rpms/usbguard
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebase to 0.7.8

Browse Source 
- added rules.d
- rebased selinux subpackage

Resolves: rhbz#1836146
This commit is contained in:
Radovan Sroka 2020-05-20 14:36:57 +02:00
parent 7950a37486
commit bd6d626064
8 changed files with 34 additions and 209 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
.gitignore vendored
View File

@ -15,3 +15,6 @@
/usbguard-0.7.6.tar.gz
/usbguard-selinux-0.0.1.tar.gz
/usbguard-selinux-0.0.2.tar.gz
/usbguard-0.7.7.tar.gz
/usbguard-selinux-0.0.3.tar.gz
/usbguard-0.7.8.tar.gz

32
selinux.patch
View File

@ -1,32 +0,0 @@
diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te
--- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500
+++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500
@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules,
type usbguard_t;
type usbguard_exec_t;
init_daemon_domain(usbguard_t, usbguard_exec_t)
+init_nnp_daemon_domain(usbguard_t)
type usbguard_unit_file_t;
systemd_unit_file(usbguard_unit_file_t)
type usbguard_conf_t;
files_config_file(usbguard_conf_t)
+systemd_mount_dir(usbguard_conf_t)
type usbguard_log_t;
logging_log_file(usbguard_log_t)
+systemd_mount_dir(usbguard_log_t)
type usbguard_rules_t;
files_config_file(usbguard_rules_t)
@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar
files_pid_filetrans(usbguard_t, usbguard_var_run_t, file)
manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
-fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file)
+fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir })
+manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t)
allow usbguard_t usbguard_tmpfs_t:file map;
manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t)

4
sources
View File

@ -1,2 +1,2 @@
SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628
SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec
SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88
SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426

118
usbguard-0.7.6-libqb.patch
View File

@ -1,118 +0,0 @@
diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp
--- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100
+++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100
@@ -242,6 +242,22 @@ namespace usbguard
return stats->client_pid;
}
+ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid)
+ {
+ try {
+ std::string path = conn->description;
+ size_t last_slash = path.find_last_of("/");
+ path = path.substr(0, last_slash);
+ chown(path.c_str(), uid, gid);
+ }
+ catch (const std::exception& exception) {
+ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what();
+ }
+ catch (...) {
+ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits.";
+ }
+ }
+
int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid)
{
try {
@@ -259,6 +275,7 @@ namespace usbguard
<< " gid=" << 0
<< " mode=0660";
qb_ipcs_connection_auth_set(conn, uid, 0, 0660);
+ qbIPCConnectionAuthSet(conn, uid, 0);
return 0;
}
else {
diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp
--- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100
+++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100
@@ -39,6 +39,71 @@
#include <qb/qbipcs.h>
#include <qb/qbloop.h>
+
+/*libqb header starts*/
+ #define CONNECTION_DESCRIPTION NAME_MAX
+
+ enum qb_ipcs_connection_state {
+ QB_IPCS_CONNECTION_INACTIVE,
+ QB_IPCS_CONNECTION_ACTIVE,
+ QB_IPCS_CONNECTION_ESTABLISHED,
+ QB_IPCS_CONNECTION_SHUTTING_DOWN,
+ };
+
+ struct qb_ipcs_connection_auth {
+ uid_t uid;
+ gid_t gid;
+ mode_t mode;
+ };
+
+ struct qb_ringbuffer_s;
+ typedef struct qb_ringbuffer_s qb_ringbuffer_t;
+
+ struct qb_ipc_one_way {
+ size_t max_msg_size;
+ enum qb_ipc_type type;
+ union {
+ struct {
+ int32_t sock;
+ char *sock_name;
+ void* shared_data;
+ char shared_file_name[NAME_MAX];
+ } us;
+ struct {
+ qb_ringbuffer_t *rb;
+ } shm;
+ } u;
+ };
+
+ struct qb_list_head {
+ struct qb_list_head *next;
+ struct qb_list_head *prev;
+ };
+
+
+ struct qb_ipcs_connection {
+ enum qb_ipcs_connection_state state;
+ int32_t refcount;
+ pid_t pid;
+ uid_t euid;
+ gid_t egid;
+ struct qb_ipcs_connection_auth auth;
+ struct qb_ipc_one_way setup;
+ struct qb_ipc_one_way request;
+ struct qb_ipc_one_way response;
+ struct qb_ipc_one_way event;
+ struct qb_ipcs_service *service;
+ struct qb_list_head list;
+ struct qb_ipc_request_header *receive_buf;
+ void *context;
+ int32_t fc_enabled;
+ int32_t poll_events;
+ int32_t outstanding_notifiers;
+ char description[CONNECTION_DESCRIPTION];
+ struct qb_ipcs_connection_stats_2 stats;
+ };
+/*libqb header ends*/
+
namespace usbguard
{
class IPCServerPrivate
@@ -107,6 +172,8 @@ namespace usbguard
bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const;
bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const;
+ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid);
+
bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const;
bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const;
bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const;

12
usbguard-0.7.6-servicefile.patch
View File

@ -1,12 +0,0 @@
diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in
--- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100
+++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100
@@ -21,7 +21,7 @@ ProtectKernelModules=yes
ProtectSystem=yes
PIDFile=/run/usbguard.pid
ReadOnlyPaths=-/
-ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp
+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/
Restart=on-failure
RestrictAddressFamilies=AF_UNIX AF_NETLINK
RestrictNamespaces=yes

32
usbguard-0.7.6-sigwaitinfo.patch
View File

@ -1,32 +0,0 @@
diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp
--- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100
+++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100
@@ -507,8 +507,14 @@ namespace usbguard
const int signal_num = sigwaitinfo(&signal_set, &signal_info);
if (signal_num <= 0) {
- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down.";
- break;
+ if (errno == EINTR) {
+ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring.";
+ continue;
+ }
+ else {
+ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down.";
+ throw Exception("Daemon::run", "sigwaitinfo", "failed");
+ }
}
switch (signal_num) {
@@ -523,8 +529,11 @@ namespace usbguard
exit_loop = false;
break;
+
+ /* should not be reachable */
default:
USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!";
+ continue;
}
}
while (!exit_loop);

18
usbguard-daemon.conf
View File

@ -9,6 +9,19 @@
#
RuleFile=/etc/usbguard/rules.conf
#
# Rule set folder path.
#
# The USBGuard daemon will use this folder to load the policy
# rule set from it and to write new rules received via the
# IPC interface.
#
# RuleFolder=/path/to/rulesfolder/
#
RuleFolder=/etc/usbguard/rules.d/
#
# Implicit policy target.
#
@ -171,3 +184,8 @@ AuditBackend=FileAudit
#
AuditFilePath=/var/log/usbguard/usbguard-audit.log
#
# Hides personally identifiable information such as device serial numbers and
# hashes of descriptors (which include the serial number) from audit entries.
#
HidePII=false

24
usbguard.spec
View File

@ -1,10 +1,10 @@
%global selinuxtype targeted
%global moduletype contrib
%define semodule_version 0.0.2
%define semodule_version 0.0.3
Name: usbguard
Version: 0.7.6
Release: 8%{?dist}
Version: 0.7.8
Release: 1%{?dist}
Summary: A tool for implementing USB device usage policy
License: GPLv2+
## Not installed
@ -46,11 +46,6 @@ BuildRequires: polkit-devel
BuildRequires: libxslt
BuildRequires: libxml2
Patch1: usbguard-0.7.6-libqb.patch
Patch2: usbguard-0.7.6-sigwaitinfo.patch
Patch3: usbguard-0.7.6-servicefile.patch
Patch4: selinux.patch
%description
The USBGuard software framework helps to protect your computer against rogue USB
devices by implementing basic whitelisting/blacklisting capabilities based on
@ -109,11 +104,6 @@ daemon.
# Remove bundled library sources before build
rm -rf src/ThirdParty/{Catch,PEGTL}
%patch1 -p1 -b .libqb
%patch2 -p1 -b .sigwaitinfo
%patch3 -p1 -b .servicefile
%patch4 -p1 -b .selinux
%build
mkdir -p ./m4
autoreconf -i -v --no-recursive ./
@ -145,6 +135,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot}
# Overwrite configuration with distribution defaults
mkdir -p %{buildroot}%{_sysconfdir}/usbguard
mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d
mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d
install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf
@ -176,6 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';'
%{_bindir}/usbguard
%dir %{_localstatedir}/log/usbguard
%dir %{_sysconfdir}/usbguard
%dir %{_sysconfdir}/usbguard/rules.d/
%dir %{_sysconfdir}/usbguard/IPCAccessControl.d
%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf
%config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf
@ -231,6 +223,12 @@ fi
%changelog
* Tue May 19 2020 Radovan Sroka <rsroka@redhat.com> - 0.7.8-1
- rebase usbguard to 0.7.8
- rebase usbguard-selinux to 0.0.3
- added rules.d/ directory
Resolves: rhbz#1808527
* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 0.7.6-8
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild