| 1008 | } |
| 1009 | |
| 1010 | std::shared_ptr<Rule> Daemon::upsertDeviceRule(uint32_t id, Rule::Target target) |
| 1011 | { |
| 1012 | USBGUARD_LOG(Trace) << "entry:" |
| 1013 | << "id=" << id |
| 1014 | << "target=" << Rule::targetToString(target); |
| 1015 | std::shared_ptr<Device> device = _dm->getDevice(id); |
| 1016 | bool with_port = true && _device_rules_with_port; |
| 1017 | bool with_parent_hash = true; |
| 1018 | |
| 1019 | /* |
| 1020 | * Generate a port specific or agnostic rule depending on the target |
| 1021 | */ |
| 1022 | switch (target) { |
| 1023 | case Rule::Target::Allow: |
| 1024 | with_port = true && with_port; |
| 1025 | with_parent_hash = true; |
| 1026 | break; |
| 1027 | |
| 1028 | case Rule::Target::Block: |
| 1029 | /* |
| 1030 | * Block the device using a port agnostic rule, so that the same device |
| 1031 | * inserted in a different port is still blocked. Note that allowDevice |
| 1032 | * generates a port specific rule and the same device won't be allowed |
| 1033 | * when inserted in a different port. |
| 1034 | */ |
| 1035 | with_port = false; |
| 1036 | with_parent_hash = false; |
| 1037 | break; |
| 1038 | |
| 1039 | case Rule::Target::Reject: |
| 1040 | /* |
| 1041 | * Reject the device using a port agnostic port. When we explicitly |
| 1042 | * reject a device, we don't want to reject it again when the same |
| 1043 | * device is inserted in a different port. |
| 1044 | */ |
| 1045 | with_port = false; |
| 1046 | with_parent_hash = false; |
| 1047 | break; |
| 1048 | |
| 1049 | case Rule::Target::Invalid: |
| 1050 | case Rule::Target::Empty: |
| 1051 | case Rule::Target::Unknown: |
| 1052 | case Rule::Target::Match: |
| 1053 | case Rule::Target::Device: |
| 1054 | default: |
| 1055 | throw Exception("upsertDeviceRule", "device rule", "Invalid target"); |
| 1056 | } |
| 1057 | |
| 1058 | /* Generate a match rule for upsert */ |
| 1059 | std::shared_ptr<Rule> match_rule = device->getDeviceRule(/*with-port=*/false, |
| 1060 | /*with-parent-hash=*/false, |
| 1061 | /*match_rule=*/true); |
| 1062 | const std::string match_spec = match_rule->toString(); |
| 1063 | USBGUARD_LOG(Debug) << "match_spec=" << match_spec; |
| 1064 | /* Generate new device rule */ |
| 1065 | std::shared_ptr<Rule> device_rule = device->getDeviceRule(with_port, with_parent_hash); |
| 1066 | device_rule->setTarget(target); |
| 1067 | const std::string rule_spec = device_rule->toString(); |