diff --git a/.gitignore b/.gitignore index 1783a9f..0e1053c 100644 --- a/.gitignore +++ b/.gitignore @@ -15,3 +15,6 @@ /usbguard-0.7.6.tar.gz /usbguard-selinux-0.0.1.tar.gz /usbguard-selinux-0.0.2.tar.gz +/usbguard-0.7.7.tar.gz +/usbguard-selinux-0.0.3.tar.gz +/usbguard-0.7.8.tar.gz diff --git a/selinux.patch b/selinux.patch deleted file mode 100644 index 945878b..0000000 --- a/selinux.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up ./usbguard-selinux-0.0.2/usbguard.te.selinux ./usbguard-selinux-0.0.2/usbguard.te ---- ./usbguard-selinux-0.0.2/usbguard.te.selinux 2019-11-13 07:08:17.000000000 -0500 -+++ ./usbguard-selinux-0.0.2/usbguard.te 2019-12-18 11:21:36.725889798 -0500 -@@ -41,15 +41,18 @@ gen_tunable(usbguard_daemon_write_rules, - type usbguard_t; - type usbguard_exec_t; - init_daemon_domain(usbguard_t, usbguard_exec_t) -+init_nnp_daemon_domain(usbguard_t) - - type usbguard_unit_file_t; - systemd_unit_file(usbguard_unit_file_t) - - type usbguard_conf_t; - files_config_file(usbguard_conf_t) -+systemd_mount_dir(usbguard_conf_t) - - type usbguard_log_t; - logging_log_file(usbguard_log_t) -+systemd_mount_dir(usbguard_log_t) - - type usbguard_rules_t; - files_config_file(usbguard_rules_t) -@@ -84,7 +87,8 @@ manage_files_pattern(usbguard_t, usbguar - files_pid_filetrans(usbguard_t, usbguard_var_run_t, file) - - manage_files_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) --fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, file) -+fs_tmpfs_filetrans(usbguard_t, usbguard_tmpfs_t, { file dir }) -+manage_dirs_pattern(usbguard_t, usbguard_tmpfs_t, usbguard_tmpfs_t) - allow usbguard_t usbguard_tmpfs_t:file map; - - manage_files_pattern(usbguard_t, usbguard_log_t, usbguard_log_t) diff --git a/sources b/sources index a2586cd..a8275fa 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (usbguard-0.7.6.tar.gz) = 0b0d42276e48baac2dc1f9031eec25e3f622a8d6178cb0400b97c7d32005bfa158b60fd286fdc66206a8684658fefaf6389ef93511e942f025e75671d7455628 -SHA512 (usbguard-selinux-0.0.2.tar.gz) = b0e88b8c7022c2fd8874af5f5c70342e9c27093f15c56a058e24c6515775d4de3d347a7a6d3b32e20fba6be347439ae7438176c9e1ceebf06a5f372697a2aeec +SHA512 (usbguard-0.7.8.tar.gz) = 315c25ed7eb61cc0920047836dcca035cb07aecb6dfece9e4f6dc2ad61aaf6fdbf86898e43493958f3d12a146eb4c8f88b90bb246da0df83bb2097ce5b853e88 +SHA512 (usbguard-selinux-0.0.3.tar.gz) = 61e4e969d44061182b286e1483409a606ecf2a3da08acf8ddd2b9af0d2143f61ff12f7a1b915e49232dd80d6c19efbdcdc43aff5b1f01e571f6abb7f8a826426 diff --git a/usbguard-0.7.6-libqb.patch b/usbguard-0.7.6-libqb.patch deleted file mode 100644 index 44b5f8d..0000000 --- a/usbguard-0.7.6-libqb.patch +++ /dev/null @@ -1,118 +0,0 @@ -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.cpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.cpp.orig 2019-11-25 12:11:49.632373175 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.cpp 2019-11-25 12:12:42.361781652 +0100 -@@ -242,6 +242,22 @@ namespace usbguard - return stats->client_pid; - } - -+ void IPCServerPrivate::qbIPCConnectionAuthSet(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) -+ { -+ try { -+ std::string path = conn->description; -+ size_t last_slash = path.find_last_of("/"); -+ path = path.substr(0, last_slash); -+ chown(path.c_str(), uid, gid); -+ } -+ catch (const std::exception& exception) { -+ USBGUARD_LOG(Error) << "IPC connection chmod error. Exception: " << exception.what(); -+ } -+ catch (...) { -+ USBGUARD_LOG(Error) << "IPC connection error. Could not change mode bits."; -+ } -+ } -+ - int32_t IPCServerPrivate::qbIPCConnectionAcceptFn(qb_ipcs_connection_t* conn, uid_t uid, gid_t gid) - { - try { -@@ -259,6 +275,7 @@ namespace usbguard - << " gid=" << 0 - << " mode=0660"; - qb_ipcs_connection_auth_set(conn, uid, 0, 0660); -+ qbIPCConnectionAuthSet(conn, uid, 0); - return 0; - } - else { -diff -up usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig usbguard-0.7.6/src/Library/IPCServerPrivate.hpp ---- usbguard-0.7.6/src/Library/IPCServerPrivate.hpp.orig 2019-11-25 12:11:27.723203531 +0100 -+++ usbguard-0.7.6/src/Library/IPCServerPrivate.hpp 2019-11-25 12:13:04.635954202 +0100 -@@ -39,6 +39,71 @@ - #include - #include - -+ -+/*libqb header starts*/ -+ #define CONNECTION_DESCRIPTION NAME_MAX -+ -+ enum qb_ipcs_connection_state { -+ QB_IPCS_CONNECTION_INACTIVE, -+ QB_IPCS_CONNECTION_ACTIVE, -+ QB_IPCS_CONNECTION_ESTABLISHED, -+ QB_IPCS_CONNECTION_SHUTTING_DOWN, -+ }; -+ -+ struct qb_ipcs_connection_auth { -+ uid_t uid; -+ gid_t gid; -+ mode_t mode; -+ }; -+ -+ struct qb_ringbuffer_s; -+ typedef struct qb_ringbuffer_s qb_ringbuffer_t; -+ -+ struct qb_ipc_one_way { -+ size_t max_msg_size; -+ enum qb_ipc_type type; -+ union { -+ struct { -+ int32_t sock; -+ char *sock_name; -+ void* shared_data; -+ char shared_file_name[NAME_MAX]; -+ } us; -+ struct { -+ qb_ringbuffer_t *rb; -+ } shm; -+ } u; -+ }; -+ -+ struct qb_list_head { -+ struct qb_list_head *next; -+ struct qb_list_head *prev; -+ }; -+ -+ -+ struct qb_ipcs_connection { -+ enum qb_ipcs_connection_state state; -+ int32_t refcount; -+ pid_t pid; -+ uid_t euid; -+ gid_t egid; -+ struct qb_ipcs_connection_auth auth; -+ struct qb_ipc_one_way setup; -+ struct qb_ipc_one_way request; -+ struct qb_ipc_one_way response; -+ struct qb_ipc_one_way event; -+ struct qb_ipcs_service *service; -+ struct qb_list_head list; -+ struct qb_ipc_request_header *receive_buf; -+ void *context; -+ int32_t fc_enabled; -+ int32_t poll_events; -+ int32_t outstanding_notifiers; -+ char description[CONNECTION_DESCRIPTION]; -+ struct qb_ipcs_connection_stats_2 stats; -+ }; -+/*libqb header ends*/ -+ - namespace usbguard - { - class IPCServerPrivate -@@ -107,6 +172,8 @@ namespace usbguard - bool qbIPCConnectionAllowed(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool authenticateIPCConnectionDAC(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr = nullptr) const; - -+ static void qbIPCConnectionAuthSet(qb_ipcs_connection_t* connection, uid_t uid, gid_t gid); -+ - bool matchACLByUID(uid_t uid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByGID(gid_t gid, IPCServer::AccessControl* const ac_ptr) const; - bool matchACLByName(uid_t uid, gid_t gid, IPCServer::AccessControl* const ac_ptr) const; diff --git a/usbguard-0.7.6-servicefile.patch b/usbguard-0.7.6-servicefile.patch deleted file mode 100644 index 63c462c..0000000 --- a/usbguard-0.7.6-servicefile.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up usbguard-0.7.6/usbguard.service.in.orig usbguard-0.7.6/usbguard.service.in ---- usbguard-0.7.6/usbguard.service.in.orig 2019-11-25 17:02:34.518355971 +0100 -+++ usbguard-0.7.6/usbguard.service.in 2019-11-25 17:04:38.753066258 +0100 -@@ -21,7 +21,7 @@ ProtectKernelModules=yes - ProtectSystem=yes - PIDFile=/run/usbguard.pid - ReadOnlyPaths=-/ --ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -+ReadWritePaths=-/dev/shm -%localstatedir%/log/usbguard -/tmp -%sysconfdir%/usbguard/ - Restart=on-failure - RestrictAddressFamilies=AF_UNIX AF_NETLINK - RestrictNamespaces=yes diff --git a/usbguard-0.7.6-sigwaitinfo.patch b/usbguard-0.7.6-sigwaitinfo.patch deleted file mode 100644 index daf8aae..0000000 --- a/usbguard-0.7.6-sigwaitinfo.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff -up usbguard-0.7.6/src/Daemon/Daemon.cpp.orig usbguard-0.7.6/src/Daemon/Daemon.cpp ---- usbguard-0.7.6/src/Daemon/Daemon.cpp.orig 2019-11-25 15:45:50.869913293 +0100 -+++ usbguard-0.7.6/src/Daemon/Daemon.cpp 2019-11-25 15:47:37.722735108 +0100 -@@ -507,8 +507,14 @@ namespace usbguard - const int signal_num = sigwaitinfo(&signal_set, &signal_info); - - if (signal_num <= 0) { -- USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -- break; -+ if (errno == EINTR) { -+ USBGUARD_LOG(Info) << "sigwaitinfo interrupted: [EINTR]. Ignoring."; -+ continue; -+ } -+ else { -+ USBGUARD_LOG(Error) << "sigwaitinfo failed: errno=" << errno << "; Shutting down."; -+ throw Exception("Daemon::run", "sigwaitinfo", "failed"); -+ } - } - - switch (signal_num) { -@@ -523,8 +529,11 @@ namespace usbguard - exit_loop = false; - break; - -+ -+ /* should not be reachable */ - default: - USBGUARD_LOG(Warning) << "Received signal " << signal_num << ". Ignoring!"; -+ continue; - } - } - while (!exit_loop); diff --git a/usbguard-daemon.conf b/usbguard-daemon.conf index e9800b2..d8806a1 100644 --- a/usbguard-daemon.conf +++ b/usbguard-daemon.conf @@ -9,6 +9,19 @@ # RuleFile=/etc/usbguard/rules.conf +# +# Rule set folder path. +# +# The USBGuard daemon will use this folder to load the policy +# rule set from it and to write new rules received via the +# IPC interface. +# +# RuleFolder=/path/to/rulesfolder/ +# + +RuleFolder=/etc/usbguard/rules.d/ + + # # Implicit policy target. # @@ -171,3 +184,8 @@ AuditBackend=FileAudit # AuditFilePath=/var/log/usbguard/usbguard-audit.log +# +# Hides personally identifiable information such as device serial numbers and +# hashes of descriptors (which include the serial number) from audit entries. +# +HidePII=false diff --git a/usbguard.spec b/usbguard.spec index 8ef93ef..1189ed8 100644 --- a/usbguard.spec +++ b/usbguard.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype contrib -%define semodule_version 0.0.2 +%define semodule_version 0.0.3 Name: usbguard -Version: 0.7.6 -Release: 8%{?dist} +Version: 0.7.8 +Release: 1%{?dist} Summary: A tool for implementing USB device usage policy License: GPLv2+ ## Not installed @@ -46,11 +46,6 @@ BuildRequires: polkit-devel BuildRequires: libxslt BuildRequires: libxml2 -Patch1: usbguard-0.7.6-libqb.patch -Patch2: usbguard-0.7.6-sigwaitinfo.patch -Patch3: usbguard-0.7.6-servicefile.patch -Patch4: selinux.patch - %description The USBGuard software framework helps to protect your computer against rogue USB devices by implementing basic whitelisting/blacklisting capabilities based on @@ -109,11 +104,6 @@ daemon. # Remove bundled library sources before build rm -rf src/ThirdParty/{Catch,PEGTL} -%patch1 -p1 -b .libqb -%patch2 -p1 -b .sigwaitinfo -%patch3 -p1 -b .servicefile -%patch4 -p1 -b .selinux - %build mkdir -p ./m4 autoreconf -i -v --no-recursive ./ @@ -145,6 +135,7 @@ make install INSTALL='install -p' DESTDIR=%{buildroot} # Overwrite configuration with distribution defaults mkdir -p %{buildroot}%{_sysconfdir}/usbguard +mkdir -p %{buildroot}%{_sysconfdir}/usbguard/rules.d mkdir -p %{buildroot}%{_sysconfdir}/usbguard/IPCAccessControl.d install -p -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/usbguard/usbguard-daemon.conf @@ -176,6 +167,7 @@ find %{buildroot} \( -name '*.la' -o -name '*.a' \) -exec rm -f {} ';' %{_bindir}/usbguard %dir %{_localstatedir}/log/usbguard %dir %{_sysconfdir}/usbguard +%dir %{_sysconfdir}/usbguard/rules.d/ %dir %{_sysconfdir}/usbguard/IPCAccessControl.d %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/usbguard-daemon.conf %config(noreplace) %attr(0600,-,-) %{_sysconfdir}/usbguard/rules.conf @@ -231,6 +223,12 @@ fi %changelog +* Tue May 19 2020 Radovan Sroka - 0.7.8-1 +- rebase usbguard to 0.7.8 +- rebase usbguard-selinux to 0.0.3 +- added rules.d/ directory +Resolves: rhbz#1808527 + * Fri Jan 31 2020 Fedora Release Engineering - 0.7.6-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild