From 006d62f59fbc86380dd5e79a084746e9e7368a98 Mon Sep 17 00:00:00 2001 From: Nadrieril Date: Tue, 27 Feb 2018 18:07:43 +0000 Subject: [PATCH 1/2] usbguard: 0.7.0 -> 0.7.2 --- .../usbguard/daemon_read_only_config.patch | 13 -------- pkgs/os-specific/linux/usbguard/default.nix | 18 +++++------ .../linux/usbguard/documentation.patch | 32 ------------------- 3 files changed, 8 insertions(+), 55 deletions(-) delete mode 100644 pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch delete mode 100644 pkgs/os-specific/linux/usbguard/documentation.patch diff --git a/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch b/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch deleted file mode 100644 index eb4d5df698ac..000000000000 --- a/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/src/Library/ConfigFilePrivate.cpp b/src/Library/ConfigFilePrivate.cpp -index 8aefa65..40914f7 100644 ---- a/src/Library/ConfigFilePrivate.cpp -+++ b/src/Library/ConfigFilePrivate.cpp -@@ -51,7 +51,7 @@ namespace usbguard - - void ConfigFilePrivate::open(const std::string& path) - { -- _stream.open(path, std::ios::in|std::ios::out); -+ _stream.open(path, std::ios::in); - if (!_stream.is_open()) { - throw std::runtime_error("Can't open " + path); - } diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix index 8ed4735dd278..2ca825a27d71 100644 --- a/pkgs/os-specific/linux/usbguard/default.nix +++ b/pkgs/os-specific/linux/usbguard/default.nix @@ -1,7 +1,8 @@ { stdenv, fetchurl, lib, - libxslt, pandoc, pkgconfig, + libxslt, pandoc, asciidoctor, pkgconfig, dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf, qtbase, qttools, qtsvg, + audit, libgcrypt ? null, libsodium ? null }: @@ -11,23 +12,19 @@ with stdenv.lib; assert libgcrypt != null -> libsodium == null; stdenv.mkDerivation rec { - version = "0.7.0"; + version = "0.7.2"; name = "usbguard-${version}"; - repo = "https://github.com/dkopecek/usbguard"; + repo = "https://github.com/USBGuard/usbguard"; src = fetchurl { url = "${repo}/releases/download/${name}/${name}.tar.gz"; - sha256 = "1e1485a2b47ba3bde9de2851b371d2552a807047a21e0b81553cf80d7f722709"; + sha256 = "5bd3e5219c590c3ae27b21315bd10b60e823cef64e5deff3305ff5b4087fc2d6"; }; - patches = [ - ./daemon_read_only_config.patch - ./documentation.patch - ]; - nativeBuildInputs = [ libxslt + asciidoctor pandoc # for rendering documentation pkgconfig ]; @@ -39,6 +36,7 @@ stdenv.mkDerivation rec { libseccomp polkit protobuf + audit qtbase qtsvg @@ -61,7 +59,7 @@ stdenv.mkDerivation rec { meta = { description = "The USBGuard software framework helps to protect your computer against BadUSB."; - homepage = "https://dkopecek.github.io/usbguard/"; + homepage = "https://usbguard.github.io/"; license = licenses.gpl2; maintainers = [ maintainers.tnias ]; }; diff --git a/pkgs/os-specific/linux/usbguard/documentation.patch b/pkgs/os-specific/linux/usbguard/documentation.patch deleted file mode 100644 index 89de627131f5..000000000000 --- a/pkgs/os-specific/linux/usbguard/documentation.patch +++ /dev/null @@ -1,32 +0,0 @@ -diff --git a/doc/usbguard-daemon.conf.5.md b/doc/usbguard-daemon.conf.5.md -index ea86ad1..63aec70 100644 ---- a/doc/usbguard-daemon.conf.5.md -+++ b/doc/usbguard-daemon.conf.5.md -@@ -30,21 +30,21 @@ The **usbguard-daemon.conf** file is loaded by the USBGuard daemon after it pars - **RestoreControllerDeviceState**=<*boolean*> - : The USBGuard daemon modifies some attributes of controller devices like the default authorization state of new child device instances. Using this setting, you can control whether the daemon will try to restore the attribute values to the state before modification on shutdown. - -+**DeviceManagerBackend**=<*backend*> -+: Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`. -+ - **IPCAllowedUsers**=<*username*> [<*username*> ...] - : A space delimited list of usernames that the daemon will accept IPC connections from. - - **IPCAllowedGroups**=<*groupname*> [<*groupname*> ...] - : A space delimited list of groupnames that the daemon will accept IPC connections from. - --**IPCAccessControlFiles**=<*path*> --: Path to a directory holding the IPC access control files. -- --**DeviceManagerBackend**=<*backend*> --: Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`. -- - **IPCAccessControlFiles**=<*path*> - : The files at this location will be interpreted by the daemon as IPC access control definition files. See the **IPC ACCESS CONTROL** section for more details. - -+**DeviceRulesWithPort**=<*boolean*> -+: Generate device specific rules including the "via-port" attribute. -+ - **AuditFilePath**=<*filepath*> - : USBGuard audit events log file path. - From 297fac40ca0768cac30977653857fa157b8238e7 Mon Sep 17 00:00:00 2001 From: Nadrieril Date: Tue, 27 Feb 2018 18:08:45 +0000 Subject: [PATCH 2/2] nixos/usbguard: Do not check permissions on rules file (using undocumented -P flag) --- nixos/modules/services/security/usbguard.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/security/usbguard.nix b/nixos/modules/services/security/usbguard.nix index 4e685e633354..5d469cabe2cb 100644 --- a/nixos/modules/services/security/usbguard.nix +++ b/nixos/modules/services/security/usbguard.nix @@ -192,7 +192,7 @@ in { serviceConfig = { Type = "simple"; - ExecStart = ''${pkgs.usbguard}/bin/usbguard-daemon -d -k -c ${daemonConfFile}''; + ExecStart = ''${pkgs.usbguard}/bin/usbguard-daemon -P -d -k -c ${daemonConfFile}''; Restart = "on-failure"; }; };