From 3d40f2c2af15e724580030aaff9d690fa17507bf Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Wed, 20 Mar 2019 16:24:08 -0400 Subject: [PATCH 01/35] Allow containers to mount and umount fuse file systems. This will allow us to use buidlah within a user namespace separated container. --- .gitignore | 9 ++++++++ container-selinux.spec | 47 +++++++++++++++++++++++++++++++++++++++--- sources | 2 +- 3 files changed, 54 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index b8974bb..5833226 100644 --- a/.gitignore +++ b/.gitignore @@ -74,3 +74,12 @@ /container-selinux-484806a.tar.gz /container-selinux-21c2be6.tar.gz /container-selinux-5e1f62f.tar.gz +/container-selinux-ec6fcad.tar.gz +/container-selinux-eb60838.tar.gz +/container-selinux-92af7fd.tar.gz +/container-selinux-c178849.tar.gz +/container-selinux-891a85f.tar.gz +/container-selinux-2c1a2ab.tar.gz +/container-selinux-5c98b56.tar.gz +/container-selinux-2521d0d.tar.gz +/container-selinux-619db17.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 5e01e51..3b292fe 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 5e1f62fe319ebbef46bcabc8cc5e22d209411dda +%global commit0 619db17b743ec8c75dabb0b08563f9ddad899ff2 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.82 +Version: 2.90 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,7 +109,48 @@ fi %{_datadir}/selinux/* %changelog -* Sun Feb 10 2019 Dan Walsh - 2.82-1 +* Wed Mar 20 2019 Dan Walsh - 2.90-1 +- Allow containers to mount and umount fuse file systems. This will allow us +- to use buidlah within a user namespace separated container. + +* Sat Mar 9 2019 Dan Walsh - 2.89-1 +- Allow all container domains to have container file types entrypoint +- Add new release to fix issues with udica +- Allow container_runtime_t to dyntransition to container domains + +* Sat Mar 09 2019 Lokesh Mandvekar (Bot) - 2:2.89-5.git2521d0d +- bump to 2.89 +- autobuilt 2521d0d + +* Thu Mar 07 2019 Lokesh Mandvekar (Bot) - 2:2.88-4.git5c98b56 +- bump to 2.88 +- autobuilt 5c98b56 + +* Wed Mar 06 2019 Lokesh Mandvekar (Bot) - 2:2.87-3.git2c1a2ab +- autobuilt 2c1a2ab + +* Sat Mar 02 2019 Lokesh Mandvekar (Bot) - 2:2.87-2.git891a85f +- bump to 2.87 +- autobuilt 891a85f + +* Fri Mar 1 2019 Dan Walsh - 2.86-1 +- Allow unconfined user and services to dyntrans to container domains, needed for CRIU +- Allow containers exectue hugetlb files. + +* Thu Feb 28 2019 Dan Walsh - 2.85-1 +- More allow rules to allow containers to run within containers + +* Thu Feb 28 2019 Dan Walsh - 2.84-1 +- More allow rules to allow containers to run within containers + +* Tue Feb 26 2019 Lokesh Mandvekar (Bot) - 2:2.82-2.git5e1f62f +- bump to 2.82 +- autobuilt 5e1f62f + +* Mon Feb 25 2019 Dan Walsh - 2.83-1 +- Allow containers to mounton cgroup and container_file_t + +* Sun Feb 10 2019 Dan Walsh - 2.82-1.nightly.git5e1f62f - Allow confined users to use containers * Fri Feb 08 2019 Lokesh Mandvekar (Bot) - 2:2.80-3.git21c2be6 diff --git a/sources b/sources index e46329b..fca6816 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-5e1f62f.tar.gz) = 8184e4191cbce80e8ecf65f82e64f6b85eeda0b7b958be099b97100aaa78c71e3d0adec642eafb7e58037ba0a5b0452da7674d7e6c02a8f3c125f67629425ea7 +SHA512 (container-selinux-619db17.tar.gz) = 958e7672a8a173b7b5d28c4a504d6c733292dfed7a850d81f8243c406eef497232dbaa7f6c6520054ef02e2d14a3a66b6e75035fa8177e145e94497f71ccaa40 From 5da44fd7476afd244893069dbda30b3862539773 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Tue, 26 Mar 2019 08:15:58 -0400 Subject: [PATCH 02/35] Allow container runtimes to create unlabeled keyrings --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 5833226..603f304 100644 --- a/.gitignore +++ b/.gitignore @@ -83,3 +83,4 @@ /container-selinux-5c98b56.tar.gz /container-selinux-2521d0d.tar.gz /container-selinux-619db17.tar.gz +/container-selinux-acc6941.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 3b292fe..26ec77b 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 619db17b743ec8c75dabb0b08563f9ddad899ff2 +%global commit0 acc6941b2b35d7e44718bb986492d808906d9d8c %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.90 +Version: 2.91 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Tue Mar 26 2019 Dan Walsh - 2.91-1 +- Allow container runtimes to create unlabeled keyrings + * Wed Mar 20 2019 Dan Walsh - 2.90-1 - Allow containers to mount and umount fuse file systems. This will allow us - to use buidlah within a user namespace separated container. diff --git a/sources b/sources index fca6816..05d5018 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-619db17.tar.gz) = 958e7672a8a173b7b5d28c4a504d6c733292dfed7a850d81f8243c406eef497232dbaa7f6c6520054ef02e2d14a3a66b6e75035fa8177e145e94497f71ccaa40 +SHA512 (container-selinux-acc6941.tar.gz) = 0086f8187095444deb8ed1b6b8396266aaf8f4f0f9d46b3bb82d89ba0208b174955fdf72e7c622e5f4d6f63ad6750318823f50f29ad73f72907b4da9b45ce39b From 18fb4db2c3de03d7db0170719bbacba25989a363 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Thu, 28 Mar 2019 08:01:02 -0400 Subject: [PATCH 03/35] Allow init_t to manage container content Allow container domains to create fifo_files on fusefs file systems Add boolean to allow containers to use ceph file systems --- .gitignore | 1 + container-selinux.spec | 9 +++++++-- sources | 1 + 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 603f304..7961c2f 100644 --- a/.gitignore +++ b/.gitignore @@ -84,3 +84,4 @@ /container-selinux-2521d0d.tar.gz /container-selinux-619db17.tar.gz /container-selinux-acc6941.tar.gz +/container-selinux-1e99f1d.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 26ec77b..5c6a6ae 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 acc6941b2b35d7e44718bb986492d808906d9d8c +%global commit0 1e99f1d53ac4b311c6020971f580fceee0d8cbfa %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.91 +Version: 2.94 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,11 @@ fi %{_datadir}/selinux/* %changelog +* Thu Mar 28 2019 Dan Walsh - 2.94-1 +- Allow init_t to manage container content +- Allow container domains to create fifo_files on fusefs file systems +- Add boolean to allow containers to use ceph file systems + * Tue Mar 26 2019 Dan Walsh - 2.91-1 - Allow container runtimes to create unlabeled keyrings diff --git a/sources b/sources index 05d5018..438452a 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (container-selinux-acc6941.tar.gz) = 0086f8187095444deb8ed1b6b8396266aaf8f4f0f9d46b3bb82d89ba0208b174955fdf72e7c622e5f4d6f63ad6750318823f50f29ad73f72907b4da9b45ce39b +SHA512 (container-selinux-1e99f1d.tar.gz) = ff485831a1912e0bb51346f8bc02d1d6dff9f4b97406d1c770c5cbfb6982b77fd82f92db62039adc8933e87b9035ea40a910e12f7b0c884ff75b8cf8892be97b From 09ee3421bff3c20de860e06e562111148ad55699 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 1 Apr 2019 17:46:44 -0400 Subject: [PATCH 04/35] Allow containers to create fusefs sockets and named pipes --- container-selinux.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/container-selinux.spec b/container-selinux.spec index 5c6a6ae..d183cce 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 1e99f1d53ac4b311c6020971f580fceee0d8cbfa +%global commit0 e3ebc6845ce8a5427b521e3f4087dab8e383a550 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.94 +Version: 2.95 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Mon Apr 1 2019 Dan Walsh - 2.95-1 +- Allow containers to create fusefs sockets and named pipes + * Thu Mar 28 2019 Dan Walsh - 2.94-1 - Allow init_t to manage container content - Allow container domains to create fifo_files on fusefs file systems From 029e334ac68ef5e76cc35bd75da86453af07ed09 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 1 Apr 2019 17:48:12 -0400 Subject: [PATCH 05/35] Allow containers to create fusefs sockets and named pipes --- .gitignore | 1 + sources | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 7961c2f..c4af282 100644 --- a/.gitignore +++ b/.gitignore @@ -85,3 +85,4 @@ /container-selinux-619db17.tar.gz /container-selinux-acc6941.tar.gz /container-selinux-1e99f1d.tar.gz +/container-selinux-e3ebc68.tar.gz diff --git a/sources b/sources index 438452a..52e8f73 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (container-selinux-acc6941.tar.gz) = 0086f8187095444deb8ed1b6b8396266aaf8f4f0f9d46b3bb82d89ba0208b174955fdf72e7c622e5f4d6f63ad6750318823f50f29ad73f72907b4da9b45ce39b -SHA512 (container-selinux-1e99f1d.tar.gz) = ff485831a1912e0bb51346f8bc02d1d6dff9f4b97406d1c770c5cbfb6982b77fd82f92db62039adc8933e87b9035ea40a910e12f7b0c884ff75b8cf8892be97b +SHA512 (container-selinux-e3ebc68.tar.gz) = 0487c6d1163c956c47cfc158ca3c41501c080428324d8dddc8cda31af282cd4cdc2f2eb9dcfd64e49dda59b26df6d9c9a253e00fcb91b36f1c8fa1a3ec272d2a From 6b6fe26acb00fc32e90a8e4e373a967092bb6735 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 12 Apr 2019 12:49:18 -0400 Subject: [PATCH 06/35] Allow containers to read/write sysctl_kernel_ns_last_pid_t Allow containers to manage fusefs sockets and named pipes --- .gitignore | 1 + container-selinux.spec | 11 +++++++++-- sources | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index c4af282..ff3c090 100644 --- a/.gitignore +++ b/.gitignore @@ -86,3 +86,4 @@ /container-selinux-acc6941.tar.gz /container-selinux-1e99f1d.tar.gz /container-selinux-e3ebc68.tar.gz +/container-selinux-a6c9822.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index d183cce..2256278 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 e3ebc6845ce8a5427b521e3f4087dab8e383a550 +%global commit0 a6c98225aa149b432c0b752c15da760d5559647d %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.95 +Version: 2.97 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,13 @@ fi %{_datadir}/selinux/* %changelog +* Fri Apr 12 2019 Dan Walsh - 2.97-1 +- Allow containers to read/write sysctl_kernel_ns_last_pid_t +- Allow containers to manage fusefs sockets and named pipes + +* Thu Apr 4 2019 Dan Walsh - 2.96-1 +- Allow containers to read/write sysctl_kernel_ns_last_pid_t + * Mon Apr 1 2019 Dan Walsh - 2.95-1 - Allow containers to create fusefs sockets and named pipes diff --git a/sources b/sources index 52e8f73..c467ad6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-e3ebc68.tar.gz) = 0487c6d1163c956c47cfc158ca3c41501c080428324d8dddc8cda31af282cd4cdc2f2eb9dcfd64e49dda59b26df6d9c9a253e00fcb91b36f1c8fa1a3ec272d2a +SHA512 (container-selinux-a6c9822.tar.gz) = 285c481a04ebc0697270d7f3c0f4e02c8f2da305e256fbebd1b8e9f689d27a0adb1129a50181e98036d87e20eb7440844ce30168649f6b19deacd844205a5a4e From 0e9558002d07c4f8b72f26dadd4fbce5d35f1d81 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 15 Apr 2019 09:15:06 -0400 Subject: [PATCH 07/35] Allow iptables to append to container_file_t --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ff3c090..759e0ee 100644 --- a/.gitignore +++ b/.gitignore @@ -87,3 +87,4 @@ /container-selinux-1e99f1d.tar.gz /container-selinux-e3ebc68.tar.gz /container-selinux-a6c9822.tar.gz +/container-selinux-aa7b807.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 2256278..7066869 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 a6c98225aa149b432c0b752c15da760d5559647d +%global commit0 aa7b8073fc449efad54710b0325a0e5eaf7b3479 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.97 +Version: 2.98 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Mon Apr 15 2019 Dan Walsh - 2.98-1 +- Allow iptables to append to container_file_t + * Fri Apr 12 2019 Dan Walsh - 2.97-1 - Allow containers to read/write sysctl_kernel_ns_last_pid_t - Allow containers to manage fusefs sockets and named pipes diff --git a/sources b/sources index c467ad6..291237d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-a6c9822.tar.gz) = 285c481a04ebc0697270d7f3c0f4e02c8f2da305e256fbebd1b8e9f689d27a0adb1129a50181e98036d87e20eb7440844ce30168649f6b19deacd844205a5a4e +SHA512 (container-selinux-aa7b807.tar.gz) = 65e754254a81985f60fc54502e179c772d48d43a9fef007fbd85842df844e4d3ccaeb679edff332cd22583163e79d21c5bf062b04f960b833fc100c85fb0a169 From e4372592164c916f909ac1b081a3155db28e32f7 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 22 Apr 2019 16:53:18 -0400 Subject: [PATCH 08/35] Fix labeling on /var/lib/containers/storage/overlay-layers,images to be sharable. --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 759e0ee..bdc68d7 100644 --- a/.gitignore +++ b/.gitignore @@ -88,3 +88,4 @@ /container-selinux-e3ebc68.tar.gz /container-selinux-a6c9822.tar.gz /container-selinux-aa7b807.tar.gz +/container-selinux-9a53d6c.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 7066869..5971abc 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 aa7b8073fc449efad54710b0325a0e5eaf7b3479 +%global commit0 9a53d6c1b9b5bd2534d94204727e101c49f4fdc2 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.98 +Version: 2.99 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Mon Apr 22 2019 Dan Walsh - 2.99-1 +- Fix labeling on /var/lib/containers/storage/overlay-layers,images to be sharable. + * Mon Apr 15 2019 Dan Walsh - 2.98-1 - Allow iptables to append to container_file_t diff --git a/sources b/sources index 291237d..d991cf6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-aa7b807.tar.gz) = 65e754254a81985f60fc54502e179c772d48d43a9fef007fbd85842df844e4d3ccaeb679edff332cd22583163e79d21c5bf062b04f960b833fc100c85fb0a169 +SHA512 (container-selinux-9a53d6c.tar.gz) = 7b9a35cea07a7a5d2c0c6376b70a9b6bdbe62effee5a0ab5f26d700a23af5c4bbf70fa6c7ac59bbe9c15286bd031eab6f57e0ad0f4155c0df2be0da8c82d8dc1 From dcf127b02460dca76f1ec1bfb94c6838005c98ff Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Tue, 23 Apr 2019 11:45:15 -0400 Subject: [PATCH 09/35] Allow containers running as spc_t to create unlabeled_t kernel keyrings --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index bdc68d7..6f0c802 100644 --- a/.gitignore +++ b/.gitignore @@ -89,3 +89,4 @@ /container-selinux-a6c9822.tar.gz /container-selinux-aa7b807.tar.gz /container-selinux-9a53d6c.tar.gz +/container-selinux-3b78187.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 5971abc..da849c1 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 9a53d6c1b9b5bd2534d94204727e101c49f4fdc2 +%global commit0 3b78187c6f61bd21db58fdd620ce9510515cd864 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.99 +Version: 2.100 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Tue Apr 23 2019 Dan Walsh - 2.100-1 +- Allow containers running as spc_t to create unlabeled_t kernel keyrings + * Mon Apr 22 2019 Dan Walsh - 2.99-1 - Fix labeling on /var/lib/containers/storage/overlay-layers,images to be sharable. diff --git a/sources b/sources index d991cf6..ba8d7ce 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-9a53d6c.tar.gz) = 7b9a35cea07a7a5d2c0c6376b70a9b6bdbe62effee5a0ab5f26d700a23af5c4bbf70fa6c7ac59bbe9c15286bd031eab6f57e0ad0f4155c0df2be0da8c82d8dc1 +SHA512 (container-selinux-3b78187.tar.gz) = 259812b900cd91197da0df4537aee9885cf2412241f8a5d7d81c1b1ac7481b1e615a1a984e548e2540c8b8705e32c52c0f1ce9bc64161ba38ed873e45beb0fd0 From fdf3e874a74e61b690a2c2be45ac06500a7603d5 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 3 May 2019 15:32:51 -0400 Subject: [PATCH 10/35] Allow containers to read rpm cache and rpm databse --- .gitignore | 1 + container-selinux.spec | 9 ++++++--- sources | 2 +- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 6f0c802..dcca350 100644 --- a/.gitignore +++ b/.gitignore @@ -90,3 +90,4 @@ /container-selinux-aa7b807.tar.gz /container-selinux-9a53d6c.tar.gz /container-selinux-3b78187.tar.gz +/container-selinux-b0061dc.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index da849c1..326f5ac 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 3b78187c6f61bd21db58fdd620ce9510515cd864 +%global commit0 b0061dc4182fb90f335f37e8b62c7a3b7e64dd09 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.100 +Version: 2.101 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -94,7 +94,7 @@ matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedi %postun if [ $1 -eq 0 ]; then -%{_sbindir}/semodule -n -r %{modulenames} docker &> /dev/null || : +%{_sbindir}/semodule -n -r %{modulenames} &> /dev/null || : if %{_sbindir}/selinuxenabled ; then %{_sbindir}/load_policy %relabel_files @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Fri May 3 2019 Dan Walsh - 2.101-1 +- Allow containers to read rpm cache and rpm databse + * Tue Apr 23 2019 Dan Walsh - 2.100-1 - Allow containers running as spc_t to create unlabeled_t kernel keyrings diff --git a/sources b/sources index ba8d7ce..c727f46 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-3b78187.tar.gz) = 259812b900cd91197da0df4537aee9885cf2412241f8a5d7d81c1b1ac7481b1e615a1a984e548e2540c8b8705e32c52c0f1ce9bc64161ba38ed873e45beb0fd0 +SHA512 (container-selinux-b0061dc.tar.gz) = 74b8ce388cc6d8b2344f3f9652bba065308b6711f88e71fcb9556413c520be1a11af4fbf399dfd5c61dc608f7e6be5566683d64383cfb46789986bb9c24bb55d From 0016135c46dcf66fb25f56d65a44011286902f25 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Sun, 12 May 2019 06:51:22 -0400 Subject: [PATCH 11/35] Allow all container domains to be entered from container_file_t --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index dcca350..af438ef 100644 --- a/.gitignore +++ b/.gitignore @@ -91,3 +91,4 @@ /container-selinux-9a53d6c.tar.gz /container-selinux-3b78187.tar.gz /container-selinux-b0061dc.tar.gz +/container-selinux-1c24dcb.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 326f5ac..1537aef 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 b0061dc4182fb90f335f37e8b62c7a3b7e64dd09 +%global commit0 1c24dcb7f081102acb48e7b95788442ba7b6c57f %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.101 +Version: 2.102 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Sun May 12 2019 Dan Walsh - 2.102-1 +- Allow all container domains to be entered from container_file_t + * Fri May 3 2019 Dan Walsh - 2.101-1 - Allow containers to read rpm cache and rpm databse diff --git a/sources b/sources index c727f46..8403962 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-b0061dc.tar.gz) = 74b8ce388cc6d8b2344f3f9652bba065308b6711f88e71fcb9556413c520be1a11af4fbf399dfd5c61dc608f7e6be5566683d64383cfb46789986bb9c24bb55d +SHA512 (container-selinux-1c24dcb.tar.gz) = 884272ffe45054019317a849c7a9b939d368c5dfb71f59d6cf123e4552f8a080dbcda071b85bff279058bad33d5c30a8dc5dca5f8c30d1cac45a03b03ac6bad9 From 1e3a6672c90c6b3b358e835cb19eb1cd45060d6d Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 17 May 2019 16:37:40 -0400 Subject: [PATCH 12/35] Set proper labeling for container volumes --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index af438ef..6ae87bb 100644 --- a/.gitignore +++ b/.gitignore @@ -92,3 +92,4 @@ /container-selinux-3b78187.tar.gz /container-selinux-b0061dc.tar.gz /container-selinux-1c24dcb.tar.gz +/container-selinux-b275a1f.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 1537aef..f62f8f6 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 1c24dcb7f081102acb48e7b95788442ba7b6c57f +%global commit0 b275a1f887c98ff545a22252c39085594cfffca4 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.102 +Version: 2.103 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Fri May 17 2019 Dan Walsh - 2.103-1 +- Set proper labeling for container volumes + * Sun May 12 2019 Dan Walsh - 2.102-1 - Allow all container domains to be entered from container_file_t diff --git a/sources b/sources index 8403962..d053aa8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-1c24dcb.tar.gz) = 884272ffe45054019317a849c7a9b939d368c5dfb71f59d6cf123e4552f8a080dbcda071b85bff279058bad33d5c30a8dc5dca5f8c30d1cac45a03b03ac6bad9 +SHA512 (container-selinux-b275a1f.tar.gz) = 7a7287cfb0b573bf9784a7c68f04f11c65169dcc6712e8dff567ece159a6c347c6c023043f364ae64ab02ac86288ee7a689b3b16ea0fd06a608138c34b91bee0 From 0774c8f1f41c59fcbfcd17ac44cae41e4b182f6f Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 3 Jun 2019 06:52:39 +0200 Subject: [PATCH 13/35] Set proper labeling for container volumes in SilverBlue --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 6ae87bb..19505f1 100644 --- a/.gitignore +++ b/.gitignore @@ -93,3 +93,4 @@ /container-selinux-b0061dc.tar.gz /container-selinux-1c24dcb.tar.gz /container-selinux-b275a1f.tar.gz +/container-selinux-7baad79.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index f62f8f6..e1875fe 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 b275a1f887c98ff545a22252c39085594cfffca4 +%global commit0 7baad79ed099c333465157a8c981d4393a381304 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.103 +Version: 2.104 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Mon Jun 3 2019 Dan Walsh - 2.104-1 +- Set proper labeling for container volumes in SilverBlue + * Fri May 17 2019 Dan Walsh - 2.103-1 - Set proper labeling for container volumes diff --git a/sources b/sources index d053aa8..bd36024 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-b275a1f.tar.gz) = 7a7287cfb0b573bf9784a7c68f04f11c65169dcc6712e8dff567ece159a6c347c6c023043f364ae64ab02ac86288ee7a689b3b16ea0fd06a608138c34b91bee0 +SHA512 (container-selinux-7baad79.tar.gz) = 9ac2e28bd0f435b24f1705c06875b94d6a4e4cebe7db4a2c3ad23b8dbda4f96e114acf963065f85327102ec7b179bd21d6b54d1c47b9ca04b06c811f714952da From 2518497b73b3b3a782ab9fac35a57c76062a0313 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Tue, 11 Jun 2019 15:05:00 -0400 Subject: [PATCH 14/35] Allow all unconfined domains to manage unlabeled keyrings Add labeling for kubernetes pods --- .gitignore | 1 + container-selinux.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 19505f1..a747661 100644 --- a/.gitignore +++ b/.gitignore @@ -94,3 +94,4 @@ /container-selinux-1c24dcb.tar.gz /container-selinux-b275a1f.tar.gz /container-selinux-7baad79.tar.gz +/container-selinux-fc7111d.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index e1875fe..fc2a771 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 7baad79ed099c333465157a8c981d4393a381304 +%global commit0 fc7111d5a9649a3fd21972e190be505c1efdd8be %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.104 +Version: 2.106 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,10 @@ fi %{_datadir}/selinux/* %changelog +* Tue Jun 11 2019 Dan Walsh - 2.106-1 +- Allow all unconfined domains to manage unlabeled keyrings +- Add labeling for kubernetes pods + * Mon Jun 3 2019 Dan Walsh - 2.104-1 - Set proper labeling for container volumes in SilverBlue diff --git a/sources b/sources index bd36024..27ec454 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-7baad79.tar.gz) = 9ac2e28bd0f435b24f1705c06875b94d6a4e4cebe7db4a2c3ad23b8dbda4f96e114acf963065f85327102ec7b179bd21d6b54d1c47b9ca04b06c811f714952da +SHA512 (container-selinux-fc7111d.tar.gz) = 4e72112d708d0c3693918aa4bbfb0a6362d393be31350195c18ef72ef2eef29e5b2ae0c91f3c882cd3c000cd03d475fb1443d52213ba20b6eb5add90b2ef1e54 From c0ee28ad0faab0e2680864eca366d45df23c379c Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Wed, 19 Jun 2019 13:34:06 -0400 Subject: [PATCH 15/35] Allow containers to manipulate Onload files. --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a747661..9548df9 100644 --- a/.gitignore +++ b/.gitignore @@ -95,3 +95,4 @@ /container-selinux-b275a1f.tar.gz /container-selinux-7baad79.tar.gz /container-selinux-fc7111d.tar.gz +/container-selinux-453b816.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index fc2a771..e1075fc 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 fc7111d5a9649a3fd21972e190be505c1efdd8be +%global commit0 453b816c74ca17ca891d44a4036a38ea8b3c6593 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.106 +Version: 2.107 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,9 @@ fi %{_datadir}/selinux/* %changelog +* Fri Jun 14 2019 Dan Walsh - 2.107-1 +- Allow containers to manipulate Onload files. + * Tue Jun 11 2019 Dan Walsh - 2.106-1 - Allow all unconfined domains to manage unlabeled keyrings - Add labeling for kubernetes pods diff --git a/sources b/sources index 27ec454..698dc99 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-fc7111d.tar.gz) = 4e72112d708d0c3693918aa4bbfb0a6362d393be31350195c18ef72ef2eef29e5b2ae0c91f3c882cd3c000cd03d475fb1443d52213ba20b6eb5add90b2ef1e54 +SHA512 (container-selinux-453b816.tar.gz) = 99c36aca1fd5ac71802892bcdfde74ae194dcb2b9b51cc99df86b5b7c80440478110d778e407b8a3dc167f3ad4b0aa8d753cd8878ef15bad2e6c0f8b4d98f2f6 From 0a6de2faa0cadbb6db2fd8f960f67b7c92684e4d Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 8 Jul 2019 13:40:35 -0400 Subject: [PATCH 16/35] Allow containers to accept connections on all socket types Allow containers to connect to gssproxy stream sockets if added to container --- .gitignore | 1 + container-selinux.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9548df9..16379be 100644 --- a/.gitignore +++ b/.gitignore @@ -96,3 +96,4 @@ /container-selinux-7baad79.tar.gz /container-selinux-fc7111d.tar.gz /container-selinux-453b816.tar.gz +/container-selinux-db771da.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index e1075fc..5b20d9b 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 453b816c74ca17ca891d44a4036a38ea8b3c6593 +%global commit0 db771da27119098fe9aefb1c02033e496d5c8760 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.107 +Version: 2.109 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,10 @@ fi %{_datadir}/selinux/* %changelog +* Mon Jul 8 2019 Dan Walsh - 2.109-1 +- Allow containers to accept connections on all socket types +- Allow containers to connect to gssproxy stream sockets if added to container + * Fri Jun 14 2019 Dan Walsh - 2.107-1 - Allow containers to manipulate Onload files. diff --git a/sources b/sources index 698dc99..2ad7730 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-453b816.tar.gz) = 99c36aca1fd5ac71802892bcdfde74ae194dcb2b9b51cc99df86b5b7c80440478110d778e407b8a3dc167f3ad4b0aa8d753cd8878ef15bad2e6c0f8b4d98f2f6 +SHA512 (container-selinux-db771da.tar.gz) = 880d656b56e94d4045073cfaf4738bbcf5bcd91f451bafa523ca4df6aed20f7fa2074f8b9bb2dc28bf33a3acd981e6fc349919bf6e7f3c946cc046dc66014a89 From 42c03a171f7db5994311b55b1e0b9c88f09664ce Mon Sep 17 00:00:00 2001 From: "Lokesh Mandvekar (Bot)" Date: Mon, 15 Jul 2019 02:25:08 +0000 Subject: [PATCH 17/35] container-selinux-2:2.109.0-2.gitdb771da - bump to 2.109.0 - autobuilt db771da Signed-off-by: Lokesh Mandvekar (Bot) --- container-selinux.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/container-selinux.spec b/container-selinux.spec index 5b20d9b..e5b88ce 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -26,8 +26,8 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.109 -Release: 1.git%{shortcommit0}%{?dist} +Version: 2.109.0 +Release: 2.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes @@ -109,6 +109,10 @@ fi %{_datadir}/selinux/* %changelog +* Mon Jul 15 2019 Lokesh Mandvekar (Bot) - 2:2.109.0-2.gitdb771da +- bump to 2.109.0 +- autobuilt db771da + * Mon Jul 8 2019 Dan Walsh - 2.109-1 - Allow containers to accept connections on all socket types - Allow containers to connect to gssproxy stream sockets if added to container From 800ae5382208235bf6b91fb89f42776af1ebbd1d Mon Sep 17 00:00:00 2001 From: "Lokesh Mandvekar (Bot)" Date: Wed, 17 Jul 2019 13:15:43 +0000 Subject: [PATCH 18/35] container-selinux-2:2.110.0-2.git544d71f - bump to 2.110.0 - autobuilt 544d71f Signed-off-by: Lokesh Mandvekar (Bot) --- .gitignore | 1 + container-selinux.spec | 8 ++++++-- sources | 2 +- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 16379be..0536b0f 100644 --- a/.gitignore +++ b/.gitignore @@ -97,3 +97,4 @@ /container-selinux-fc7111d.tar.gz /container-selinux-453b816.tar.gz /container-selinux-db771da.tar.gz +/container-selinux-544d71f.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index e5b88ce..83bc3df 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/projectatomic/container-selinux -%global commit0 db771da27119098fe9aefb1c02033e496d5c8760 +%global commit0 544d71ff87f427664ff65cfb94b6ad068af689a7 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -26,7 +26,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.109.0 +Version: 2.110.0 Release: 2.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -109,6 +109,10 @@ fi %{_datadir}/selinux/* %changelog +* Wed Jul 17 2019 Lokesh Mandvekar (Bot) - 2:2.110.0-2.git544d71f +- bump to 2.110.0 +- autobuilt 544d71f + * Mon Jul 15 2019 Lokesh Mandvekar (Bot) - 2:2.109.0-2.gitdb771da - bump to 2.109.0 - autobuilt db771da diff --git a/sources b/sources index 2ad7730..eb69337 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-db771da.tar.gz) = 880d656b56e94d4045073cfaf4738bbcf5bcd91f451bafa523ca4df6aed20f7fa2074f8b9bb2dc28bf33a3acd981e6fc349919bf6e7f3c946cc046dc66014a89 +SHA512 (container-selinux-544d71f.tar.gz) = ef4e58d33f095899c75a880cdb8e4fb2dc9523f717666af702e4d87a6ddccf7d9695b009872f42bd4dfae01944ee0335aa4688d6ffd6199efb38aaf29f997d73 From 18222fd21f85a26109b8b585924f9c3ab7457029 Mon Sep 17 00:00:00 2001 From: Lokesh Mandvekar Date: Thu, 18 Jul 2019 18:15:41 +0530 Subject: [PATCH 19/35] build for centos 7 and formatting updates Signed-off-by: Lokesh Mandvekar --- container-selinux.spec | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/container-selinux.spec b/container-selinux.spec index 83bc3df..c100b88 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -1,8 +1,12 @@ -%global debug_package %{nil} +%global debug_package %{nil} # container-selinux -%global git0 https://github.com/projectatomic/container-selinux +%global git0 https://github.com/containers/container-selinux +%if 0%{?fedora} %global commit0 544d71ff87f427664ff65cfb94b6ad068af689a7 +%else +%global commit0 014f8664b9df323e9a49761c54249afa520839af +%endif %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -19,7 +23,7 @@ # Relabel files %global relabel_files() %{_sbindir}/restorecon -R %{_bindir}/*podman* %{_bindir}/*runc* %{_bindir}/*crio %{_bindir}/docker* %{_localstatedir}/run/containerd.sock %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sysconfdir}/docker %{_sysconfdir}/crio %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_unitdir}/docker.service %{_unitdir}/docker-containerd.service %{_unitdir}/docker-latest.service %{_unitdir}/docker-latest-containerd.service %{_sysconfdir}/docker %{_libexecdir}/docker* &> /dev/null || : -# Version of SELinux we were using +# Version of SELinux we are using %global selinux_policyver 3.13.1-220 Name: container-selinux @@ -73,7 +77,7 @@ rm -rf container-selinux.spec %post # Install all modules in a single transaction if [ $1 -eq 1 ]; then - %{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 + %{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi %_format MODULES %{_datadir}/selinux/packages/$x.pp.bz2 %{_sbindir}/semodule -n -s %{selinuxtype} -r container 2> /dev/null @@ -84,8 +88,8 @@ if %{_sbindir}/selinuxenabled ; then %{_sbindir}/load_policy %relabel_files if [ $1 -eq 1 ]; then - restorecon -R %{_sharedstatedir}/docker &> /dev/null || : - restorecon -R %{_sharedstatedir}/containers &> /dev/null || : + restorecon -R %{_sharedstatedir}/docker &> /dev/null || : + restorecon -R %{_sharedstatedir}/containers &> /dev/null || : fi fi . %{_sysconfdir}/selinux/config From 09de749476829f57db1c44015506bac2fa18334a Mon Sep 17 00:00:00 2001 From: Lokesh Mandvekar Date: Thu, 18 Jul 2019 18:20:16 +0530 Subject: [PATCH 20/35] update release tag Signed-off-by: Lokesh Mandvekar --- container-selinux.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/container-selinux.spec b/container-selinux.spec index c100b88..9caf9da 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -31,7 +31,7 @@ Name: container-selinux Epoch: 2 %endif Version: 2.110.0 -Release: 2.git%{shortcommit0}%{?dist} +Release: 2%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes From 4fe4bb10ff9a3a44ebc112a3782206b46452c81b Mon Sep 17 00:00:00 2001 From: "Lokesh Mandvekar (Bot)" Date: Thu, 18 Jul 2019 13:40:16 +0000 Subject: [PATCH 21/35] container-selinux-2:2.111.0-1 - bump to 2.111.0 - autobuilt 9a75deb for fedora - autobuilt 014f866 for centos Signed-off-by: Lokesh Mandvekar (Bot) --- .gitignore | 1 + container-selinux.spec | 11 ++++++++--- sources | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 0536b0f..5d34d21 100644 --- a/.gitignore +++ b/.gitignore @@ -98,3 +98,4 @@ /container-selinux-453b816.tar.gz /container-selinux-db771da.tar.gz /container-selinux-544d71f.tar.gz +/container-selinux-9a75deb.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 9caf9da..1070b3a 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -3,7 +3,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux %if 0%{?fedora} -%global commit0 544d71ff87f427664ff65cfb94b6ad068af689a7 +%global commit0 9a75deb315f10ca3cf1295e6cd56cec2e62dbf6e %else %global commit0 014f8664b9df323e9a49761c54249afa520839af %endif @@ -30,8 +30,8 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.110.0 -Release: 2%{?dist} +Version: 2.111.0 +Release: 1%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes @@ -113,6 +113,11 @@ fi %{_datadir}/selinux/* %changelog +* Thu Jul 18 2019 Lokesh Mandvekar (Bot) - 2:2.111.0-1 +- bump to 2.111.0 +- autobuilt 9a75deb for fedora +- autobuilt 014f866 for centos + * Wed Jul 17 2019 Lokesh Mandvekar (Bot) - 2:2.110.0-2.git544d71f - bump to 2.110.0 - autobuilt 544d71f diff --git a/sources b/sources index eb69337..622439c 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-544d71f.tar.gz) = ef4e58d33f095899c75a880cdb8e4fb2dc9523f717666af702e4d87a6ddccf7d9695b009872f42bd4dfae01944ee0335aa4688d6ffd6199efb38aaf29f997d73 +SHA512 (container-selinux-9a75deb.tar.gz) = 0d6d69f49048a118e40fd6c06b8785e3eed5381ae4fe7d70e836fb61659df748b548deaaaff91eeb7ed466e70114b3c614b88218a58e286df091381706623dec From 9376ad7ceff7fd2026f60eddf2dd35c01a92bb80 Mon Sep 17 00:00:00 2001 From: Lokesh Mandvekar Date: Sat, 20 Jul 2019 04:39:41 +0530 Subject: [PATCH 22/35] ensure sources file records centos branch commit Signed-off-by: Lokesh Mandvekar --- .gitignore | 1 + container-selinux.spec | 5 +++++ sources | 1 + 3 files changed, 7 insertions(+) diff --git a/.gitignore b/.gitignore index 5d34d21..5769123 100644 --- a/.gitignore +++ b/.gitignore @@ -99,3 +99,4 @@ /container-selinux-db771da.tar.gz /container-selinux-544d71f.tar.gz /container-selinux-9a75deb.tar.gz +/container-selinux-014f866.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 1070b3a..fef120c 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -4,6 +4,10 @@ %global git0 https://github.com/containers/container-selinux %if 0%{?fedora} %global commit0 9a75deb315f10ca3cf1295e6cd56cec2e62dbf6e +# record centos commit here as well so it can be added +# to sources file for centos cbs build +%global commit_centos 014f8664b9df323e9a49761c54249afa520839af +%global shortcommit_centos %(c=%{commit_centos}; echo ${c:0:7}) %else %global commit0 014f8664b9df323e9a49761c54249afa520839af %endif @@ -36,6 +40,7 @@ License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes Source0: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz +Source1: %{git0}/archive/%{commit_centos}/%{name}-%{shortcommit_centos}.tar.gz BuildArch: noarch BuildRequires: git BuildRequires: pkgconfig(systemd) diff --git a/sources b/sources index 622439c..798e929 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ +SHA512 (container-selinux-014f866.tar.gz) = 2772e1549283b95bed98e3c189dc8d96b71ae0b7b4ab54dc5882439bf7a9703916ae71a1162154b99834179bb9327741e3393f3c0b95179c3ea271bd4bd6fa20 SHA512 (container-selinux-9a75deb.tar.gz) = 0d6d69f49048a118e40fd6c06b8785e3eed5381ae4fe7d70e836fb61659df748b548deaaaff91eeb7ed466e70114b3c614b88218a58e286df091381706623dec From b2114083bc3ea669359069978e4a3809a394283a Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Thu, 8 Aug 2019 17:23:19 -0400 Subject: [PATCH 23/35] Allow containers to use fusefs_t entrypoint Dontaudit attempts to setattr on devicenodes. --- .gitignore | 2 +- container-selinux.spec | 43 +++++++++++++++++++----------------------- sources | 3 +-- 3 files changed, 21 insertions(+), 27 deletions(-) diff --git a/.gitignore b/.gitignore index 5769123..99e890b 100644 --- a/.gitignore +++ b/.gitignore @@ -99,4 +99,4 @@ /container-selinux-db771da.tar.gz /container-selinux-544d71f.tar.gz /container-selinux-9a75deb.tar.gz -/container-selinux-014f866.tar.gz +/container-selinux-b68cf19.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index fef120c..37ac679 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -1,16 +1,8 @@ -%global debug_package %{nil} +%global debug_package %{nil} # container-selinux %global git0 https://github.com/containers/container-selinux -%if 0%{?fedora} -%global commit0 9a75deb315f10ca3cf1295e6cd56cec2e62dbf6e -# record centos commit here as well so it can be added -# to sources file for centos cbs build -%global commit_centos 014f8664b9df323e9a49761c54249afa520839af -%global shortcommit_centos %(c=%{commit_centos}; echo ${c:0:7}) -%else -%global commit0 014f8664b9df323e9a49761c54249afa520839af -%endif +%global commit0 b68cf19f1c6c920994becf8aa0dc141dec77de2a %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,20 +19,20 @@ # Relabel files %global relabel_files() %{_sbindir}/restorecon -R %{_bindir}/*podman* %{_bindir}/*runc* %{_bindir}/*crio %{_bindir}/docker* %{_localstatedir}/run/containerd.sock %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sysconfdir}/docker %{_sysconfdir}/crio %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_unitdir}/docker.service %{_unitdir}/docker-containerd.service %{_unitdir}/docker-latest.service %{_unitdir}/docker-latest-containerd.service %{_sysconfdir}/docker %{_libexecdir}/docker* &> /dev/null || : -# Version of SELinux we are using +# Version of SELinux we were using %global selinux_policyver 3.13.1-220 +# Hooked up to autobuilder, please check with @lsm5 before updating Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.111.0 -Release: 1%{?dist} +Version: 2.112.0 +Release: 1.dev.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes Source0: %{git0}/archive/%{commit0}/%{name}-%{shortcommit0}.tar.gz -Source1: %{git0}/archive/%{commit_centos}/%{name}-%{shortcommit_centos}.tar.gz BuildArch: noarch BuildRequires: git BuildRequires: pkgconfig(systemd) @@ -117,19 +109,22 @@ fi %doc README.md %{_datadir}/selinux/* +# Hooked up to autobuilder, please check with @lsm5 before updating %changelog -* Thu Jul 18 2019 Lokesh Mandvekar (Bot) - 2:2.111.0-1 +* Thu Aug 8 2019 Dan Walsh - 2.112-1 +- Allow containers to use fusefs_t entrypoint +- Dontaudit attempts to setattr on devicenodes. + +* Wed Jul 24 2019 Fedora Release Engineering - 2:2.111.0-3.1.dev.git9a75deb +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Thu Jul 18 2019 Lokesh Mandvekar (Bot) - 2:2.111.0-2.1.dev.git9a75deb - bump to 2.111.0 -- autobuilt 9a75deb for fedora -- autobuilt 014f866 for centos +- autobuilt 9a75deb -* Wed Jul 17 2019 Lokesh Mandvekar (Bot) - 2:2.110.0-2.git544d71f -- bump to 2.110.0 -- autobuilt 544d71f - -* Mon Jul 15 2019 Lokesh Mandvekar (Bot) - 2:2.109.0-2.gitdb771da -- bump to 2.109.0 -- autobuilt db771da +* Wed Jul 10 2019 Lokesh Mandvekar - 2.110.0-1.1.dev.git544d71f +- bump to v2.110.0 +- hook up to autobuild * Mon Jul 8 2019 Dan Walsh - 2.109-1 - Allow containers to accept connections on all socket types diff --git a/sources b/sources index 798e929..106cee4 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (container-selinux-014f866.tar.gz) = 2772e1549283b95bed98e3c189dc8d96b71ae0b7b4ab54dc5882439bf7a9703916ae71a1162154b99834179bb9327741e3393f3c0b95179c3ea271bd4bd6fa20 -SHA512 (container-selinux-9a75deb.tar.gz) = 0d6d69f49048a118e40fd6c06b8785e3eed5381ae4fe7d70e836fb61659df748b548deaaaff91eeb7ed466e70114b3c614b88218a58e286df091381706623dec +SHA512 (container-selinux-b68cf19.tar.gz) = 25c3133277f55935ca19bdb1703079ba245def284d00c749464626d16d9ca2056dc7e9b6d806ccdf65825e3defc32540c7fbf6acdfc50c430c0da5a80a39e20f From 766e2e72c4c12cbd546b181cd2cce07ed595130e Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 9 Aug 2019 15:11:05 -0400 Subject: [PATCH 24/35] Allow containers to name_bind to rawip_sockets. --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 99e890b..d582e45 100644 --- a/.gitignore +++ b/.gitignore @@ -100,3 +100,4 @@ /container-selinux-544d71f.tar.gz /container-selinux-9a75deb.tar.gz /container-selinux-b68cf19.tar.gz +/container-selinux-4f7d6bb.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 37ac679..778934e 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 b68cf19f1c6c920994becf8aa0dc141dec77de2a +%global commit0 4f7d6bb78724eb2fccd40bbaf96a668a94acc5ce %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.112.0 +Version: 2.113.0 Release: 1.dev.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,9 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Fri Aug 9 2019 Dan Walsh - 2.113-1 +- Allow containers to name_bind to rawip_sockets. + * Thu Aug 8 2019 Dan Walsh - 2.112-1 - Allow containers to use fusefs_t entrypoint - Dontaudit attempts to setattr on devicenodes. diff --git a/sources b/sources index 106cee4..36cc5ee 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-b68cf19.tar.gz) = 25c3133277f55935ca19bdb1703079ba245def284d00c749464626d16d9ca2056dc7e9b6d806ccdf65825e3defc32540c7fbf6acdfc50c430c0da5a80a39e20f +SHA512 (container-selinux-4f7d6bb.tar.gz) = 74c509d0bec92d693f6673610f09346cb8b82520f178a8713064d020f1428e28e23a36200e40fe8db2fff2d1d6117f6ea33cb823a5114ad3041b222066779061 From fb7e8af02d593c0059dbcbb19709d27ba06c69fb Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Mon, 19 Aug 2019 08:10:22 -0400 Subject: [PATCH 25/35] Allow containers to settatr on /proc/self/ lnk_files Allow containers to remount /proc --- .gitignore | 1 + container-selinux.spec | 10 +++++++--- sources | 2 +- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index d582e45..ee0ea80 100644 --- a/.gitignore +++ b/.gitignore @@ -101,3 +101,4 @@ /container-selinux-9a75deb.tar.gz /container-selinux-b68cf19.tar.gz /container-selinux-4f7d6bb.tar.gz +/container-selinux-028ab00.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 778934e..a645052 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 4f7d6bb78724eb2fccd40bbaf96a668a94acc5ce +%global commit0 028ab0049681265664a3bbae7501bc5bddcd6cc0 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,8 +27,8 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.113.0 -Release: 1.dev.git%{shortcommit0}%{?dist} +Version: 2.114.0 +Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes @@ -111,6 +111,10 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Mon Aug 19 2019 Dan Walsh - 2.114-1 +- Allow containers to settatr on /proc/self/ lnk_files +- Allow containers to remount /proc + * Fri Aug 9 2019 Dan Walsh - 2.113-1 - Allow containers to name_bind to rawip_sockets. diff --git a/sources b/sources index 36cc5ee..3be76ab 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-4f7d6bb.tar.gz) = 74c509d0bec92d693f6673610f09346cb8b82520f178a8713064d020f1428e28e23a36200e40fe8db2fff2d1d6117f6ea33cb823a5114ad3041b222066779061 +SHA512 (container-selinux-028ab00.tar.gz) = 96ec9a26a2ceb75431891d5b914921d190df0259443eb245b850d97d5cc8796df3ddc34443d9e144740e43a9540ba295b39f70c3224caf127fa95a532ebb24dc From b6958ea0f18b625337c34d8be2f26cecf631965d Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Wed, 21 Aug 2019 09:57:33 -0400 Subject: [PATCH 26/35] Allow containers to execmod files on fusefs_t --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index ee0ea80..1d09d33 100644 --- a/.gitignore +++ b/.gitignore @@ -102,3 +102,4 @@ /container-selinux-b68cf19.tar.gz /container-selinux-4f7d6bb.tar.gz /container-selinux-028ab00.tar.gz +/container-selinux-fddfbbb.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index a645052..364e334 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 028ab0049681265664a3bbae7501bc5bddcd6cc0 +%global commit0 fddfbbb7836cabeb28feffb4602f4a3ae5016cdb %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.114.0 +Version: 2.115.0 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,9 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Wed Aug 21 2019 Dan Walsh - 2.115-1 +- Allow containers to execmod files on fusefs_t + * Mon Aug 19 2019 Dan Walsh - 2.114-1 - Allow containers to settatr on /proc/self/ lnk_files - Allow containers to remount /proc diff --git a/sources b/sources index 3be76ab..6905754 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-028ab00.tar.gz) = 96ec9a26a2ceb75431891d5b914921d190df0259443eb245b850d97d5cc8796df3ddc34443d9e144740e43a9540ba295b39f70c3224caf127fa95a532ebb24dc +SHA512 (container-selinux-fddfbbb.tar.gz) = 54b17ee82861163633afd44ae6db65a91a6b9b2ebed86df55d0378611b571118c9ef24788d2ad67b730516454fd264e44333f9cb94ff63621ee54586bf5c6eb4 From 37b7696e180e26d2f40297a0eb17f68b780a8992 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Thu, 5 Sep 2019 09:34:54 -0400 Subject: [PATCH 27/35] Don't let container_runtime_t transition to svirt domains. --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 1 + 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 1d09d33..fd3ed0a 100644 --- a/.gitignore +++ b/.gitignore @@ -103,3 +103,4 @@ /container-selinux-4f7d6bb.tar.gz /container-selinux-028ab00.tar.gz /container-selinux-fddfbbb.tar.gz +/container-selinux-c5ef5ac.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 364e334..5bfb23c 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 fddfbbb7836cabeb28feffb4602f4a3ae5016cdb +%global commit0 c5ef5ac658a0d616d53b81272694e778a2115b29 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.115.0 +Version: 2.116.0 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,9 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Thu Sep 5 2019 Dan Walsh - 2.116-1 +- Don't let container_runtime_t transition to svirt domains. + * Wed Aug 21 2019 Dan Walsh - 2.115-1 - Allow containers to execmod files on fusefs_t diff --git a/sources b/sources index 6905754..7441bd0 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ SHA512 (container-selinux-fddfbbb.tar.gz) = 54b17ee82861163633afd44ae6db65a91a6b9b2ebed86df55d0378611b571118c9ef24788d2ad67b730516454fd264e44333f9cb94ff63621ee54586bf5c6eb4 +SHA512 (container-selinux-c5ef5ac.tar.gz) = cb31fb2aa891a21d47cb1f67caf51e39a14f3269155e9881499d8c325f2f9acfa9d49c5e283db99dcc3333eee0cc3798b33bf5bf7cc54701f450cf35762501fb From c49d7bbb079e582086558e109a8075f81fb7f982 Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Fri, 20 Sep 2019 10:04:38 +0200 Subject: [PATCH 28/35] Add label for /usr/bin/crun --- .gitignore | 1 + container-selinux.spec | 7 +++++-- sources | 3 +-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index fd3ed0a..1e866b9 100644 --- a/.gitignore +++ b/.gitignore @@ -104,3 +104,4 @@ /container-selinux-028ab00.tar.gz /container-selinux-fddfbbb.tar.gz /container-selinux-c5ef5ac.tar.gz +/container-selinux-bfde70a.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 5bfb23c..7cd6d8e 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 c5ef5ac658a0d616d53b81272694e778a2115b29 +%global commit0 bfde70abeab100e944dcfd439859fbae967d8b39 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.116.0 +Version: 2.117.0 Release: 1.git%{shortcommit0}%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,9 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Fri Sep 20 2019 Dan Walsh - 2.117-1 +- Add label for /usr/bin/crun + * Thu Sep 5 2019 Dan Walsh - 2.116-1 - Don't let container_runtime_t transition to svirt domains. diff --git a/sources b/sources index 7441bd0..e25d105 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (container-selinux-fddfbbb.tar.gz) = 54b17ee82861163633afd44ae6db65a91a6b9b2ebed86df55d0378611b571118c9ef24788d2ad67b730516454fd264e44333f9cb94ff63621ee54586bf5c6eb4 -SHA512 (container-selinux-c5ef5ac.tar.gz) = cb31fb2aa891a21d47cb1f67caf51e39a14f3269155e9881499d8c325f2f9acfa9d49c5e283db99dcc3333eee0cc3798b33bf5bf7cc54701f450cf35762501fb +SHA512 (container-selinux-bfde70a.tar.gz) = f8e963b9688f65b768e6b0dcb427fe9f47397e70f4889166d8c6eeccbeb9dd393acfa19586870e367ce5eea1d1d2d15ec9acb6fdb7e108c772be137a76ff4b45 From cff91463a930e7df746b342efd2299de345969d6 Mon Sep 17 00:00:00 2001 From: RH Container Bot Date: Fri, 11 Oct 2019 14:39:26 +0000 Subject: [PATCH 29/35] container-selinux-2:2.118.0-2 - bump to v2.118.0 - autobuilt 79bdcb5 for fedora - autobuilt 42087be for centos Signed-off-by: RH Container Bot --- .gitignore | 1 + container-selinux.spec | 11 ++++++++--- sources | 2 +- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1e866b9..e1a3501 100644 --- a/.gitignore +++ b/.gitignore @@ -105,3 +105,4 @@ /container-selinux-fddfbbb.tar.gz /container-selinux-c5ef5ac.tar.gz /container-selinux-bfde70a.tar.gz +/container-selinux-79bdcb5.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 7cd6d8e..0314635 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 bfde70abeab100e944dcfd439859fbae967d8b39 +%global commit0 79bdcb5e74af7036479b61160e4dadf670f1097e %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,8 +27,8 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.117.0 -Release: 1.git%{shortcommit0}%{?dist} +Version: 2.118.0 +Release: 2%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes @@ -111,6 +111,11 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Fri Oct 11 2019 RH Container Bot - 2:2.118.0-2 +- bump to v2.118.0 +- autobuilt 79bdcb5 for fedora +- autobuilt 42087be for centos + * Fri Sep 20 2019 Dan Walsh - 2.117-1 - Add label for /usr/bin/crun diff --git a/sources b/sources index e25d105..5927510 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-bfde70a.tar.gz) = f8e963b9688f65b768e6b0dcb427fe9f47397e70f4889166d8c6eeccbeb9dd393acfa19586870e367ce5eea1d1d2d15ec9acb6fdb7e108c772be137a76ff4b45 +SHA512 (container-selinux-79bdcb5.tar.gz) = 2c0cf0c2996acb156899d543f4139e2530eb07499765f3bd777e29250f726a7affa894e35408d619b557dff368af643184953cf7b8e3c873cf699fda8c38daae From 0f3aed29b0f35de13f77bc2cbb9239d6351f5ed6 Mon Sep 17 00:00:00 2001 From: RH Container Bot Date: Thu, 24 Oct 2019 16:00:18 +0000 Subject: [PATCH 30/35] container-selinux-2:2.119.0-2 - bump to v2.119.0 - autobuilt b383f07 for fedora - autobuilt 42087be for centos Signed-off-by: RH Container Bot --- .gitignore | 1 + container-selinux.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index e1a3501..6c0344f 100644 --- a/.gitignore +++ b/.gitignore @@ -106,3 +106,4 @@ /container-selinux-c5ef5ac.tar.gz /container-selinux-bfde70a.tar.gz /container-selinux-79bdcb5.tar.gz +/container-selinux-b383f07.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 0314635..1d84397 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 79bdcb5e74af7036479b61160e4dadf670f1097e +%global commit0 b383f07f547c3ae491edcd116133f79d6f50a6e7 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.118.0 +Version: 2.119.0 Release: 2%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,11 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Thu Oct 24 2019 RH Container Bot - 2:2.119.0-2 +- bump to v2.119.0 +- autobuilt b383f07 for fedora +- autobuilt 42087be for centos + * Fri Oct 11 2019 RH Container Bot - 2:2.118.0-2 - bump to v2.118.0 - autobuilt 79bdcb5 for fedora diff --git a/sources b/sources index 5927510..e1ba5f8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-79bdcb5.tar.gz) = 2c0cf0c2996acb156899d543f4139e2530eb07499765f3bd777e29250f726a7affa894e35408d619b557dff368af643184953cf7b8e3c873cf699fda8c38daae +SHA512 (container-selinux-b383f07.tar.gz) = 01c47d12460611229654b5ef9961b7815dfa749241d422e83ec548cd029d1113aea1f7a55e8277f5ebceea4528575efe1e09d853eec09adac15efe88c5394eb7 From d0db063667c05ca9910bf2d33862e73a0109f13e Mon Sep 17 00:00:00 2001 From: RH Container Bot Date: Sun, 27 Oct 2019 09:30:42 +0000 Subject: [PATCH 31/35] container-selinux-2:2.119.1-2 - bump to v2.119.1 - autobuilt 2ecb2a8 for fedora - autobuilt c57a6f9 for centos Signed-off-by: RH Container Bot --- .gitignore | 1 + container-selinux.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 6c0344f..4f845af 100644 --- a/.gitignore +++ b/.gitignore @@ -107,3 +107,4 @@ /container-selinux-bfde70a.tar.gz /container-selinux-79bdcb5.tar.gz /container-selinux-b383f07.tar.gz +/container-selinux-2ecb2a8.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 1d84397..07fce34 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 b383f07f547c3ae491edcd116133f79d6f50a6e7 +%global commit0 2ecb2a86fb873956344d2dab7334d97bfb0711fc %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.119.0 +Version: 2.119.1 Release: 2%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,11 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Sun Oct 27 2019 RH Container Bot - 2:2.119.1-2 +- bump to v2.119.1 +- autobuilt 2ecb2a8 for fedora +- autobuilt c57a6f9 for centos + * Thu Oct 24 2019 RH Container Bot - 2:2.119.0-2 - bump to v2.119.0 - autobuilt b383f07 for fedora diff --git a/sources b/sources index e1ba5f8..19820f3 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-b383f07.tar.gz) = 01c47d12460611229654b5ef9961b7815dfa749241d422e83ec548cd029d1113aea1f7a55e8277f5ebceea4528575efe1e09d853eec09adac15efe88c5394eb7 +SHA512 (container-selinux-2ecb2a8.tar.gz) = a4c81a08e2510a9f8db5d203bc038d230e2d114f56bfc1338cade01d4dd9945a2156c227e189cd4975d558675af82e2ecb389c90c368202303860c49b3359540 From 65d5ed337c38802f237cc697356e86fa0632f502 Mon Sep 17 00:00:00 2001 From: RH Container Bot Date: Fri, 6 Dec 2019 19:13:49 +0000 Subject: [PATCH 32/35] container-selinux-2:2.123.0-2 - bump to v2.123.0 - autobuilt 0b25a4a for fedora - autobuilt c57a6f9 for centos Signed-off-by: RH Container Bot --- .gitignore | 1 + container-selinux.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4f845af..4449cbb 100644 --- a/.gitignore +++ b/.gitignore @@ -108,3 +108,4 @@ /container-selinux-79bdcb5.tar.gz /container-selinux-b383f07.tar.gz /container-selinux-2ecb2a8.tar.gz +/container-selinux-0b25a4a.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 07fce34..3b3efe8 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 2ecb2a86fb873956344d2dab7334d97bfb0711fc +%global commit0 0b25a4a5f05e1810f6bbeffcc40d89c3db5d2a30 %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.119.1 +Version: 2.123.0 Release: 2%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,11 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Fri Dec 06 2019 RH Container Bot - 2:2.123.0-2 +- bump to v2.123.0 +- autobuilt 0b25a4a for fedora +- autobuilt c57a6f9 for centos + * Sun Oct 27 2019 RH Container Bot - 2:2.119.1-2 - bump to v2.119.1 - autobuilt 2ecb2a8 for fedora diff --git a/sources b/sources index 19820f3..6bce357 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-2ecb2a8.tar.gz) = a4c81a08e2510a9f8db5d203bc038d230e2d114f56bfc1338cade01d4dd9945a2156c227e189cd4975d558675af82e2ecb389c90c368202303860c49b3359540 +SHA512 (container-selinux-0b25a4a.tar.gz) = 50c1f23670a3beb36afd7689c937da26a9ffeb1a75e6e1a73632201193df7f5ec118b8a0cfe8296eb175ac98440a70270353897933d42d7bbea5b1f90f36e770 From deb231a1582457bd0167552206d31635b59197b7 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 6 Dec 2019 11:19:09 -0800 Subject: [PATCH 33/35] Bump SELinux policy version requirement per zpytela --- container-selinux.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/container-selinux.spec b/container-selinux.spec index 3b3efe8..a17f600 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -20,7 +20,7 @@ %global relabel_files() %{_sbindir}/restorecon -R %{_bindir}/*podman* %{_bindir}/*runc* %{_bindir}/*crio %{_bindir}/docker* %{_localstatedir}/run/containerd.sock %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sysconfdir}/docker %{_sysconfdir}/crio %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_unitdir}/docker.service %{_unitdir}/docker-containerd.service %{_unitdir}/docker-latest.service %{_unitdir}/docker-latest-containerd.service %{_sysconfdir}/docker %{_libexecdir}/docker* &> /dev/null || : # Version of SELinux we were using -%global selinux_policyver 3.13.1-220 +%global selinux_policyver 3.14.3-53 # Hooked up to autobuilder, please check with @lsm5 before updating Name: container-selinux From 1211d57e8c57f8991e137dd4b00e93231a4dd553 Mon Sep 17 00:00:00 2001 From: RH Container Bot Date: Wed, 11 Dec 2019 18:13:36 +0000 Subject: [PATCH 34/35] container-selinux-2:2.124.0-2 - bump to v2.124.0 - autobuilt f958d0c for fedora - autobuilt c57a6f9 for centos Signed-off-by: RH Container Bot --- .gitignore | 1 + container-selinux.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 4449cbb..f079ee5 100644 --- a/.gitignore +++ b/.gitignore @@ -109,3 +109,4 @@ /container-selinux-b383f07.tar.gz /container-selinux-2ecb2a8.tar.gz /container-selinux-0b25a4a.tar.gz +/container-selinux-f958d0c.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index a17f600..9532fc7 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -2,7 +2,7 @@ # container-selinux %global git0 https://github.com/containers/container-selinux -%global commit0 0b25a4a5f05e1810f6bbeffcc40d89c3db5d2a30 +%global commit0 f958d0cee4099f79890247ec64b57502b3acdb9f %global shortcommit0 %(c=%{commit0}; echo ${c:0:7}) # container-selinux stuff (prefix with ds_ for version/release etc.) @@ -27,7 +27,7 @@ Name: container-selinux %if 0%{?fedora} Epoch: 2 %endif -Version: 2.123.0 +Version: 2.124.0 Release: 2%{?dist} License: GPLv2 URL: %{git0} @@ -111,6 +111,11 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Wed Dec 11 2019 RH Container Bot - 2:2.124.0-2 +- bump to v2.124.0 +- autobuilt f958d0c for fedora +- autobuilt c57a6f9 for centos + * Fri Dec 06 2019 RH Container Bot - 2:2.123.0-2 - bump to v2.123.0 - autobuilt 0b25a4a for fedora diff --git a/sources b/sources index 6bce357..e81c4ec 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (container-selinux-0b25a4a.tar.gz) = 50c1f23670a3beb36afd7689c937da26a9ffeb1a75e6e1a73632201193df7f5ec118b8a0cfe8296eb175ac98440a70270353897933d42d7bbea5b1f90f36e770 +SHA512 (container-selinux-f958d0c.tar.gz) = 88a4ccf596233f293118e516bafee8d758e669f292c80e8b25b1a8df956ef0e14e36cb61b53f83b20fc68e9cffe8b100d792197ea311418f11169a437c5893d2 From 9ba33124b58212491535f1e3c69f9bb75cdb7505 Mon Sep 17 00:00:00 2001 From: Jindrich Novy Date: Fri, 3 Jan 2020 13:58:40 +0100 Subject: [PATCH 35/35] container-selinux-2.124.0-3.fc30 - implement spec file refactoring by Zdenek Pytela, namely: Change the uninstall command in the %%postun section of the specfile to use the %%selinux_modules_uninstall macro which uses priority 200. Change the install command in the %%post section if the specfile to use the %%selinux_modules_install macro. Replace relabel commands with using the %%selinux_relabel_pre and %%selinux_relabel_post macros. Change formatting so that the lines are vertically aligned in the %%postun section. (https://github.com/containers/container-selinux/pull/85) Signed-off-by: Jindrich Novy --- .gitignore | 111 ----------------------------------------- container-selinux.spec | 39 ++++++++------- 2 files changed, 21 insertions(+), 129 deletions(-) diff --git a/.gitignore b/.gitignore index f079ee5..05a0e4a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,112 +1 @@ -/container-selinux-513572d.tar.gz -/container-selinux-bcdcb9a.tar.gz -/container-selinux-3bbbad5.tar.gz -/container-selinux-b9809fa.tar.gz -/container-selinux-ba28054.tar.gz -/container-selinux-9e004af.tar.gz -/container-selinux-ce95ddb.tar.gz -/container-selinux-f7333f9.tar.gz -/container-selinux-08bb6e0.tar.gz -/container-selinux-8f8caa6.tar.gz -/container-selinux-14f7c51.tar.gz -/container-selinux-c81ea26.tar.gz -/container-selinux-9027f8e.tar.gz -/container-selinux-ed3082b.tar.gz -/container-selinux-5212fea.tar.gz -/container-selinux-a80afba.tar.gz -/container-selinux-c5fd77f.tar.gz -/container-selinux-c89e9b5.tar.gz -/container-selinux-58324f3.tar.gz -/container-selinux-81ff96c.tar.gz -/container-selinux-a9260d4.tar.gz -/container-selinux-e37e93d.tar.gz -/container-selinux-de38c07.tar.gz -/container-selinux-0620186.tar.gz -/container-selinux-47e0448.tar.gz -/container-selinux-b430a71.tar.gz -/container-selinux-0b666c4.tar.gz -/container-selinux-7fe0136.tar.gz -/container-selinux-dca3b87.tar.gz -/container-selinux-f9a30e8.tar.gz -/container-selinux-d985665.tar.gz -/container-selinux-8ba32a4.tar.gz -/container-selinux-26c642a.tar.gz -/container-selinux-96e58bf.tar.gz -/container-selinux-599072a.tar.gz -/container-selinux-231b213.tar.gz -/container-selinux-d148550.tar.gz -/container-selinux-dfcc97d.tar.gz -/container-selinux-38a982b.tar.gz -/container-selinux-2377c73.tar.gz -/container-selinux-aece4ff.tar.gz -/container-selinux-663e003.tar.gz -/container-selinux-fd7d508.tar.gz -/container-selinux-fd50128.tar.gz -/container-selinux-bdc0137.tar.gz -/container-selinux-55c7d4d.tar.gz -/container-selinux-d248f91.tar.gz -/container-selinux-d213769.tar.gz -/container-selinux-701557f.tar.gz -/container-selinux-97f8dfc.tar.gz -/container-selinux-9b55129.tar.gz -/container-selinux-1ecf953.tar.gz -/container-selinux-284f9e7.tar.gz -/container-selinux-d346375.tar.gz -/container-selinux-bf5b26b.tar.gz -/container-selinux-dfaf8fd.tar.gz -/container-selinux-8ecc282.tar.gz -/container-selinux-0407867.tar.gz -/container-selinux-042f7cf.tar.gz -/container-selinux-25277c8.tar.gz -/container-selinux-c139a3d.tar.gz -/container-selinux-452b90d.tar.gz -/container-selinux-4e73492.tar.gz -/container-selinux-5721d74.tar.gz -/container-selinux-d7a3f33.tar.gz -/container-selinux-a62c2db.tar.gz -/container-selinux-99e2cfd.tar.gz -/container-selinux-87fae85.tar.gz -/container-selinux-5133af6.tar.gz -/container-selinux-2c57a17.tar.gz -/container-selinux-1362777.tar.gz -/container-selinux-6f01752.tar.gz -/container-selinux-1b655d9.tar.gz -/container-selinux-484806a.tar.gz -/container-selinux-21c2be6.tar.gz -/container-selinux-5e1f62f.tar.gz -/container-selinux-ec6fcad.tar.gz -/container-selinux-eb60838.tar.gz -/container-selinux-92af7fd.tar.gz -/container-selinux-c178849.tar.gz -/container-selinux-891a85f.tar.gz -/container-selinux-2c1a2ab.tar.gz -/container-selinux-5c98b56.tar.gz -/container-selinux-2521d0d.tar.gz -/container-selinux-619db17.tar.gz -/container-selinux-acc6941.tar.gz -/container-selinux-1e99f1d.tar.gz -/container-selinux-e3ebc68.tar.gz -/container-selinux-a6c9822.tar.gz -/container-selinux-aa7b807.tar.gz -/container-selinux-9a53d6c.tar.gz -/container-selinux-3b78187.tar.gz -/container-selinux-b0061dc.tar.gz -/container-selinux-1c24dcb.tar.gz -/container-selinux-b275a1f.tar.gz -/container-selinux-7baad79.tar.gz -/container-selinux-fc7111d.tar.gz -/container-selinux-453b816.tar.gz -/container-selinux-db771da.tar.gz -/container-selinux-544d71f.tar.gz -/container-selinux-9a75deb.tar.gz -/container-selinux-b68cf19.tar.gz -/container-selinux-4f7d6bb.tar.gz -/container-selinux-028ab00.tar.gz -/container-selinux-fddfbbb.tar.gz -/container-selinux-c5ef5ac.tar.gz -/container-selinux-bfde70a.tar.gz -/container-selinux-79bdcb5.tar.gz -/container-selinux-b383f07.tar.gz -/container-selinux-2ecb2a8.tar.gz -/container-selinux-0b25a4a.tar.gz /container-selinux-f958d0c.tar.gz diff --git a/container-selinux.spec b/container-selinux.spec index 9532fc7..7e54796 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -16,9 +16,6 @@ # Format must contain '$x' somewhere to do anything useful %global _format() export %1=""; for x in %{modulenames}; do %1+=%2; %1+=" "; done; -# Relabel files -%global relabel_files() %{_sbindir}/restorecon -R %{_bindir}/*podman* %{_bindir}/*runc* %{_bindir}/*crio %{_bindir}/docker* %{_localstatedir}/run/containerd.sock %{_localstatedir}/run/docker.sock %{_localstatedir}/run/docker.pid %{_sysconfdir}/docker %{_sysconfdir}/crio %{_localstatedir}/log/docker %{_localstatedir}/log/lxc %{_localstatedir}/lock/lxc %{_unitdir}/docker.service %{_unitdir}/docker-containerd.service %{_unitdir}/docker-latest.service %{_unitdir}/docker-latest-containerd.service %{_sysconfdir}/docker %{_libexecdir}/docker* &> /dev/null || : - # Version of SELinux we were using %global selinux_policyver 3.14.3-53 @@ -28,7 +25,7 @@ Name: container-selinux Epoch: 2 %endif Version: 2.124.0 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2 URL: %{git0} Summary: SELinux policies for container runtimes @@ -71,6 +68,9 @@ rm -rf container-selinux.spec %check +%pre +%selinux_relabel_pre -s %{selinuxtype} + %post # Install all modules in a single transaction if [ $1 -eq 1 ]; then @@ -80,28 +80,19 @@ fi %{_sbindir}/semodule -n -s %{selinuxtype} -r container 2> /dev/null %{_sbindir}/semodule -n -s %{selinuxtype} -d docker 2> /dev/null %{_sbindir}/semodule -n -s %{selinuxtype} -d gear 2> /dev/null -%{_sbindir}/semodule -n -X 200 -s %{selinuxtype} -i $MODULES > /dev/null -if %{_sbindir}/selinuxenabled ; then - %{_sbindir}/load_policy - %relabel_files - if [ $1 -eq 1 ]; then - restorecon -R %{_sharedstatedir}/docker &> /dev/null || : - restorecon -R %{_sharedstatedir}/containers &> /dev/null || : - fi -fi +%selinux_modules_install -s %{selinuxtype} $MODULES . %{_sysconfdir}/selinux/config sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedir}/containers &> /dev/null || : %postun if [ $1 -eq 0 ]; then -%{_sbindir}/semodule -n -r %{modulenames} &> /dev/null || : -if %{_sbindir}/selinuxenabled ; then -%{_sbindir}/load_policy -%relabel_files -fi + %selinux_modules_uninstall -s %{selinuxtype} %{modulenames} docker fi +%posttrans +%selinux_relabel_post -s %{selinuxtype} + #define license tag if not already defined %{!?_licensedir:%global license %doc} @@ -111,6 +102,18 @@ fi # Hooked up to autobuilder, please check with @lsm5 before updating %changelog +* Fri Jan 03 2020 Jindrich Novy - 2:2.124.0-3 +- implement spec file refactoring by Zdenek Pytela, namely: + Change the uninstall command in the %%postun section of the specfile + to use the %%selinux_modules_uninstall macro which uses priority 200. + Change the install command in the %%post section if the specfile + to use the %%selinux_modules_install macro. + Replace relabel commands with using the %%selinux_relabel_pre and + %%selinux_relabel_post macros. + Change formatting so that the lines are vertically aligned + in the %%postun section. + (https://github.com/containers/container-selinux/pull/85) + * Wed Dec 11 2019 RH Container Bot - 2:2.124.0-2 - bump to v2.124.0 - autobuilt f958d0c for fedora