diff --git a/usbguard-ipc-override-fix.patch b/usbguard-ipc-override-fix.patch new file mode 100644 index 0000000..61a54c7 --- /dev/null +++ b/usbguard-ipc-override-fix.patch @@ -0,0 +1,20 @@ +diff --color -ru a/src/Library/IPCServerPrivate.cpp b/src/Library/IPCServerPrivate.cpp +--- a/src/Library/IPCServerPrivate.cpp 2020-11-23 15:56:12.979847655 +0100 ++++ b/src/Library/IPCServerPrivate.cpp 2021-10-14 12:33:12.462503822 +0200 +@@ -567,10 +567,12 @@ + bool IPCServerPrivate::authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const + { + USBGUARD_LOG(Trace) << "uid=" << uid << " gid=" << gid << " ac_ptr=" << ac_ptr; +- return \ +- matchACLByUID(uid, ac_ptr) || \ +- matchACLByGID(gid, ac_ptr) || \ +- matchACLByName(uid, gid, ac_ptr); ++ ++ bool matched_uid = matchACLByUID(uid, ac_ptr); ++ bool matched_gid = matchACLByGID(gid, ac_ptr); ++ bool matched_name = matchACLByName(uid, gid, ac_ptr); ++ ++ return matched_uid || matched_gid || matched_name; + } + + bool IPCServerPrivate::matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const diff --git a/usbguard-notifier-decrease-spam.patch b/usbguard-notifier-decrease-spam.patch new file mode 100644 index 0000000..5173805 --- /dev/null +++ b/usbguard-notifier-decrease-spam.patch @@ -0,0 +1,182 @@ +diff --color -ru a/usbguard-notifier-0.0.6/man/usbguard-notifier.1 b/usbguard-notifier-0.0.6/man/usbguard-notifier.1 +--- a/usbguard-notifier-0.0.6/man/usbguard-notifier.1 2021-10-14 12:44:57.816146101 +0200 ++++ b/usbguard-notifier-0.0.6/man/usbguard-notifier.1 2021-10-14 12:46:14.442519466 +0200 +@@ -39,7 +39,12 @@ + .PP + \fB\-w, \-\-wait\fR + .RS 4 +-Wait until an active IPC connection is estabilished\&. ++Wait until an active IPC connection is estabilished\&. ie\&. infinite number of attempts\&. ++.RE ++.PP ++\fB\-n, \-\-num\-attempts\fR \fInum\fR ++.RS 4 ++Number of IPC connection attempts. Window between each attempt is 1 second\&. The default number of attempts is 3\&. + .RE + .PP + \fB\-d, \-\-debug\fR +@@ -51,6 +56,64 @@ + .RS 4 + Show help\&. + .RE ++.SH "HOW TO START" ++.sp ++In order to make usbguard\-notifier work properly, you will need to perform certain actions: ++.sp ++.RS 4 ++.ie n \{\ ++\h'-04' 1.\h'+01'\c ++.\} ++.el \{\ ++.sp -1 ++.IP " 1." 4.2 ++.\} ++Each user who wants to run usbguard\-notifier service needs to have sufficient IPC privileges to connect to the usbguard IPC interface\&. To allow a specific user to listen to the device signals you can use the following command: ++ ++ ++\fB$ sudo usbguard add\-user\fR ++\fIUSER\fR ++\fB\-d listen\fR ++ ++Or you can allow a group of users: ++ ++ ++\fB$ sudo usbguard add\-user \-g\fR ++\fIGROUP\fR ++\fB\-d listen\fR ++.RE ++.sp ++.RS 4 ++.ie n \{\ ++\h'-04' 2.\h'+01'\c ++.\} ++.el \{\ ++.sp -1 ++.IP " 2." 4.2 ++.\} ++Now, you need a running usbguard\-daemon instance to connect to\&. Start the usbguard service or restart it if it is already running\&. ++.RE ++.sp ++.RS 4 ++.ie n \{\ ++\h'-04' 3.\h'+01'\c ++.\} ++.el \{\ ++.sp -1 ++.IP " 3." 4.2 ++.\} ++After configuring IPC privileges and starting up the usbguard\-daemon, the user can now start the usbguard\-notifier service: ++ ++ ++\fB$ systemctl start \-\-user usbguard\-notifier\&.service\fR ++ ++Optionally, the user can enable the usbguard\-notifier service to start automatically after the login: ++ ++ ++\fB$ systemctl enable \-\-user usbguard\-notifier\&.service\fR ++.RE ++.sp ++The usbguard\-notifier should now be running\&. Anytime a USB device gets inserted/ejected or allowed/blocked a message will pop up in the user\(cqs graphical interface\&. + .SH "SEE ALSO" + .sp + usbguard(1) +diff --color -ru a/usbguard-notifier-0.0.6/src/Main.cpp b/usbguard-notifier-0.0.6/src/Main.cpp +--- a/usbguard-notifier-0.0.6/src/Main.cpp 2020-03-04 08:59:49.138771474 +0100 ++++ b/usbguard-notifier-0.0.6/src/Main.cpp 2021-10-14 12:46:14.443519484 +0200 +@@ -20,6 +20,7 @@ + #include "Log.hpp" + #include "Notifier.hpp" + ++#include + #include + #include + #include +@@ -27,10 +28,11 @@ + + #include + +-static const char* short_options = "wdh"; ++static const char* short_options = "wn:dh"; + + static const struct ::option long_options[] = { + { "wait", no_argument, nullptr, 'w' }, ++ { "num-attempts", required_argument, nullptr, 'n' }, + { "debug", no_argument, nullptr, 'd' }, + { "help", no_argument, nullptr, 'h' } + }; +@@ -40,22 +42,26 @@ + out << "Usage: " << app_name << " [OPTIONS]" << std::endl; + out << std::endl; + out << "Options:" << std::endl; +- out << " -w, --wait Wait until an active IPC connection is estabilished." << std::endl; +- out << " -d, --debug Enable debug mode." << std::endl; +- out << " -h, --help Show this usage message." << std::endl; ++ out << " -w, --wait Wait until an active IPC connection is estabilished." << std::endl; ++ out << " -n, --num-attempts Number of IPC connection attempts." << std::endl; ++ out << " -d, --debug Enable debug mode." << std::endl; ++ out << " -h, --help Show this usage message." << std::endl; + } + + int main(int argc, char** argv) + { + const std::string app_name(::basename(*argv)); + bool wait_connection = false, debug = false; +- int opt; ++ int opt, num_attempts = 3; + + while ((opt = getopt_long(argc, argv, short_options, long_options, nullptr)) != -1) { + switch (opt) { + case 'w': + wait_connection = true; + break; ++ case 'n': ++ num_attempts = std::atoi(optarg); ++ break; + case 'd': + debug = true; + break; +@@ -71,23 +77,26 @@ + } + NOTIFIER_LOGGER.setDebugMode(debug); + +- for (;;) { ++ bool print_err = true; ++ for (int i = 0; wait_connection || i < num_attempts; ++i) { + try { + usbguardNotifier::Notifier notifier(app_name); + notifier.connect(); + std::cout << "Connection has been established" << std::endl; ++ print_err = true; ++ i = 0; + notifier.wait(); + } catch (const std::runtime_error& e) { + std::cerr << "Error:" << e.what() << std::endl; + return EXIT_FAILURE; + } catch (const usbguard::Exception& e) { +- std::cerr << "IPC connection failure!" << e.message() << std::endl; +- std::cerr << "Check if usbguard-daemon is running in the background" << std::endl; +- if (!wait_connection) { +- break; ++ if (print_err) { ++ print_err = false; ++ std::cerr << "IPC connection failure!" << e.message() << std::endl; ++ std::cerr << "Check if usbguard-daemon is running in the background" << std::endl; + } +- sleep(1); + } ++ sleep(1); + } + return EXIT_SUCCESS; + } +diff --color -ru a/usbguard-notifier-0.0.6/usbguard-notifier.service.in b/usbguard-notifier-0.0.6/usbguard-notifier.service.in +--- a/usbguard-notifier-0.0.6/usbguard-notifier.service.in 2020-03-04 09:00:32.019254871 +0100 ++++ b/usbguard-notifier-0.0.6/usbguard-notifier.service.in 2021-10-14 12:46:14.444519502 +0200 +@@ -3,7 +3,7 @@ + After=usbguard.service + + [Service] +-ExecStart=%bindir%/usbguard-notifier -w ++ExecStart=%bindir%/usbguard-notifier + + [Install] + WantedBy=default.target diff --git a/usbguard-validate-acl.patch b/usbguard-validate-acl.patch new file mode 100644 index 0000000..8625a86 --- /dev/null +++ b/usbguard-validate-acl.patch @@ -0,0 +1,105 @@ +diff --color -ru a/doc/man/usbguard.1.adoc b/doc/man/usbguard.1.adoc +--- a/doc/man/usbguard.1.adoc 2020-11-23 15:56:12.977847682 +0100 ++++ b/doc/man/usbguard.1.adoc 2021-10-14 12:39:11.949947187 +0200 +@@ -282,6 +282,7 @@ + .... + + Consult the usbguard-daemon.conf(5) man-page for a detailed list of available privileges in each section. ++You can also use 'ALL' instead of 'privileges' to automatically assign all relevant privileges to a given section. + + + === *remove-user* 'name' ['OPTIONS'] +diff --color -ru a/doc/man/usbguard-daemon.conf.5.adoc b/doc/man/usbguard-daemon.conf.5.adoc +--- a/doc/man/usbguard-daemon.conf.5.adoc 2020-11-23 15:56:12.977847682 +0100 ++++ b/doc/man/usbguard-daemon.conf.5.adoc 2021-10-14 12:39:11.953947259 +0200 +@@ -162,6 +162,8 @@ + + ** list: Get values of run-time parameters. + ++ ** listen: Listen to property parameter changes. ++ + The following is a generally usable and reasonably safe example of an access control file. + It allows one to modify USB device authorization state (`Devices=modify`), list USB devices (`Devices=list`), listen to USB device related events (`Devices=listen`), list USB authorization policy rules (`Policy=list`) and listen to exception events (`Exceptions=listen`): + +diff --color -ru a/src/Library/public/usbguard/IPCServer.cpp b/src/Library/public/usbguard/IPCServer.cpp +--- a/src/Library/public/usbguard/IPCServer.cpp 2020-11-23 15:56:12.979847655 +0100 ++++ b/src/Library/public/usbguard/IPCServer.cpp 2021-10-14 12:39:11.954947277 +0200 +@@ -159,18 +159,25 @@ + throw USBGUARD_BUG("Cannot set privileges for NONE section"); + } + ++ const uint8_t p = static_cast(privilege); ++ + if (section == Section::ALL) { +- for (const auto& value : { ++ for (const auto& s : { + Section::POLICY, + Section::PARAMETERS, + Section::EXCEPTIONS, + Section::DEVICES + }) { +- _access_control[value] |= static_cast(privilege); ++ _access_control[s] |= p & ~ac_mask(s); + } + } + else { +- _access_control[section] |= static_cast(privilege); ++ if (privilege != Privilege::ALL && (p & ac_mask(section))) { ++ throw std::runtime_error("Invalid privilege " + ++ privilegeToString(privilege) + " for section " + ++ sectionToString(section)); ++ } ++ _access_control[section] |= p & ~ac_mask(section); + } + } + +@@ -254,6 +261,28 @@ + merge(access_control); + } + ++ uint8_t IPCServer::AccessControl::ac_mask(IPCServer::AccessControl::Section section) const ++ { ++ const uint8_t MODIFY = static_cast(Privilege::MODIFY); ++ const uint8_t LIST = static_cast(Privilege::LIST); ++ const uint8_t LISTEN = static_cast(Privilege::LISTEN); ++ ++ switch (section) { ++ case Section::DEVICES: ++ return ~(MODIFY | LIST | LISTEN); ++ case Section::POLICY: ++ return ~(MODIFY | LIST); ++ case Section::EXCEPTIONS: ++ return ~(LISTEN); ++ case Section::PARAMETERS: ++ return ~(MODIFY | LIST | LISTEN); ++ case Section::ALL: ++ case Section::NONE: ++ default: ++ return 0xff; ++ } ++ } ++ + IPCServer::IPCServer() + : d_pointer(usbguard::make_unique(*this)) + { +diff --color -ru a/src/Library/public/usbguard/IPCServer.hpp b/src/Library/public/usbguard/IPCServer.hpp +--- a/src/Library/public/usbguard/IPCServer.hpp 2020-10-11 17:43:43.519295669 +0200 ++++ b/src/Library/public/usbguard/IPCServer.hpp 2021-10-14 12:39:11.955947295 +0200 +@@ -278,6 +278,17 @@ + }; + + /** ++ * @brief Get a privilege mask for given section ++ * ++ * For example, if the section is POLICY that has privileges MODIFY ++ * and LIST, the mask would be ~(MODIFY | LIST) ++ * ++ * @param section Section for which the privilege mask should be returned ++ * @return Privilege mask for section ++ */ ++ uint8_t ac_mask(Section section) const; ++ ++ /** + * @brief Access control represented by unordered map of + * tuples (Section, 8b privileges). + * diff --git a/usbguard.spec b/usbguard.spec index 0390614..002faaa 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -8,7 +8,7 @@ Name: usbguard Version: 1.0.0 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A tool for implementing USB device usage policy Group: System Environment/Daemons License: GPLv2+ @@ -54,6 +54,9 @@ Patch1: usbguard-0.7.6-notifier.patch Patch2: usbguard-audit-capability.patch Patch3: usbguard-selinux-audit-capability.patch Patch4: usbguard-service-pidfile.patch +Patch5: usbguard-ipc-override-fix.patch +Patch6: usbguard-validate-acl.patch +Patch7: usbguard-notifier-decrease-spam.patch %description The USBGuard software framework helps to protect your computer against rogue USB @@ -134,6 +137,9 @@ rm -rf src/ThirdParty/{Catch,PEGTL} %patch2 -p1 -b .audit-write %patch3 -p1 -b .selinux-audit-write %patch4 -p1 -b .pidfile +%patch5 -p1 -b .ipc-override-fix +%patch6 -p1 -b .validate-acl +%patch7 -p1 -b .notifier-decrease-spam %build mkdir -p ./m4 @@ -265,7 +271,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %files selinux %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2 -%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} +%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name} %{_datadir}/selinux/devel/include/%{moduletype}/ipp-%{name}.if %post selinux @@ -288,7 +294,7 @@ fi %{_userunitdir}/%{name}-notifier.service %post notifier -%systemd_user_post %{name}-notifier.service +%systemd_user_post \--preset-mode=disable-only %{name}-notifier.service %preun notifier %systemd_user_preun %{name}-notifier.service @@ -298,6 +304,16 @@ fi %changelog +* Thu Oct 14 2021 Zoltan Fridrich - 1.0.0-9 +- fix DSP module definition in spec file +Resolves: rhbz#2014442 +- fix IPC access control files override +Resolves: rhbz#2009227 +- validate ACL permission existence +Resolves: rhbz#2009229 +- decrease usbguard-notifier spam when denied connection +Resolves: rhbz#2009226 + * Tue Aug 10 2021 Mohan Boddu - 1.0.0-8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688