diff --git a/.gitignore b/.gitignore index e6f026e..ff8bb43 100644 --- a/.gitignore +++ b/.gitignore @@ -25,3 +25,4 @@ /usbguard-notifier-0.1.1.tar.gz /usbguard-1.1.3.tar.gz /usbguard-selinux-0.0.5.tar.gz +/usbguard-1.1.4.tar.gz diff --git a/catch1-devel.patch b/catch1-devel.patch new file mode 100644 index 0000000..b6ec178 --- /dev/null +++ b/catch1-devel.patch @@ -0,0 +1,34 @@ +diff -up usbguard-1.1.4/configure.ac.orig usbguard-1.1.4/configure.ac +--- usbguard-1.1.4/configure.ac.orig 2025-11-04 09:27:33.016736712 +0100 ++++ usbguard-1.1.4/configure.ac 2025-11-04 09:27:54.843249396 +0100 +@@ -400,16 +400,13 @@ if test "x$enable_catch" = xyes; then + catch_summary="bundled; $catch_CFLAGS $catch_LIBS" + else + SAVE_CPPFLAGS=$CPPFLAGS +- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" ++ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" + AC_LANG_PUSH([C++]) +- AC_CHECK_HEADER([catch_test_macros.hpp], +- [catch_CFLAGS="-I/usr/include/catch2 -DHAVE_CATCH2_V3" +- catch_LIBS="-lCatch2Main -lCatch2"], +- [AC_CHECK_HEADER([catch.hpp], +- [catch_CFLAGS="-I/usr/include/catch2" ++ AC_CHECK_HEADER([catch.hpp], ++ [catch_CFLAGS="-I/usr/include/catch" + catch_LIBS=""], +- [AC_MSG_FAILURE(Catch2 not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] +- )]) ++ [AC_MSG_FAILURE(Catch not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)] ++ ) + AC_LANG_POP + CPPFLAGS=$SAVE_CPPFLAGS + catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" +@@ -417,7 +414,7 @@ if test "x$enable_catch" = xyes; then + else + catch_CFLAGS="" + catch_LIBS="" +- catch_summary="disabled; not checking for Catch2" ++ catch_summary="disabled; not checking for Catch" + fi + AC_SUBST([catch_CFLAGS]) + AC_SUBST([catch_LIBS]) diff --git a/disable-console-logging.patch b/disable-console-logging.patch index ee17b84..d17113a 100644 --- a/disable-console-logging.patch +++ b/disable-console-logging.patch @@ -1,9 +1,9 @@ -diff -up usbguard-1.1.3/usbguard.service.in.orig usbguard-1.1.3/usbguard.service.in ---- usbguard-1.1.3/usbguard.service.in.orig 2024-06-12 14:36:13.192536970 +0200 -+++ usbguard-1.1.3/usbguard.service.in 2024-06-12 14:36:21.110609346 +0200 +diff -up usbguard-1.1.4/usbguard.service.in.orig usbguard-1.1.4/usbguard.service.in +--- usbguard-1.1.4/usbguard.service.in.orig 2025-11-04 09:30:06.066901646 +0100 ++++ usbguard-1.1.4/usbguard.service.in 2025-11-04 09:30:08.179271961 +0100 @@ -8,7 +8,7 @@ OOMScoreAdjust=-1000 AmbientCapabilities= - CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE + CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE CAP_DAC_READ_SEARCH DevicePolicy=closed -ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf +ExecStart=%sbindir%/usbguard-daemon -f -s -K -c %sysconfdir%/usbguard/usbguard-daemon.conf diff --git a/selinux-sbin.patch b/selinux-sbin.patch new file mode 100644 index 0000000..93de40b --- /dev/null +++ b/selinux-sbin.patch @@ -0,0 +1,14 @@ +diff --git a/usbguard.fc b/usbguard.fc +index d8cfa45..3904962 100644 +--- a/usbguard.fc ++++ b/usbguard.fc +@@ -18,7 +18,9 @@ + /etc/usbguard/rules\.conf -- gen_context(system_u:object_r:usbguard_rules_t,s0) + /etc/usbguard(/.*)? gen_context(system_u:object_r:usbguard_conf_t,s0) + /usr/lib/systemd/system/usbguard.* -- gen_context(system_u:object_r:usbguard_unit_file_t,s0) ++/usr/bin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-daemon -- gen_context(system_u:object_r:usbguard_exec_t,s0) ++/usr/bin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /usr/sbin/usbguard-dbus -- gen_context(system_u:object_r:usbguard_exec_t,s0) + /var/log/usbguard(/.*)? gen_context(system_u:object_r:usbguard_log_t,s0) + /run/usbguard.* -- gen_context(system_u:object_r:usbguard_var_run_t,s0) diff --git a/sources b/sources index 235cf86..dd0419e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (usbguard-notifier-0.1.1.tar.gz) = 5540739301f4f4c83f7443b740cf7345be7928f3ed697878094dee1752eac7dedfab9eb652856bfa555be9bfa24687c4b74194afa022973848af13328f0ca1ba -SHA512 (usbguard-1.1.3.tar.gz) = 530bfea12ec8497c30d530c73f868207aad8b0e0e917cb7c7506f6148681a6a4ff12de5cddcfea458eb2b91ce8bb8b0e68d42e2590a4dc6b15f43c18f8256cf1 +SHA512 (usbguard-1.1.4.tar.gz) = d4f588ff97cb9529d9f8c7664998fbfc55fc6e5ddeaad8da3a7e4703e5de0c1b74871763d46ef558458258bbda71bbb47ebc9b4daf67bd9a3d1da015ea48fe61 SHA512 (usbguard-selinux-0.0.5.tar.gz) = 72b12e6a44dddfd863909f82e288170f935c4e941cb65678cd544fd0fa33ecce0a794c4b620dea9f496a45f2035d3b3b6dde662319db200eaff38e26999c4496 +SHA512 (usbguard-notifier-0.1.1.tar.gz) = 5540739301f4f4c83f7443b740cf7345be7928f3ed697878094dee1752eac7dedfab9eb652856bfa555be9bfa24687c4b74194afa022973848af13328f0ca1ba diff --git a/tmpfiles.patch b/tmpfiles.patch deleted file mode 100644 index 4eb6b0f..0000000 --- a/tmpfiles.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 306cad81aee91d6adb61acdb9f1a9900fe2a13cd Mon Sep 17 00:00:00 2001 -From: Cropi -Date: Thu, 6 Feb 2025 08:00:59 +0100 -Subject: [PATCH] =?UTF-8?q?At=20boot=20time,=20systemd=E2=80=91tmpfiles=20?= - =?UTF-8?q?processes=20this=20file=20and=20creates=20/var/log/usbguard=20s?= - =?UTF-8?q?o=20that=20the=20usbguard=20service=20can=20start=20successfull?= - =?UTF-8?q?y.?= -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - ---- - Makefile.am | 13 +++++++++++-- - usbguard-tmpfiles.conf | 1 + - 2 files changed, 12 insertions(+), 2 deletions(-) - create mode 100644 usbguard-tmpfiles.conf - -diff --git a/Makefile.am b/Makefile.am -index 7dc6849..2a8bfeb 100644 ---- a/Makefile.am -+++ b/Makefile.am -@@ -90,8 +90,8 @@ $(top_builddir)/%.roff: %.adoc - $(INSTALL) -m 644 $(top_builddir)/$(@:.roff=) $(top_builddir)/$@ - endif - --install-data-hook: install-daemon-conf install-systemd-service install-data-dbus --uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus -+install-data-hook: install-daemon-conf install-systemd-service install-data-dbus install-tmpfiles -+uninstall-hook: uninstall-daemon-conf uninstall-systemd-service uninstall-data-dbus uninstall-tmpfiles - - CLEANFILES+=\ - $(top_builddir)/usbguard-daemon.conf -@@ -106,6 +106,15 @@ usbguard_confdir= $(sysconfdir)/usbguard - - distuninstallcheck_listfiles= find . -type f ! -name rules.conf -print - -+EXTRA_DIST+=usbguard-tmpfiles.conf -+ -+install-tmpfiles: -+ mkdir -p ${DESTDIR}$(prefix)/lib/tmpfiles.d/ -+ $(INSTALL_DATA) -m 640 ${srcdir}/usbguard-tmpfiles.conf ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ -+uninstall-tmpfiles: -+ rm ${DESTDIR}$(prefix)/lib/tmpfiles.d/usbguard.conf -+ - install-daemon-conf: $(top_builddir)/usbguard-daemon.conf - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir) - $(MKDIR_P) $(DESTDIR)/$(usbguard_confdir)/IPCAccessControl.d -diff --git a/usbguard-tmpfiles.conf b/usbguard-tmpfiles.conf -new file mode 100644 -index 0000000..e90908f ---- /dev/null -+++ b/usbguard-tmpfiles.conf -@@ -0,0 +1 @@ -+d /var/log/usbguard 0700 root root - - --- -2.48.1 - diff --git a/usbguard-revert-catch.patch b/usbguard-revert-catch.patch deleted file mode 100644 index d75cb85..0000000 --- a/usbguard-revert-catch.patch +++ /dev/null @@ -1,17 +0,0 @@ -diff -up ./configure.ac.fix ./configure.ac ---- ./configure.ac.fix 2022-03-03 15:05:03.357194713 +0100 -+++ ./configure.ac 2022-03-03 15:06:02.849787794 +0100 -@@ -394,11 +394,11 @@ if test "x$with_bundled_catch" = xyes; t - catch_summary="bundled; $catch_CFLAGS $catch_LIBS" - else - SAVE_CPPFLAGS=$CPPFLAGS -- CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch2" -+ CPPFLAGS="-std=c++17 $CPPFLAGS -I/usr/include/catch" - AC_LANG_PUSH([C++]) - AC_CHECK_HEADER([catch.hpp], [], [AC_MSG_FAILURE(catch.hpp not found or not usable. Re-run with --with-bundled-catch to use the bundled library.)]) - AC_LANG_POP -- catch_CFLAGS="-I/usr/include/catch2" -+ catch_CFLAGS="-I/usr/include/catch" - catch_LIBS="" - CPPFLAGS=$SAVE_CPPFLAGS - catch_summary="system-wide; $catch_CFLAGS $catch_LIBS" diff --git a/usbguard.spec b/usbguard.spec index e17f95c..90f9754 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -5,8 +5,8 @@ %define notifier_version 0.1.1 Name: usbguard -Version: 1.1.3 -Release: 6%{?dist} +Version: 1.1.4 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPL-2.0-or-later ## Not installed @@ -44,9 +44,9 @@ BuildRequires: audit-libs-devel # For `pkg-config systemd` only BuildRequires: systemd -Patch1: usbguard-revert-catch.patch +Patch1: catch1-devel.patch Patch2: disable-console-logging.patch -Patch3: tmpfiles.patch +Patch3: selinux-sbin.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -120,13 +120,15 @@ device presence changes and displays them as pop-up notifications. # selinux %setup -q -D -T -a 1 +pushd %{name}-selinux-%{semodule_version} +%patch -P 3 -p1 +popd # notifier %setup -q -D -T -a 2 -%patch -P 1 -p1 -b .catch +%patch -P 1 -p1 %patch -P 2 -p1 -%patch -P 3 -p1 # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} @@ -291,6 +293,13 @@ fi %changelog +* Tue Nov 04 2025 Attila Lakatos - 1.1.4-1 +- Rebase to 1.1.4 +- selinux: comply with with the "Unify bin and sbin" change + Resolves: RHEL-113206 +- Restore permissions of the log directory + Resolves: RHEL-92260 + * Thu Feb 06 2025 Attila Lakatos - 1.1.3-6 - Install usbguard-tmpfles.conf Resolves: RHEL-78183