import usbguard-1.0.0-8.el9

2021-11-03 02:36:01 -04:00 · 2021-11-03 02:36:01 -04:00 · 5ec4878e36
commit 5ec4878e36
8 changed files with 911 additions and 0 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,3 @@
+SOURCES/usbguard-1.0.0.tar.gz
+SOURCES/usbguard-notifier-0.0.6.tar.gz
+SOURCES/usbguard-selinux-0.0.4.tar.gz
--- a/.usbguard.metadata
+++ b/.usbguard.metadata
@ -0,0 +1,3 @@
+bf909799daae6798634e1b01efaaadc5781b9755 SOURCES/usbguard-1.0.0.tar.gz
+7bd5b72c6fd73472ef1230977b9358345ce442d3 SOURCES/usbguard-notifier-0.0.6.tar.gz
+40db29405c2236791ca5ce616d9e563a8309356e SOURCES/usbguard-selinux-0.0.4.tar.gz
--- a/SOURCES/usbguard-0.7.6-notifier.patch
+++ b/SOURCES/usbguard-0.7.6-notifier.patch
@ -0,0 +1,88 @@
+diff -up ./usbguard-notifier-0.0.6/configure.ac.notifier ./usbguard-notifier-0.0.6/configure.ac
+--- ./usbguard-notifier-0.0.6/configure.ac.notifier	2020-04-29 07:35:43.057914703 +0200
+++ ./usbguard-notifier-0.0.6/configure.ac	2020-06-17 16:27:53.577151720 +0200
+@@ -44,6 +44,32 @@ AC_ARG_WITH(
+     [notificaiton_path="/tmp/usbguard-notifier"]
+ )
+ 
+# usbguard-devel
+# Add the path to where your usbguard-devel includes are
+# You might need this option when you want to package usbguard-notifier
+# together with usbguard at the same time
+AC_ARG_WITH(
+    [usbguard-devel],
+    AS_HELP_STRING([--with-usbguard-devel], [Select to compile notifier from source usbguard devel files(only top level directory)]),
+    [usbguard_CFLAGS="-I$withval/src/Library/public/"
+     usbguard_LIBS=""
+     usbguard_LA="$withval/libusbguard.la"
+     libusbguard_summary="$usbguard_CFLAGS $usbguard_LIBS"
+     AC_SUBST([usbguard_CFLAGS])
+     AC_SUBST([usbguard_LIBS])
+     AC_SUBST([usbguard_LA])
+     custom_usbguard_devel_enabled=yes
+    ],
+    [
+        PKG_CHECK_MODULES(
+            [usbguard],
+            [libusbguard >= 0.7.2],
+            [libusbguard_summary="$usbguard_CFLAGS $usbguard_LIBS"],
+            [AC_MSG_FAILURE([libusbguard development files not found])]
+        )
+    ]
+)
+
+ # Build notifier-cli, default is yes
+ AC_ARG_ENABLE([notifier-cli],
+     [AC_HELP_STRING([--enable-notifier-cli], [enable notifier cli(default=yes)])],
+@@ -81,14 +107,6 @@ PKG_CHECK_MODULES(
+     [AC_MSG_FAILURE([libnotify development files not found])]
+ )
+ 
+-# usbguard
+-PKG_CHECK_MODULES(
+-    [usbguard],
+-    [libusbguard >= 0.7.2],
+-    [libusbguard_summary="$usbguard_CFLAGS $usbguard_LIBS"],
+-    [AC_MSG_FAILURE([libusbguard development files not found])]
+-)
+-
+ # asciidoc
+ AC_CHECK_PROGS(A2X, [a2x])
+ if test -z "$A2X"; then
+@@ -162,6 +180,7 @@ AC_SUBST(config_PATH, $prefix/.config)
+ AC_SUBST(NOTIFICATION_PATH, $notification_path)
+ 
+ AM_CONDITIONAL([NOTIFIER_CLI_ENABLED], [test "x$notifier_cli_enabled" = xyes ])
+AM_CONDITIONAL([CUSTOM_USBGUARD_DEVEL_ENABLED], [test "x$custom_usbguard_devel_enabled" = "xyes"])
+ 
+ AC_CONFIG_FILES([
+     Makefile
+diff -up ./usbguard-notifier-0.0.6/Makefile.am.notifier ./usbguard-notifier-0.0.6/Makefile.am
+--- ./usbguard-notifier-0.0.6/Makefile.am.notifier	2020-04-29 07:18:21.024388188 +0200
+++ ./usbguard-notifier-0.0.6/Makefile.am	2020-06-17 16:27:53.592151848 +0200
+@@ -57,6 +57,13 @@ usbguard_notifier_CXXFLAGS = \
+ 	@usbguard_CFLAGS@ \
+ 	-fPIC
+ 
+if CUSTOM_USBGUARD_DEVEL_ENABLED
+usbguard_notifier_LDADD = \
+	@usbguard_LA@
+usbguard_notifier_cli_LDADD = \
+	@usbguard_LA@
+endif
+
+ BUILT_SOURCES = \
+ 	src/BuildConfig.h
+ 
+diff -up ./usbguard-notifier-0.0.6/man/usbguard-notifier.1.notifier ./usbguard-notifier-0.0.6/man/usbguard-notifier.1
+--- ./usbguard-notifier-0.0.6/man/usbguard-notifier.1.notifier	2020-06-17 19:55:54.621855004 +0200
+++ ./usbguard-notifier-0.0.6/man/usbguard-notifier.1	2020-06-17 19:56:46.551297432 +0200
+@@ -53,7 +53,7 @@ Show help\&.
+ .RE
+ .SH "SEE ALSO"
+ .sp
+-usbguard\-notifier\-cli(1), usbguard(1)
+usbguard(1)
+ .SH "BUGS"
+ .sp
+ If you find a bug in this software or if you\(cqd like to request a feature to be implemented, please file a ticket at https://github\&.com/Cropi/usbguard\-notifier/issues/new\&.
--- a/SOURCES/usbguard-audit-capability.patch
+++ b/SOURCES/usbguard-audit-capability.patch
@ -0,0 +1,12 @@
+diff -up usbguard-1.0.0/usbguard.service.in.orig usbguard-1.0.0/usbguard.service.in
+--- usbguard-1.0.0/usbguard.service.in.orig	2021-03-17 14:16:21.675374844 +0100
+++ usbguard-1.0.0/usbguard.service.in	2021-03-17 14:16:29.056373213 +0100
+@@ -5,7 +5,7 @@ Documentation=man:usbguard-daemon(8)
+ 
+ [Service]
+ AmbientCapabilities=
+-CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER
+CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE
+ DevicePolicy=closed
+ ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf
+ IPAddressDeny=any
--- a/SOURCES/usbguard-daemon.conf
+++ b/SOURCES/usbguard-daemon.conf
@ -0,0 +1,211 @@
+#
+# Rule set file path.
+#
+# The USBGuard daemon will use this file to load the policy
+# rule set from it and to write new rules received via the
+# IPC interface.
+#
+# RuleFile=/path/to/rules.conf
+#
+RuleFile=/etc/usbguard/rules.conf
+
+#
+# Rule set folder path.
+#
+# The USBGuard daemon will use this folder to load the policy
+# rule set from it and to write new rules received via the
+# IPC interface. Usually, we set the option to
+# /etc/usbguard/rules.d/. The USBGuard daemon is supposed to
+# behave like any other standard Linux daemon therefore it
+# loads rule files in alpha-numeric order. File names inside
+# RuleFolder directory should start with a two-digit number
+# prefix indicating the position, in which the rules are
+# scanned by the daemon.
+#
+# RuleFolder=/path/to/rulesfolder/
+#
+RuleFolder=/etc/usbguard/rules.d/
+
+#
+# Implicit policy target.
+#
+# How to treat devices that don't match any rule in the
+# policy. One of:
+#
+# * allow  - authorize the device
+# * block  - block the device
+# * reject - remove the device
+#
+ImplicitPolicyTarget=block
+
+#
+# Present device policy.
+#
+# How to treat devices that are already connected when the
+# daemon starts. One of:
+#
+# * allow        - authorize every present device
+# * block        - deauthorize every present device
+# * reject       - remove every present device
+# * keep         - just sync the internal state and leave it
+# * apply-policy - evaluate the ruleset for every present
+#                  device
+#
+PresentDevicePolicy=apply-policy
+
+#
+# Present controller policy.
+#
+# How to treat USB controllers that are already connected
+# when the daemon starts. One of:
+#
+# * allow        - authorize every present device
+# * block        - deauthorize every present device
+# * reject       - remove every present device
+# * keep         - just sync the internal state and leave it
+# * apply-policy - evaluate the ruleset for every present
+#                  device
+#
+PresentControllerPolicy=keep
+
+#
+# Inserted device policy.
+#
+# How to treat USB devices that are already connected
+# *after* the daemon starts. One of:
+#
+# * block        - deauthorize every present device
+# * reject       - remove every present device
+# * apply-policy - evaluate the ruleset for every present
+#                  device
+#
+InsertedDevicePolicy=apply-policy
+
+#
+# Control which devices are authorized by default.
+#
+# The USBGuard daemon modifies some the default authorization state attributes
+# of controller devices. This setting, enables you to define what value the
+# default authorization is set to.
+#
+# * keep         - do not change the authorization state
+# * none         - every new device starts out deauthorized
+# * all          - every new device starts out authorized
+# * internal     - internal devices start out authorized, external devices start
+#                  out deauthorized (this requires the ACPI tables to properly
+#                  label internal devices, and kernel support)
+#
+#AuthorizedDefault=none
+
+#
+# Restore controller device state.
+#
+# The USBGuard daemon modifies some attributes of controller
+# devices like the default authorization state of new child device
+# instances. Using this setting, you can control whether the
+# daemon will try to restore the attribute values to the state
+# before modification on shutdown.
+#
+# SECURITY CONSIDERATIONS: If set to true, the USB authorization
+# policy could be bypassed by performing some sort of attack on the
+# daemon (via a local exploit or via a USB device) to make it shutdown
+# and restore to the operating-system default state (known to be permissive).
+#
+RestoreControllerDeviceState=false
+
+#
+# Device manager backend
+#
+# Which device manager backend implementation to use. One of:
+#
+# * uevent   - Netlink based implementation which uses sysfs to scan for present
+#              devices and an uevent netlink socket for receiving USB device
+#              related events.
+# * umockdev - umockdev based device manager capable of simulating devices based
+#              on umockdev-record files. Useful for testing.
+#
+DeviceManagerBackend=uevent
+
+#!!! WARNING: It's good practice to set at least one of the !!!
+#!!!          two options bellow. If none of them are set,  !!!
+#!!!          the daemon will accept IPC connections from   !!!
+#!!!          anyone, thus allowing anyone to modify the    !!!
+#!!!          rule set and (de)authorize USB devices.       !!!
+
+#
+# Users allowed to use the IPC interface.
+#
+# A space delimited list of usernames that the daemon will
+# accept IPC connections from.
+#
+# IPCAllowedUsers=username1 username2 ...
+#
+IPCAllowedUsers=root
+
+#
+# Groups allowed to use the IPC interface.
+#
+# A space delimited list of groupnames that the daemon will
+# accept IPC connections from.
+#
+# IPCAllowedGroups=groupname1 groupname2 ...
+#
+IPCAllowedGroups=wheel
+
+#
+# IPC access control definition files path.
+#
+# The files at this location will be interpreted by the daemon
+# as access control definition files. The (base)name of a file
+# should be in the form:
+#
+#   [user][:<group>]
+#
+# and should contain lines in the form:
+#
+#   <section>=[privilege] ...
+#
+# This way each file defines who is able to connect to the IPC
+# bus and what privileges he has.
+#
+IPCAccessControlFiles=/etc/usbguard/IPCAccessControl.d/
+
+#
+# Generate device specific rules including the "via-port"
+# attribute.
+#
+# This option modifies the behavior of the allowDevice
+# action. When instructed to generate a permanent rule,
+# the action can generate a port specific rule. Because
+# some systems have unstable port numbering, the generated
+# rule might not match the device after rebooting the system.
+#
+# If set to false, the generated rule will still contain
+# the "parent-hash" attribute which also defines an association
+# to the parent device. See usbguard-rules.conf(5) for more
+# details.
+#
+DeviceRulesWithPort=false
+
+#
+# USBGuard Audit events log backend
+#
+# One of:
+#
+# * FileAudit - Log audit events into a file specified by
+#               AuditFilePath setting (see below)
+# * LinuxAudit - Log audit events using the Linux Audit
+#                subsystem (using audit_log_user_message)
+#
+AuditBackend=FileAudit
+
+#
+# USBGuard audit events log file path.
+#
+AuditFilePath=/var/log/usbguard/usbguard-audit.log
+
+#
+# Hides personally identifiable information such as device serial numbers and
+# hashes of descriptors (which include the serial number) from audit entries.
+#
+#HidePII=false
--- a/SOURCES/usbguard-selinux-audit-capability.patch
+++ b/SOURCES/usbguard-selinux-audit-capability.patch
@ -0,0 +1,12 @@
+diff -up usbguard-1.0.0/usbguard-selinux-0.0.4/usbguard.te.orig usbguard-1.0.0/usbguard-selinux-0.0.4/usbguard.te
+--- usbguard-1.0.0/usbguard-selinux-0.0.4/usbguard.te.orig	2021-03-23 10:32:56.239139027 +0100
+++ usbguard-1.0.0/usbguard-selinux-0.0.4/usbguard.te	2021-03-23 10:33:05.718229143 +0100
+@@ -68,7 +68,7 @@ files_pid_file(usbguard_var_run_t)
+ # Local policy
+ #
+ 
+-allow usbguard_t self:capability { chown fowner };
+allow usbguard_t self:capability { chown fowner audit_write };
+ allow usbguard_t self:netlink_kobject_uevent_socket { bind create setopt read };
+ allow usbguard_t self:netlink_audit_socket { nlmsg_relay create_netlink_socket_perms };
+ 
--- a/SOURCES/usbguard-service-pidfile.patch
+++ b/SOURCES/usbguard-service-pidfile.patch
@ -0,0 +1,24 @@
+From 6a596441eb91215898542bce4aadabfe396a3875 Mon Sep 17 00:00:00 2001
+From: Birger Schacht <1143280+b1rger@users.noreply.github.com>
+Date: Mon, 18 Jan 2021 15:00:47 +0000
+Subject: [PATCH] Write PIDFile to /run instead of /var/run
+
+According to https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch05s13.html regarding /var/run:
+This directory was once intended for system information data describing the system since it was booted. These functions have been moved to /run; this directory exists to ensure compatibility with systems and software using an older version of this specification.
+---
+ usbguard.service.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/usbguard.service.in b/usbguard.service.in
+index 0d7e193c..2ec8c633 100644
+--- a/usbguard.service.in
+++ b/usbguard.service.in
+@@ -12,7 +12,7 @@ IPAddressDeny=any
+ LockPersonality=yes
+ MemoryDenyWriteExecute=yes
+ NoNewPrivileges=yes
+-PIDFile=/var/run/usbguard.pid
+PIDFile=/run/usbguard.pid
+ PrivateDevices=yes
+ PrivateTmp=yes
+ ProtectControlGroups=yes
--- a/SPECS/usbguard.spec
+++ b/SPECS/usbguard.spec
@ -0,0 +1,558 @@
+%global _hardened_build 1
+%global selinuxtype targeted
+%global moduletype contrib
+%define semodule_version 0.0.4
+%define notifier_version 0.0.6
+
+%bcond_without check
+
+Name:           usbguard
+Version:        1.0.0
+Release:        8%{?dist}
+Summary:        A tool for implementing USB device usage policy
+Group:          System Environment/Daemons
+License:        GPLv2+
+## Not installed
+# src/ThirdParty/Catch: Boost Software License - Version 1.0
+URL:            https://usbguard.github.io/
+Source0:        https://github.com/USBGuard/usbguard/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
+Source1:        https://github.com/USBGuard/%{name}-selinux/archive/v%{semodule_version}.tar.gz#/%{name}-selinux-%{semodule_version}.tar.gz
+Source2:        https://github.com/Cropi/%{name}-notifier/releases/download/%{name}-notifier-%{notifier_version}/%{name}-notifier-%{notifier_version}.tar.gz
+Source3:        usbguard-daemon.conf
+
+Requires: systemd
+Requires(post): systemd
+Requires(preun): systemd
+Requires(postun): systemd
+Requires(post): /sbin/ldconfig
+Requires(postun): /sbin/ldconfig
+Recommends: (%{name}-selinux if selinux-policy-%{selinuxtype})
+Conflicts:  %{name}
+
+BuildRequires: gcc-c++
+BuildRequires: libqb-devel
+BuildRequires: libgcrypt-devel
+BuildRequires: libstdc++-devel
+BuildRequires: protobuf-devel protobuf-compiler
+BuildRequires: PEGTL-static
+BuildRequires: catch1-devel
+BuildRequires: autoconf automake libtool
+BuildRequires: bash-completion
+BuildRequires: asciidoc
+BuildRequires: audit-libs-devel
+# For `pkg-config systemd` only
+BuildRequires: systemd
+
+BuildRequires: dbus-glib-devel
+BuildRequires: dbus-devel
+BuildRequires: glib2-devel
+BuildRequires: polkit-devel
+BuildRequires: libxslt
+BuildRequires: libxml2
+
+Patch1: usbguard-0.7.6-notifier.patch
+Patch2: usbguard-audit-capability.patch
+Patch3: usbguard-selinux-audit-capability.patch
+Patch4: usbguard-service-pidfile.patch
+
+%description
+The USBGuard software framework helps to protect your computer against rogue USB
+devices by implementing basic whitelisting/blacklisting capabilities based on
+USB device attributes.
+
+%package        devel
+Summary:        Development files for %{name}
+Group:          Development/Libraries
+Requires:       %{name} = %{version}-%{release}
+Requires:       pkgconfig
+Requires:       libstdc++-devel
+
+%description    devel
+The %{name}-devel package contains libraries and header files for
+developing applications that use %{name}.
+
+%package        tools
+Summary:        USBGuard Tools
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+
+%description    tools
+The %{name}-tools package contains optional tools from the USBGuard
+software framework.
+
+%package        dbus
+Summary:        USBGuard D-Bus Service
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+Requires:       dbus
+Requires:       polkit
+
+%description    dbus
+The %{name}-dbus package contains an optional component that provides
+a D-Bus interface to the USBGuard daemon component.
+
+%package        selinux
+Summary:        USBGuard selinux
+Group:          Applications/System
+Requires:       selinux-policy-%{selinuxtype}
+Requires(post): selinux-policy-%{selinuxtype}
+BuildRequires:  selinux-policy-devel
+BuildArch: noarch
+%{?selinux_requires}
+
+%description    selinux
+The %{name}-selinux package contains selinux policy for the USBGuard
+daemon.
+
+%package        notifier
+Summary:        A tool for detecting usbguard policy and device presence changes
+Group:          Applications/System
+Requires:       %{name} = %{version}-%{release}
+Requires:       systemd
+BuildRequires:  librsvg2-devel
+BuildRequires:  libnotify-devel
+BuildRequires:  execstack
+
+%description    notifier
+The %{name}-notifier package detects usbguard policy modifications as well as
+device presence changes and displays them as pop-up notifications.
+
+# usbguard
+%prep
+%setup -q
+
+# selinux
+%setup -q -D -T -a 1
+
+# notifier
+%setup -q -D -T -a 2
+
+# Remove bundled library sources before build
+rm -rf src/ThirdParty/{Catch,PEGTL}
+
+%patch1 -p1 -b .notifier
+%patch2 -p1 -b .audit-write
+%patch3 -p1 -b .selinux-audit-write
+%patch4 -p1 -b .pidfile
+
+%build
+mkdir -p ./m4
+autoreconf -i -v --no-recursive ./
+%configure \
+    --disable-silent-rules \
+    --without-bundled-catch \
+    --without-bundled-pegtl \
+    --enable-systemd \
+    --with-dbus \
+    --with-polkit \
+    --with-crypto-library=gcrypt
+
+make %{?_smp_mflags}
+
+# selinux
+pushd %{name}-selinux-%{semodule_version}
+make
+popd
+
+# notifier
+pushd %{name}-notifier-%{notifier_version}
+mkdir -p ./m4
+autoreconf -i -v --no-recursive ./
+export CXXFLAGS="$RPM_OPT_FLAGS"
+%configure \
+    --disable-silent-rules \
+    --without-bundled-catch \
+    --enable-debug-build \
+    --disable-notifier-cli \
+    --with-usbguard-devel="../"
+
+%set_build_flags
+make %{?_smp_mflags}
+popd
+
+%if %{with check}
+%check
+make check
+%endif
+
+# selinux
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
+%install
+make install INSTALL='install -p' DESTDIR=%{buildroot}
+
+# Overwrite configuration with distribution defaults
+mkdir -p %{buildroot}%{_sysconfdir}/usbguard
+mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d
+mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d
+install -p -m 644 %{SOURCE3} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
+
+# selinux
+install -d %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -m 0644 %{name}-selinux-%{semodule_version}/%{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}
+install -d -p %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}
+install -p -m 644 %{name}-selinux-%{semodule_version}/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+# notifier
+pushd %{name}-notifier-%{notifier_version}
+make install INSTALL='install -p' DESTDIR=%{buildroot}
+execstack -c %{buildroot}%{_bindir}/%{name}-notifier
+popd
+
+# Cleanup
+find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
+
+%preun
+%systemd_preun usbguard.service
+
+%post
+/sbin/ldconfig
+%systemd_post usbguard.service
+
+%postun
+/sbin/ldconfig
+%systemd_postun usbguard.service
+
+%files
+%defattr(-,root,root,-)
+%doc README.adoc CHANGELOG.md
+%license LICENSE
+%{_libdir}/*.so.*
+%{_sbindir}/usbguard-daemon
+%{_bindir}/usbguard
+%dir %{_localstatedir}/log/usbguard
+%dir %{_sysconfdir}/usbguard
+%dir %{_sysconfdir}/usbguard/rules.d/
+%dir %{_sysconfdir}/usbguard/IPCAccessControl.d
+%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf
+%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf
+%{_unitdir}/usbguard.service
+%{_datadir}/man/man8/usbguard-daemon.8.gz
+%{_datadir}/man/man5/usbguard-daemon.conf.5.gz
+%{_datadir}/man/man5/usbguard-rules.conf.5.gz
+%{_datadir}/man/man1/usbguard.1.gz
+%{_datadir}/bash-completion/completions/usbguard
+
+%files devel
+%defattr(-,root,root,-)
+%{_includedir}/*
+%{_libdir}/*.so
+%{_libdir}/pkgconfig/*.pc
+
+%files tools
+%defattr(-,root,root,-)
+%{_bindir}/usbguard-rule-parser
+
+
+%files dbus
+%defattr(-,root,root,-)
+%{_sbindir}/usbguard-dbus
+%{_datadir}/dbus-1/system-services/org.usbguard1.service
+%{_datadir}/dbus-1/system.d/org.usbguard1.conf
+%{_datadir}/polkit-1/actions/org.usbguard1.policy
+%{_unitdir}/usbguard-dbus.service
+%{_mandir}/man8/usbguard-dbus.8.gz
+
+%preun dbus
+%systemd_preun usbguard-dbus.service
+
+%post dbus
+%systemd_post usbguard-dbus.service
+
+%postun dbus
+%systemd_postun_with_restart usbguard-dbus.service
+
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
+%{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{name}
+fi
+
+%posttrans selinux
+%selinux_relabel_post -s %{selinuxtype}
+
+%files notifier
+%defattr(-,root,root,-)
+%doc %{name}-notifier-%{notifier_version}/README.md %{name}-notifier-%{notifier_version}/CHANGELOG.md
+%license %{name}-notifier-%{notifier_version}/LICENSE
+%{_bindir}/%{name}-notifier
+%{_mandir}/man1/%{name}-notifier.1.gz
+%{_userunitdir}/%{name}-notifier.service
+
+%post notifier
+%systemd_user_post %{name}-notifier.service
+
+%preun notifier
+%systemd_user_preun %{name}-notifier.service
+
+%postun notifier
+%systemd_user_postun_with_restart %{name}-notifier.service
+
+
+%changelog
+* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 1.0.0-8
+- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
+  Related: rhbz#1991688
+
+* Wed Jul 28 2021 Radovan Sroka <rsroka@redhat.com> - 1.0.0-7
+RHEL 9 BETA
+- starting usbguard service complains about PIDFile= references a path below legacy directory /var/run/
+Resolves: rhbz#1985627
+- file conflict when installing usbguard on rhel
+Resolves: rhbz#1986785
+
+* Fri Apr 16 2021 Attila Lakatos <alakatos@redhat.com> - 1.0.0-6
+- Clear executable stack flag on usbguard-notifier
+Resolves: rhbz#1917544
+
+* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.0.0-5
+- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
+
+* Fri Feb 19 2021 Attila Lakatos <alakatos@redhat.com> - 1.0.0-4
+- sync with rhel-8.4.0 branch
+- bundle usbguard-notifier as subpackage
+Resolves: rhbz#1917544
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 12:49:32 CET 2021 Adrian Reber <adrian@lisas.de> - 1.0.0-2
+- Rebuilt for protobuf 3.14
+
+* Thu Jan 14 2021 Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-1
+- rebase usbguard to 1.0.0
+- added support for rules covering combination of classes
+- fix usbguard being killed
+Resolves: rhbz#1916039
+Resolves: rhbz#1861330
+Resolves: rhbz#1905257
+
+* Wed Jan 13 14:43:57 CET 2021 Adrian Reber <adrian@lisas.de> - 0.7.8-6
+- Rebuilt for protobuf 3.14
+
+* Thu Sep 24 2020 Adrian Reber <adrian@lisas.de> - 0.7.8-5
+- Rebuilt for protobuf 3.13
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.8-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jun 24 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-3
+- rebase selinux tarball to v0.0.4
+- enable forking style in unit file
+- set DevicePolicy to closed in unit file
+- usbguard prevented from writing conf via dontaudit rule
+Resolves: rhbz#1804713
+Resolves: rhbz#1789923
+
+* Sun Jun 14 2020 Adrian Reber <adrian@lisas.de> - 0.7.8-2
+- Rebuilt for protobuf 3.12
+
+* Tue May 19 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-1
+- rebase usbguard to 0.7.8
+- rebase usbguard-selinux to 0.0.3
+- added rules.d/ directory
+Resolves: rhbz#1808527
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.6-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Dec 19 2019 Orion Poplawski <orion@nwra.com> - 0.7.6-7
+- Rebuild for protobuf 3.11
+
+* Wed Dec 18 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-6
+- fix selinux problems
+
+* Mon Dec 02 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-5
+- obsolete applet-qt subpackage
+
+* Mon Nov 25 2019 Attila Lakatos <alakatos@redhat.com> - 0.7.6-4
+- added patch for libqb related permission issues
+  resolves: rhbz#1776357
+- added patch to ensure that usbguard-daemons is still running after locked screen
+  resolves: rhbz#1751861
+- added patch to fix permanent device policy changes
+
+* Wed Nov 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-3
+- fixed typo in specfile
+- usbguard.conf was generated incorrectly
+
+* Wed Nov 13 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-2
+- added selinux subpackage
+
+* Mon Nov 11 2019 Radovan Sroka <rsroka@redhat.com> - 0.7.6-1
+- rebase to 0.7.6
+- removed usbguard-applet subpackage which is not in upstream anymore
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Wed Nov 21 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 0.7.2-6
+- Rebuild for protobuf 3.6
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Apr 05 2018 Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-4
+- Update to latest PEGTL API
+
+* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Tue Jan 23 2018 Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-2
+- Escape rpm macros mentioned in changelog section
+
+* Tue Jan 23 2018 Daniel Kopeček <dkopecek@redhat.com> - 0.7.2-1
+- Update to 0.7.2
+- Don't use --enable-werror downstream
+- Removed patches related to compiler warnings
+
+* Mon Jan 15 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 0.7.1-2
+- catch → catch1
+
+* Wed Dec 06 2017 Daniel Kopeček <dkopecek@redhat.com> - 0.7.1-1
+- Update to 0.7.1
+
+* Wed Nov 29 2017 Igor Gnatenko <ignatenko@redhat.com> - 0.7.0-9
+- Rebuild for protobuf 3.5
+
+* Mon Nov 13 2017 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 0.7.0-8
+- Rebuild for protobuf 3.4
+
+* Mon Oct 16 2017 Daniel Kopeček <dkopecek@redhat.com> 0.7.0-7
+- Fix enumeration timeout on kernel >= 4.13
+  Resolves: rhbz#1499052
+
+* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.0-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu Jul 13 2017 Daniel Kopeček <dkopecek@redhat.com> 0.7.0-4
+- Added patch to disable unused parameter warning for protobuf
+  generated sources to fix compilation with newer protobuf version
+
+* Tue Jun 13 2017 Orion Poplawski <orion@cora.nwra.com> - 0.7.0-3
+- Rebuild for protobuf 3.3.1
+
+* Mon May 15 2017 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_27_Mass_Rebuild
+
+* Thu Apr 13 2017 Daniel Kopeček <dkopecek@redhat.com> 0.7.0-1
+- Update to 0.7.0
+  - changed PresentDevicePolicy setting from keep to apply-policy
+  - added AuditFilePath configuration option pointing to
+    /var/log/usbguard/usbguard-audit.log file
+  - install bash-completion script
+  - use 0600 file permissions for usbguard-daemon.conf and rules.conf
+
+* Sun Mar 19 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170319
+- Update to latest git snapshot
+
+* Fri Mar 17 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170317
+- Update to latest git snapshot
+- Use --enable-werror configure option as the upstream default
+  changed to not use -Werror.
+
+* Thu Mar 02 2017 Daniel Kopeček <dkopecek@redhat.com> 0.6.3-0.1.20170301
+- Update to latest git snapshot
+- Disabled upstream alignment warning compiler flag
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.6.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Thu Jan 26 2017 Orion Poplawski <orion@cora.nwra.com> - 0.6.2-3
+- Rebuild for protobuf 3.2.0
+
+* Sat Nov 19 2016 Orion Poplawski <orion@cora.nwra.com> - 0.6.2-2
+- Rebuild for protobuf 3.1.0
+
+* Sun Sep 18 2016 Daniel Kopeček <dkopecek@redhat.com> 0.6.2-1
+- Update to 0.6.2
+
+* Fri Sep 16 2016 Daniel Kopeček <dkopecek@redhat.com> 0.6.1-1
+- Update to 0.6.1
+
+* Sun Sep 04 2016 Daniel Kopeček <dkopecek@redhat.com> 0.6.0-1
+- Update to 0.6.0
+
+* Thu Aug 18 2016 Daniel Kopeček <dkopecek@redhat.com> 0.5.14-1
+- Update to 0.5.14
+
+* Tue Aug 16 2016 Daniel Kopeček <dkopecek@redhat.com> 0.5.13-1
+- Update to 0.5.13
+
+* Sun Aug 14 2016 Daniel Kopeček <dkopecek@redhat.com> 0.5.12-1
+- Update to 0.5.12
+
+* Sat Aug 13 2016 Daniel Kopeček <dkopecek@redhat.com> 0.5.11-2
+- Update source tarball
+- Ship CHANGELOG.md
+
+* Sat Aug 13 2016 Daniel Kopeček <dkopecek@redhat.com> 0.5.11-1
+- Update to 0.5.11
+- Use libgcrypt instead of libsodium for crypto
+
+* Thu Jul 21 2016 Daniel Kopecek <dkopecek@redhat.com> 0.5.10-2
+- Adjust the default configuration to keep the authorization state
+  of present controller devices.
+
+* Sat Jul 09 2016 Daniel Kopecek <dkopecek@redhat.com> 0.5.10-1
+- Update to release 0.5.10
+
+* Mon Mar 07 2016 Remi Collet <remi@fedoraproject.org> - 0.4-5
+- rebuild for new libsodium soname
+
+* Sun Feb 07 2016 Daniel Kopecek <dkopecek@redhat.com> 0.4-4
+- Update to version 0.4
+- added usbguard CLI
+- added a tools subpackage with usbguard-rule-parser binary
+
+* Fri Feb 05 2016 Fedora Release Engineering <releng@fedoraproject.org> - 0.3p3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Fri Jun 19 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.3p3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue Apr 14 2015 Daniel Kopecek <dkopecek@redhat.com> 0.3p3-1
+- Update to version 0.3p3
+- added %%check section
+- removed explicit -devel requires on systemd, libqb and
+  libsodium devel files
+- added -devel requires on libstdc++-devel
+
+* Sat Apr 11 2015 Daniel Kopecek <dkopecek@redhat.com> 0.3p2-1
+- Update to version 0.3p2
+- use system-wide json and spdlog packages
+
+* Fri Apr 10 2015 Daniel Kopecek <dkopecek@redhat.com> 0.3p1-1
+- Update to version 0.3p1
+- removed bundled cppformat copylib
+
+* Thu Apr 09 2015 Daniel Kopecek <dkopecek@redhat.com> 0.3-1
+- Update to version 0.3
+- disabled silent rules
+- install license file
+- added man pages
+- use _hardened_build 1 instead of custom compilation flags
+- fix file permissions on files in /etc
+- do not install an empty rule set file
+
+* Fri Apr 03 2015 Daniel Kopecek <dkopecek@redhat.com> 0.2-1
+- Update to version 0.2
+- Updated description
+- Corrected package group
+
+* Tue Mar 17 2015 Daniel Kopecek <dkopecek@redhat.com> 0.1-1
+- Initial package