff --git a/usbguard.fc b/usbguard.fc
index d8cfa45..3904962 100644
--- a/usbguard.fc
+++ b/usbguard.fc
@@ -18,7 +18,9 @@
/etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0)
/etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0)
/usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0)
+/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0)
/usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0)
+/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0)
/usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0)
/var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0)
/run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0)

4
sources
View File

@ -1,3 +1,3 @@
SHA512 (usbguard-notifier-0.1.1.tar.gz) = 5540739301f4f4c83f7443b740cf7345be7928f3ed697878094dee1752eac7dedfab9eb652856bfa555be9bfa24687c4b74194afa022973848af13328f0ca1ba
SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1
SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61
SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496
SHA512 (usbguard-notifier-0.1.1.tar.gz) = 5540739301f4f4c83f7443b740cf7345be7928f3ed697878094dee1752eac7dedfab9eb652856bfa555be9bfa24687c4b74194afa022973848af13328f0ca1ba

58
tmpfiles.patch
View File

@ -1,58 +0,0 @@
From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Thu, 6 Feb 2025 08:00:59 +0100
Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?=
=?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?=
=?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?=
=?UTF-8?q?y.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
Makefile.am | 13 +++++++++++--
usbguard-tmpfiles.conf | 1 +
2 files changed, 12 insertions(+), 2 deletions(-)
create mode 100644 usbguard-tmpfiles.conf
diff --git a/Makefile.am b/Makefile.am
index 7dc6849..2a8bfeb 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc
$(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@
endif
-install-data-hook: install-daemon-conf install-systemd-service install-data-dbus
-uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus
+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles
+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles
CLEANFILES+=\
$(top_builddir)/usbguard-daemon.conf
@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard
distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print
+EXTRA_DIST+=usbguard-tmpfiles.conf
+
+install-tmpfiles:
+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/
+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf
+
+uninstall-tmpfiles:
+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf
+
install-daemon-conf: $(top_builddir)/usbguard-daemon.conf
$(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)
$(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d
diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf
new file mode 100644
index 0000000..e90908f
--- /dev/null
+++ b/usbguard-tmpfiles.conf
@@ -0,0 +1 @@
+d /var/log/usbguard 0700 root root - -
--
2.48.1

17
usbguard-revert-catch.patch
View File

@ -1,17 +0,0 @@
diff -up ./configure.ac.fix ./configure.ac
--- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100
+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100
@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t
catch_summary="bundled; $catch_CFLAGS $catch_LIBS"
else
SAVE_CPPFLAGS=$CPPFLAGS
- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2"
+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch"
AC_LANG_PUSH([C++])
AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)])
AC_LANG_POP
- catch_CFLAGS="-I/usr/include/catch2"
+ catch_CFLAGS="-I/usr/include/catch"
catch_LIBS=""
CPPFLAGS=$SAVE_CPPFLAGS
catch_summary="system-wide; $catch_CFLAGS $catch_LIBS"

21
usbguard.spec
View File

@ -5,8 +5,8 @@
%define notifier_version 0.1.1
Name: usbguard
Version: 1.1.3
Release: 6%{?dist}
Version: 1.1.4
Release: 1%{?dist}
Summary: A tool for implementing USB device usage policy
License: GPL-2.0-or-later
## Not installed
@ -44,9 +44,9 @@ BuildRequires: audit-libs-devel
# For `pkg-config systemd` only
BuildRequires: systemd
Patch1: usbguard-revert-catch.patch
Patch1: catch1-devel.patch
Patch2: disable-console-logging.patch
Patch3: tmpfiles.patch
Patch3: selinux-sbin.patch
%description
The USBGuard software framework helps to protect your computer against rogue USB
@ -120,13 +120,15 @@ device presence changes and displays them as pop-up notifications.
# selinux
%setup -q -D -T -a 1
pushd %{name}-selinux-%{semodule_version}
%patch -P 3 -p1
popd
# notifier
%setup -q -D -T -a 2
%patch -P 1 -p1 -b .catch
%patch -P 1 -p1
%patch -P 2 -p1
%patch -P 3 -p1
# Remove bundled library sources before build
rm -rf src/ThirdParty/{Catch,PEGTL}
@ -291,6 +293,13 @@ fi
%changelog
* Tue Nov 04 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.4-1
- Rebase to 1.1.4
- selinux: comply with with the "Unify bin and sbin" change
Resolves: RHEL-113206
- Restore permissions of the log directory
Resolves: RHEL-92260
* Thu Feb 06 2025 Attila Lakatos <alakatos@redhat.com> - 1.1.3-6
- Install usbguard-tmpfles.conf
Resolves: RHEL-78183