nixos/usbguard: create package and module (#28363)

* nixos/usbguard: create package and module

No usbguard module or package existed for NixOS previously. USBGuard
will protect you from BadUSB attacks. (assuming configuration is done
correctly)

* nixos/usbguard: remove extra packages

Users can override this by themselves.

* nixos/usbguard: add maintainer and fix style

3 files changed, 113 insertions, 0 deletions

diff --git a/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch b/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch
new file mode 100644
index 000000000000..eb4d5df698ac
--- /dev/null
+++ b/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch
@@ -0,0 +1,13 @@
+diff --git a/src/Library/ConfigFilePrivate.cpp b/src/Library/ConfigFilePrivate.cpp
+index 8aefa65..40914f7 100644
+--- a/src/Library/ConfigFilePrivate.cpp
++++ b/src/Library/ConfigFilePrivate.cpp
+@@ -51,7 +51,7 @@ namespace usbguard
+ 
+   void ConfigFilePrivate::open(const std::string& path)
+   {
+-    _stream.open(path, std::ios::in|std::ios::out);
++    _stream.open(path, std::ios::in);
+     if (!_stream.is_open()) {
+       throw std::runtime_error("Can't open " + path);
+     }
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
new file mode 100644
index 000000000000..b88d96e02a44
--- /dev/null
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -0,0 +1,68 @@
+{
+  stdenv, fetchurl, lib,
+  libxslt, pandoc, pkgconfig,
+  dbus_glib, libcap_ng, libqb, libseccomp, polkit, protobuf, qtbase, qttools, qtsvg,
+  libgcrypt ? null,
+  libsodium ? null
+}:
+
+with stdenv.lib;
+
+assert libgcrypt != null -> libsodium == null;
+
+stdenv.mkDerivation rec {
+  version = "0.7.0";
+  name = "usbguard-${version}";
+
+  repo = "https://github.com/dkopecek/usbguard";
+
+  src = fetchurl {
+    url = "${repo}/releases/download/${name}/${name}.tar.gz";
+    sha256 = "1e1485a2b47ba3bde9de2851b371d2552a807047a21e0b81553cf80d7f722709";
+  };
+
+  patches = [
+    ./daemon_read_only_config.patch
+    ./documentation.patch
+  ];
+
+  nativeBuildInputs = [
+    libxslt
+    pandoc # for rendering documentation
+    pkgconfig
+  ];
+
+  buildInputs = [
+    dbus_glib
+    libcap_ng
+    libqb
+    libseccomp
+    polkit
+    protobuf
+
+    qtbase
+    qtsvg
+    qttools
+  ]
+  ++ (lib.optional (libgcrypt != null) libgcrypt)
+  ++ (lib.optional (libsodium != null) libsodium);
+
+  configureFlags = [
+    "--with-bundled-catch"
+    "--with-bundled-pegtl"
+    "--with-dbus"
+    "--with-gui-qt=qt5"
+    "--with-polkit"
+  ]
+  ++ (lib.optional (libgcrypt != null) "--with-crypto-library=gcrypt")
+  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium");
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "The USBGuard software framework helps to protect your computer against BadUSB.";
+    homepage = "https://dkopecek.github.io/usbguard/";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.tnias ];
+  };
+}
diff --git a/pkgs/os-specific/linux/usbguard/documentation.patch b/pkgs/os-specific/linux/usbguard/documentation.patch
new file mode 100644
index 000000000000..89de627131f5
--- /dev/null
+++ b/pkgs/os-specific/linux/usbguard/documentation.patch
@@ -0,0 +1,32 @@
+diff --git a/doc/usbguard-daemon.conf.5.md b/doc/usbguard-daemon.conf.5.md
+index ea86ad1..63aec70 100644
+--- a/doc/usbguard-daemon.conf.5.md
++++ b/doc/usbguard-daemon.conf.5.md
+@@ -30,21 +30,21 @@ The **usbguard-daemon.conf** file is loaded by the USBGuard daemon after it pars
+ **RestoreControllerDeviceState**=<*boolean*>
+ :   The USBGuard daemon modifies some attributes of controller devices like the default authorization state of new child device instances. Using this setting, you can control whether the daemon will try to restore the attribute values to the state before modification on shutdown.
+ 
++**DeviceManagerBackend**=<*backend*>
++:   Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`.
++
+ **IPCAllowedUsers**=<*username*> [<*username*> ...]
+ :   A space delimited list of usernames that the daemon will accept IPC connections from.
+ 
+ **IPCAllowedGroups**=<*groupname*> [<*groupname*> ...]
+ :   A space delimited list of groupnames that the daemon will accept IPC connections from.
+ 
+-**IPCAccessControlFiles**=<*path*>
+-:   Path to a directory holding the IPC access control files.
+-
+-**DeviceManagerBackend**=<*backend*>
+-:   Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`.
+-
+ **IPCAccessControlFiles**=<*path*>
+ :   The files at this location will be interpreted by the daemon as IPC access control definition files. See the **IPC ACCESS CONTROL** section for more details.
+ 
++**DeviceRulesWithPort**=<*boolean*>
++:   Generate device specific rules including the "via-port" attribute.
++
+ **AuditFilePath**=<*filepath*>
+ :   USBGuard audit events log file path.
+