NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2e2eefd5ad
kumquat-buildroot/package/usbguard/usbguard.mk

65 lines
1.7 KiB
Makefile
Raw Normal View History

package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
################################################################################
#
## usbguard
#
################################################################################
package/usbguard: bump to version 1.1.1 - This bump fixes unauthorized access via D-Bus (CVE-2019-25058): https://github.com/advisories/GHSA-p5wh-m4gj-x2mr but dbus is disabled on buildroot - musl is supported since https://github.com/USBGuard/usbguard/commit/b04e8deacac4f3f4a82a10b219c2d555e1b2aa24 - C++17 is now mandatory: https://github.com/USBGuard/usbguard/commit/8c86264986685bf646c65228abce2432e08e3c4c - Update hash of license file (use license file from gnu.org: https://github.com/USBGuard/usbguard/commit/3292511ab164ce0bdf6d58f0369ce3993dded9ad) https://github.com/USBGuard/usbguard/blob/usbguard-1.1.1/CHANGELOG.md Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-03-19 20:34:22 +01:00
USBGUARD_VERSION = 1.1.1
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
USBGUARD_SITE = https://github.com/USBGuard/usbguard/releases/download/usbguard-$(USBGUARD_VERSION)
USBGUARD_LICENSE = GPL-2.0+
USBGUARD_LICENSE_FILES = LICENSE
package/usbguard: add USBGUARD_CPE_ID_VENDOR cpe:2.3:a:usbguard_project:usbguard is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ausbguard_project%3Ausbguard Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-03-09 22:34:59 +01:00
USBGUARD_CPE_ID_VENDOR = usbguard_project
package/usbguard: add SELinux module Support for usbguard is added by the admin/usbguard module in the SELinux refpolicy. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-08-04 12:10:57 +02:00
USBGUARD_SELINUX_MODULES = usbguard
package/usbguard: improve option handling Don't pass --disable-seccomp and --disable-systemd unconditionally While at it, also add a space and a new line when needed, and split the initial CONF_OPTS assignment to have one option per line. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-23 18:59:23 +02:00
USBGUARD_CONF_OPTS = \
--with-bundled-catch \
--with-bundled-pegtl \
--disable-debug-build \
--without-dbus \
--without-polkit \
--disable-umockdev
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
USBGUARD_DEPENDENCIES += libqb protobuf
package/usbguard: needs at least a crypto backend Since its addition in commit fbff7d7289cc95db991184f890f4ca1fcf8a101e, usbguard needs a crypto backend otherwise the build will fail on: checking for sodium... no checking for libcrypto... no checking for powerpc-buildroot-linux-uclibc-libgcrypt-config... no checking for libgcrypt-config... no checking for LIBGCRYPT - version >= 1.5.0... no configure: error: The selected crypto backend library is not available. So select sodium as the default crypto backend as this is the default choice in configure.ac. Fixes: - http://autobuild.buildroot.org/results/fb9865e2c65ea1dd9a657e1181a6c8c49481fda7 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-08-04 12:07:36 +02:00
ifeq ($(BR2_PACKAGE_LIBSODIUM),y)
USBGUARD_CONF_OPTS += --with-crypto-library=sodium
USBGUARD_DEPENDENCIES += libsodium
else ifeq ($(BR2_PACKAGE_LIBOPENSSL),y)
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
USBGUARD_CONF_OPTS += --with-crypto-library=openssl
USBGUARD_DEPENDENCIES += libopenssl
package/usbguard: needs at least a crypto backend Since its addition in commit fbff7d7289cc95db991184f890f4ca1fcf8a101e, usbguard needs a crypto backend otherwise the build will fail on: checking for sodium... no checking for libcrypto... no checking for powerpc-buildroot-linux-uclibc-libgcrypt-config... no checking for libgcrypt-config... no checking for LIBGCRYPT - version >= 1.5.0... no configure: error: The selected crypto backend library is not available. So select sodium as the default crypto backend as this is the default choice in configure.ac. Fixes: - http://autobuild.buildroot.org/results/fb9865e2c65ea1dd9a657e1181a6c8c49481fda7 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-08-04 12:07:36 +02:00
else ifeq ($(BR2_PACKAGE_LIBGCRYPT),y)
package/usbguard: fix build with libgcrypt Building with libgcrypt fails since the addition of the package in commit fbff7d7289cc95db991184f890f4ca1fcf8a101e: checking for sparc64-buildroot-linux-gnu-libgcrypt-config... no checking for libgcrypt-config... no checking for LIBGCRYPT - version >= 1.5.0... no configure: error: The selected crypto backend library is not available. Fix this build failure by helping usbguard to find libgcrypt-config Fixes: - http://autobuild.buildroot.org/results/4c19e50a2a5308cb31a62f1b4b538a30353022bb Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-23 18:59:24 +02:00
USBGUARD_CONF_ENV += \
ac_cv_path_LIBGCRYPT_CONFIG=$(STAGING_DIR)/usr/bin/libgcrypt-config
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
USBGUARD_CONF_OPTS += --with-crypto-library=gcrypt
USBGUARD_DEPENDENCIES += libgcrypt
endif
package/usbguard: improve option handling Don't pass --disable-seccomp and --disable-systemd unconditionally While at it, also add a space and a new line when needed, and split the initial CONF_OPTS assignment to have one option per line. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-23 18:59:23 +02:00
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
USBGUARD_CONF_OPTS += --enable-systemd
USBGUARD_DEPENDENCIES += systemd
package/usbguard: improve option handling Don't pass --disable-seccomp and --disable-systemd unconditionally While at it, also add a space and a new line when needed, and split the initial CONF_OPTS assignment to have one option per line. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-23 18:59:23 +02:00
else
USBGUARD_CONF_OPTS += --disable-systemd
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
endif
ifeq ($(BR2_PACKAGE_LIBSECCOMP),y)
USBGUARD_CONF_OPTS += --enable-seccomp
USBGUARD_DEPENDENCIES += libseccomp
package/usbguard: improve option handling Don't pass --disable-seccomp and --disable-systemd unconditionally While at it, also add a space and a new line when needed, and split the initial CONF_OPTS assignment to have one option per line. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-23 18:59:23 +02:00
else
USBGUARD_CONF_OPTS += --disable-seccomp
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
endif
ifeq ($(BR2_PACKAGE_LIBCAP_NG),y)
USBGUARD_CONF_OPTS += --enable-libcapng
USBGUARD_DEPENDENCIES += libcap-ng
endif
define USBGUARD_INSTALL_INIT_SYSV
$(INSTALL) -m 0755 -D package/usbguard/S20usbguard \
$(TARGET_DIR)/etc/init.d/S20usbguard
endef
package/usbguard: enforce the right permissions on the configuration file Only 0600 rights are allowed for the rules.conf. This file is read when the usbguard daemon starts and will prevent it to run otherwise. As Git only tracks the executable bit, setting the right permissions in the package makefile is the cleanest solution, in particular when providing this file from a rootfs overlay. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-06-18 11:47:10 +02:00
define USBGUARD_PERMISSIONS
/etc/usbguard/rules.conf f 0600 0 0 - - - - -
endef
package/usbguard: new package usbguard is a software framework to implement USB device blacklisting and whitelisting based on their attributes. More info. on: https://usbguard.github.io/ Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com> Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> [Arnout: - correct indirect dependencies from protobuf instead of libglib2; - say in Config.in help text that rules.conf has to be created]
2021-06-08 14:32:10 +02:00
$(eval $(autotools-package))
Reference in New Issue Copy Permalink