MSVSphere Packaging Team
2 years ago
parent
93c26f23d8
commit
1e01f81b19
@ -0,0 +1,11 @@
|
|||||||
|
diff -up usbguard-1.0.0/usbguard.service.in.orig usbguard-1.0.0/usbguard.service.in
|
||||||
|
--- usbguard-1.0.0/usbguard.service.in.orig 2022-11-28 10:21:35.889977314 +0100
|
||||||
|
+++ usbguard-1.0.0/usbguard.service.in 2022-11-28 10:21:52.711987716 +0100
|
||||||
|
@@ -4,6 +4,7 @@ Wants=systemd-udevd.service local-fs.tar
|
||||||
|
Documentation=man:usbguard-daemon(8)
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
+OOMScoreAdjust=-1000
|
||||||
|
AmbientCapabilities=
|
||||||
|
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE
|
||||||
|
DevicePolicy=closed
|
||||||
@ -0,0 +1,12 @@
|
|||||||
|
diff -up usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp.orig usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp
|
||||||
|
--- usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp.orig 2022-11-28 10:35:44.052560664 +0100
|
||||||
|
+++ usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp 2022-11-28 10:35:55.510568939 +0100
|
||||||
|
@@ -76,7 +76,7 @@ namespace usbguard
|
||||||
|
}
|
||||||
|
|
||||||
|
if (ruleSet.empty()){
|
||||||
|
- USBGUARD_LOG(Warning) << "RuleFile not set; Modification of the permanent policy won't be possible.";
|
||||||
|
+ USBGUARD_LOG(Warning) << "Neither RuleFile nor RuleFolder are set; Modification of the permanent policy won't be possible.";
|
||||||
|
ruleSet = generateDefaultRuleSet();
|
||||||
|
}
|
||||||
|
|
||||||
@ -0,0 +1,19 @@
|
|||||||
|
diff -up usbguard-1.0.0/src/Daemon/Daemon.cpp.orig usbguard-1.0.0/src/Daemon/Daemon.cpp
|
||||||
|
--- usbguard-1.0.0/src/Daemon/Daemon.cpp.orig 2022-11-28 10:25:01.044104150 +0100
|
||||||
|
+++ usbguard-1.0.0/src/Daemon/Daemon.cpp 2022-11-28 10:25:34.736124980 +0100
|
||||||
|
@@ -40,6 +40,7 @@
|
||||||
|
#include <sys/types.h>
|
||||||
|
#include <sys/poll.h>
|
||||||
|
#include <unistd.h>
|
||||||
|
+#include <sys/wait.h>
|
||||||
|
#include <signal.h>
|
||||||
|
#include <string.h>
|
||||||
|
#include <sys/stat.h>
|
||||||
|
@@ -606,6 +607,7 @@ namespace usbguard
|
||||||
|
const int signum = sigtimedwait(&mask, &info, &timeout);
|
||||||
|
|
||||||
|
if (signum == SIGUSR1 && info.si_signo == SIGUSR1 && info.si_pid == pid) {
|
||||||
|
+ waitpid(pid, nullptr, 0);
|
||||||
|
USBGUARD_LOG(Trace) << "Finished daemonization";
|
||||||
|
exit(EXIT_SUCCESS);
|
||||||
|
}
|
||||||
@ -0,0 +1,12 @@
|
|||||||
|
diff -up usbguard-1.0.0/usbguard.service.in.orig usbguard-1.0.0/usbguard.service.in
|
||||||
|
--- usbguard-1.0.0/usbguard.service.in.orig 2023-01-12 13:22:23.032554498 +0100
|
||||||
|
+++ usbguard-1.0.0/usbguard.service.in 2023-01-12 13:22:33.082568210 +0100
|
||||||
|
@@ -8,7 +8,7 @@ OOMScoreAdjust=-1000
|
||||||
|
AmbientCapabilities=
|
||||||
|
CapabilityBoundingSet=CAP_CHOWN CAP_FOWNER CAP_AUDIT_WRITE
|
||||||
|
DevicePolicy=closed
|
||||||
|
-ExecStart=%sbindir%/usbguard-daemon -f -s -c %sysconfdir%/usbguard/usbguard-daemon.conf
|
||||||
|
+ExecStart=%sbindir%/usbguard-daemon -f -s -K -c %sysconfdir%/usbguard/usbguard-daemon.conf
|
||||||
|
IPAddressDeny=any
|
||||||
|
LockPersonality=yes
|
||||||
|
MemoryDenyWriteExecute=yes
|
||||||
@ -0,0 +1,43 @@
|
|||||||
|
diff -up usbguard-1.0.0/doc/man/example-allow-device.adoc.orig usbguard-1.0.0/doc/man/example-allow-device.adoc
|
||||||
|
--- usbguard-1.0.0/doc/man/example-allow-device.adoc.orig 2022-11-28 12:00:26.695561514 +0100
|
||||||
|
+++ usbguard-1.0.0/doc/man/example-allow-device.adoc 2022-11-28 11:57:01.120457773 +0100
|
||||||
|
@@ -0,0 +1,6 @@
|
||||||
|
+....
|
||||||
|
+ # Allow a device by ID(it is the very first number from the list-devices command output)
|
||||||
|
+ $ sudo usbguard allow-device 10
|
||||||
|
+ # Allow all devices named "Dell Wired Multimedia Keyboard"
|
||||||
|
+ $ sudo usbguard allow-device name \"Dell Wired Multimedia Keyboard\"
|
||||||
|
+....
|
||||||
|
diff -up usbguard-1.0.0/doc/man/example-initial-policy.adoc.orig usbguard-1.0.0/doc/man/example-initial-policy.adoc
|
||||||
|
--- usbguard-1.0.0/doc/man/example-initial-policy.adoc.orig 2022-11-28 12:00:31.781564080 +0100
|
||||||
|
+++ usbguard-1.0.0/doc/man/example-initial-policy.adoc 2022-11-28 11:57:25.353470002 +0100
|
||||||
|
@@ -0,0 +1,7 @@
|
||||||
|
+....
|
||||||
|
+ $ sudo usbguard generate-policy > rules.conf
|
||||||
|
+ $ vi rules.conf
|
||||||
|
+ (review/modify the rule set)
|
||||||
|
+ $ sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
|
||||||
|
+ $ sudo systemctl restart usbguard
|
||||||
|
+....
|
||||||
|
diff -up usbguard-1.0.0/doc/man/footer.adoc.orig usbguard-1.0.0/doc/man/footer.adoc
|
||||||
|
--- usbguard-1.0.0/doc/man/footer.adoc.orig 2022-11-28 11:54:21.495377220 +0100
|
||||||
|
+++ usbguard-1.0.0/doc/man/footer.adoc 2022-11-28 11:55:51.960422872 +0100
|
||||||
|
@@ -0,0 +1,18 @@
|
||||||
|
+== BUGS
|
||||||
|
+If you find a bug in this software or if you'd like to request a feature to be implemented, please file a ticket at <https://github.com/USBGuard/usbguard/issues/new>.
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+== AUTHOR
|
||||||
|
+USBGuard was originally written by Daniel Kopeček.
|
||||||
|
+Many people have contributed to it.
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+== RESOURCES
|
||||||
|
+Main web site: <https://usbguard.github.io/>
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+== COPYING
|
||||||
|
+Copyright © 2015-{docyear} Red Hat, Inc. +
|
||||||
|
+License GPLv2+: GNU GPL version 2 or later http://gnu.org/licenses/gpl.html. +
|
||||||
|
+This is free software: you are free to change and redistribute it.
|
||||||
|
+There is NO WARRANTY, to the extent permitted by law.
|
||||||
@ -0,0 +1,68 @@
|
|||||||
|
diff -up usbguard-1.0.0/doc/man/usbguard-daemon.conf.5.adoc.orig usbguard-1.0.0/doc/man/usbguard-daemon.conf.5.adoc
|
||||||
|
--- usbguard-1.0.0/doc/man/usbguard-daemon.conf.5.adoc.orig 2023-01-05 10:58:24.684407437 +0100
|
||||||
|
+++ usbguard-1.0.0/doc/man/usbguard-daemon.conf.5.adoc 2023-01-05 10:58:42.323426745 +0100
|
||||||
|
@@ -27,7 +27,12 @@ It may be overridden using the *-c* comm
|
||||||
|
behave like any other standard Linux daemon therefore it loads rule files in
|
||||||
|
alpha-numeric order. File names inside `RuleFolder` directory should start
|
||||||
|
with a two-digit number prefix indicating the position, in which the rules
|
||||||
|
- are scanned by the daemon.
|
||||||
|
+ are scanned by the daemon. Using RuleFile and RuleFolder at the same time is
|
||||||
|
+ permitted. However, modification of the permanent policy is not possible if
|
||||||
|
+ one of the following conditions are met:
|
||||||
|
+ ** Neither RuleFile nor RuleFolder are specified.
|
||||||
|
+ ** RuleFile is not specified, RuleFolder is but it does not contain any files,
|
||||||
|
+ where we could save permanent rules.
|
||||||
|
|
||||||
|
*ImplicitPolicyTarget*='target'::
|
||||||
|
How to treat USB devices that don't match any rule in the policy. Target
|
||||||
|
diff -up usbguard-1.0.0/src/Daemon/Daemon.cpp.orig usbguard-1.0.0/src/Daemon/Daemon.cpp
|
||||||
|
--- usbguard-1.0.0/src/Daemon/Daemon.cpp.orig 2023-01-05 10:58:49.689434809 +0100
|
||||||
|
+++ usbguard-1.0.0/src/Daemon/Daemon.cpp 2023-01-05 10:59:18.991466884 +0100
|
||||||
|
@@ -742,7 +742,7 @@ namespace usbguard
|
||||||
|
/* TODO: reevaluate the firewall rules for all active devices */
|
||||||
|
const uint32_t id = _policy.appendRule(rule, parent_id);
|
||||||
|
|
||||||
|
- if (_config.hasSettingValue("RuleFile") && permanent) {
|
||||||
|
+ if ((_config.hasSettingValue("RuleFile") || _config.hasSettingValue("RuleFolder")) && permanent) {
|
||||||
|
_policy.save();
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -755,7 +755,7 @@ namespace usbguard
|
||||||
|
USBGUARD_LOG(Trace) << "id=" << id;
|
||||||
|
_policy.removeRule(id);
|
||||||
|
|
||||||
|
- if (_config.hasSettingValue("RuleFile")) {
|
||||||
|
+ if (_config.hasSettingValue("RuleFile") || _config.hasSettingValue("RuleFolder")) {
|
||||||
|
_policy.save();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
diff -up usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp.orig usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp
|
||||||
|
--- usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp.orig 2023-01-05 10:59:27.117475780 +0100
|
||||||
|
+++ usbguard-1.0.0/src/Daemon/RuleSetFactory.cpp 2023-01-05 10:59:46.228496702 +0100
|
||||||
|
@@ -75,8 +75,24 @@ namespace usbguard
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (ruleSet.empty()){
|
||||||
|
- USBGUARD_LOG(Warning) << "Neither RuleFile nor RuleFolder are set; Modification of the permanent policy won't be possible.";
|
||||||
|
+ /*
|
||||||
|
+ * This means one of the following:
|
||||||
|
+ * - Neither RuleFile nor RuleFolder are specified
|
||||||
|
+ * - RuleFile not specified, RuleFolder is but it does not contain any files,
|
||||||
|
+ * where we could save permanent rules
|
||||||
|
+ */
|
||||||
|
+ if (ruleSet.empty()) {
|
||||||
|
+ std::string msg;
|
||||||
|
+
|
||||||
|
+ if (ns.getRulesPath().empty() && ns.getRulesDirPath().empty()) {
|
||||||
|
+ msg = "Neither RuleFile nor RuleFolder are set.";
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ msg = "RuleFile is not set, RuleFolder is but it does not contain any rule files.";
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ USBGUARD_LOG(Warning) << "Modification of the permanent policy won't be possible."
|
||||||
|
+ << " Reason: " << msg;
|
||||||
|
ruleSet = generateDefaultRuleSet();
|
||||||
|
}
|
||||||
|
|
||||||
Loading…
Reference in new issue