Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

With the 1f76e522a ("Rename all /var/run file context entries to /run")
selinux-policy commit, all /var/run file context entries moved to /run
and the equivalency was inverted. Subsequently, changes in mrtg.fc
need to be done, too, in a similar manner.
Together with that, the "/run/lock = /var/lock" equivalency was also
inverted and entries moved.

.gitignore

@@ -1,12 +1,2 @@
-mrtg-2.16.3.tar.gz
-mrtg-2.16.3.tar.gz.md5.gpg
-/mrtg-2.16.4.tar.gz
-/mrtg-2.16.4.tar.gz.md5
-/mrtg-2.17.0.tar.gz
-/mrtg-2.17.0.tar.gz.md5
-/mrtg-2.17.2.tar.gz
-/mrtg-2.17.2.tar.gz.md5
-/mrtg-2.17.3.tar.gz
-/mrtg-2.17.3.tar.gz.md5
-/mrtg-2.17.4.tar.gz
-/mrtg-2.17.4.tar.gz.md5
+/mrtg-2.17.10.tar.gz
+/mrtg-2.17.10.tar.gz.md5

mrtg-2.15.0-lib64.patch

@@ -1,9 +1,7 @@
-Blech, give us a relatively simple way to drop in "lib" or "lib64", as
-appropriate.  Needs fixing to be more correct.
-
---- mrtg-2.15.0/bin/cfgmaker.lib64	2006-12-06 01:10:06.000000000 +0100
-+++ mrtg-2.15.0/bin/cfgmaker	2006-12-06 12:35:16.000000000 +0100
-@@ -44,7 +44,7 @@
+diff -up mrtg-2.17.7/bin/cfgmaker.orig mrtg-2.17.7/bin/cfgmaker
+--- mrtg-2.17.7/bin/cfgmaker.orig	2018-07-13 08:09:56.000000000 +0200
++++ mrtg-2.17.7/bin/cfgmaker	2018-08-08 13:07:38.419241131 +0200
+@@ -44,7 +44,7 @@ BEGIN {
  
  use FindBin;
  use lib "${FindBin::Bin}";
@@ -12,20 +10,10 @@ appropriate.  Needs fixing to be more correct.
  
  use MRTG_lib "2.100015";
  use Getopt::Long;
---- mrtg-2.15.0/bin/mrtg-traffic-sum.lib64	2006-12-06 12:37:19.000000000 +0100
-+++ mrtg-2.15.0/bin/mrtg-traffic-sum	2006-12-06 12:38:18.000000000 +0100
-@@ -23,7 +23,7 @@
- 
- use FindBin;
- use lib "${FindBin::Bin}";
--use lib "${FindBin::Bin}${main::SL}..${main::SL}lib${main::SL}mrtg2";
-+use lib "${FindBin::Bin}${main::SL}..${main::SL}@@lib@@${main::SL}mrtg2";
- use MRTG_lib "2.090017";
- use POSIX qw(mktime);
- 
---- mrtg-2.15.0/bin/indexmaker.lib64	2006-12-06 01:10:06.000000000 +0100
-+++ mrtg-2.15.0/bin/indexmaker	2006-12-06 12:35:16.000000000 +0100
-@@ -48,7 +48,7 @@
+diff -up mrtg-2.17.7/bin/indexmaker.orig mrtg-2.17.7/bin/indexmaker
+--- mrtg-2.17.7/bin/indexmaker.orig	2018-07-13 08:09:56.000000000 +0200
++++ mrtg-2.17.7/bin/indexmaker	2018-08-08 13:08:41.187309764 +0200
+@@ -48,7 +48,7 @@ BEGIN {
  
  use FindBin;
  use lib "${FindBin::Bin}";
@@ -34,9 +22,10 @@ appropriate.  Needs fixing to be more correct.
  
  use MRTG_lib "2.100016";
  use Getopt::Long;
---- mrtg-2.15.0/bin/mrtg.lib64	2006-12-06 01:10:06.000000000 +0100
-+++ mrtg-2.15.0/bin/mrtg	2006-12-06 12:35:16.000000000 +0100
-@@ -81,7 +81,7 @@
+diff -up mrtg-2.17.7/bin/mrtg.orig mrtg-2.17.7/bin/mrtg
+--- mrtg-2.17.7/bin/mrtg.orig	2018-07-13 08:09:56.000000000 +0200
++++ mrtg-2.17.7/bin/mrtg	2018-08-08 13:09:07.459338491 +0200
+@@ -81,7 +81,7 @@ ERR
  
  use FindBin;
  use lib "${FindBin::Bin}";
@@ -45,3 +34,15 @@ appropriate.  Needs fixing to be more correct.
  use Getopt::Long;
  use Math::BigFloat;
  
+diff -up mrtg-2.17.7/bin/mrtg-traffic-sum.orig mrtg-2.17.7/bin/mrtg-traffic-sum
+--- mrtg-2.17.7/bin/mrtg-traffic-sum.orig	2017-03-05 15:09:52.000000000 +0100
++++ mrtg-2.17.7/bin/mrtg-traffic-sum	2018-08-08 13:08:17.650284034 +0200
+@@ -33,7 +33,7 @@ BEGIN {
+ 
+ use FindBin;
+ use lib "${FindBin::Bin}";
+-use lib "${FindBin::Bin}${main::SL}..${main::SL}lib${main::SL}mrtg2";
++use lib "${FindBin::Bin}${main::SL}..${main::SL}@@lib@@${main::SL}mrtg2";
+ use MRTG_lib "2.090017";
+ use POSIX qw(mktime);
+ 

mrtg-2.17.2-socket6-fix.patch

@@ -1,7 +1,7 @@
-diff -up mrtg-2.17.3/bin/mrtg.orig mrtg-2.17.3/bin/mrtg
---- mrtg-2.17.3/bin/mrtg.orig	2011-12-07 14:24:11.926747910 +0100
-+++ mrtg-2.17.3/bin/mrtg	2011-12-07 14:25:33.522162313 +0100
-@@ -300,7 +300,7 @@ sub main {
+diff -up mrtg-2.17.7/bin/mrtg.orig mrtg-2.17.7/bin/mrtg
+--- mrtg-2.17.7/bin/mrtg.orig	2018-08-08 13:09:59.682296406 +0200
++++ mrtg-2.17.7/bin/mrtg	2018-08-08 13:11:01.089173582 +0200
+@@ -302,7 +302,7 @@ sub main {
      if ($cfg{enableipv6} eq 'yes') {
          if ( eval {local $SIG{__DIE__};require Socket; require Socket6; require IO::Socket::INET6;}) {
              import Socket;
@@ -10,14 +10,14 @@ diff -up mrtg-2.17.3/bin/mrtg.orig mrtg-2.17.3/bin/mrtg
              debug('base', "IPv6 libraries found, IPv6 enabled.");
          } else {
              warn "$NOW: WARNING: IPv6 libraries not found, IPv6 disabled.\n";
-diff -up mrtg-2.17.3/lib/mrtg2/SNMP_Session.pm.orig mrtg-2.17.3/lib/mrtg2/SNMP_Session.pm
---- mrtg-2.17.3/lib/mrtg2/SNMP_Session.pm.orig	2011-12-07 14:25:45.606223538 +0100
-+++ mrtg-2.17.3/lib/mrtg2/SNMP_Session.pm	2011-12-07 14:27:21.593713162 +0100
+diff -up mrtg-2.17.7/lib/mrtg2/SNMP_Session.pm.orig mrtg-2.17.7/lib/mrtg2/SNMP_Session.pm
+--- mrtg-2.17.7/lib/mrtg2/SNMP_Session.pm.orig	2018-07-13 08:09:56.000000000 +0200
++++ mrtg-2.17.7/lib/mrtg2/SNMP_Session.pm	2018-08-08 13:13:15.361988807 +0200
 @@ -146,7 +146,7 @@ BEGIN {
  
      if (eval {local $SIG{__DIE__};require Socket6;} &&
         eval {local $SIG{__DIE__};require IO::Socket::INET6; IO::Socket::INET6->VERSION("1.26");}) {
--       Socket6->import(qw(pack_sockaddr_in6 inet_pton getaddrinfo unpack_sockaddr_in6));
+-       Socket6->import(qw(pack_sockaddr_in6 inet_pton getaddrinfo));
 +       Socket6->import(qw(inet_pton getaddrinfo inet_ntop));
  	$ipv6_addr_len = length(pack_sockaddr_in6(161, inet_pton(AF_INET6(), "::1")));
  	$SNMP_Session::ipv6available = 1;
@@ -26,7 +26,7 @@ diff -up mrtg-2.17.3/lib/mrtg2/SNMP_Session.pm.orig mrtg-2.17.3/lib/mrtg2/SNMP_S
  BEGIN {
      if($SNMP_Session::ipv6available) {
  	    import IO::Socket::INET6;
--        Socket6->import(qw(pack_sockaddr_in6 inet_pton getaddrinfo unpack_sockaddr_in6));
+-        Socket6->import(qw(pack_sockaddr_in6 inet_pton getaddrinfo));
 +        Socket6->import(qw(inet_pton getaddrinfo inet_ntop));
      }
  }

mrtg-2.17.4-cfgmaker-ifhighspeed.patch

@@ -1,9 +1,9 @@
-diff -up mrtg-2.17.4/bin/cfgmaker.orig mrtg-2.17.4/bin/cfgmaker
---- mrtg-2.17.4/bin/cfgmaker.orig	2012-06-28 13:26:04.457533598 +0200
-+++ mrtg-2.17.4/bin/cfgmaker	2012-06-28 13:27:50.514045178 +0200
+diff -up mrtg-2.17.10/bin/cfgmaker.orig mrtg-2.17.10/bin/cfgmaker
+--- mrtg-2.17.10/bin/cfgmaker.orig	2022-01-20 08:05:38.441966441 +0100
++++ mrtg-2.17.10/bin/cfgmaker	2022-01-20 08:05:59.947909140 +0100
 @@ -224,7 +224,7 @@ sub InterfaceInfo($$$$$) {
  #            maximum value (4,294,967,295) and ifHighSpeed must be used
- #            to report the interace's speed.  For a sub-layer which has
+ #            to report the interface's speed.  For a sub-layer which has
  #            no concept of bandwidth, this object should be zero."
 -            if ( (not defined $value) || ($value == 2**32-1) ) {
 +            if ( (not defined $value) || ($value == 2**32-1) || ($value == 2**32-2)) {

mrtg-2.17.4-cfgmaker-uninitialized-value.patch

@@ -1,42 +0,0 @@
-diff -up mrtg-2.17.4/bin/cfgmaker.orig mrtg-2.17.4/bin/cfgmaker
---- mrtg-2.17.4/bin/cfgmaker.orig	2015-09-07 13:12:23.960003553 +0200
-+++ mrtg-2.17.4/bin/cfgmaker	2015-09-07 13:13:16.694253515 +0200
-@@ -1369,22 +1369,23 @@ sub addrouter() {
-             # tenderly and populate the $$flags{}{} hashes accordingly.
-             for my $g (@{$$opt{"global"}}) {
-                 my ($t,$fs);
--                $g =~ /^options\[([_^\$])\]:\s*(.*)$/i;
--                $t = $1;
--                $fs = $2;
--                $t =~ s/_/default/;
--                $t =~ s/\^/prepend/;
--                $t =~ s/\$/append/;
-+                if ($g =~ /^options\[([_^\$])\]:\s*(.*)$/i) {
-+                    $t = $1;
-+                    $fs = $2;
-+                    $t =~ s/_/default/;
-+                    $t =~ s/\^/prepend/;
-+                    $t =~ s/\$/append/;
- 
--                # If a line like "options[X]:" is found clear
--                # all flags for that category and then go to next
--                # --global 'Options[..' line if any.
--                if ($fs =~ /^\s*$/) {
--                    $$flags{$t} = {};
--                    next;
--                } else {
--                    for my $f (split /\s*,\s*/,$fs) {
--                        $$flags{$t}{$f} = "set";
-+                    # If a line like "options[X]:" is found clear
-+                    # all flags for that category and then go to next
-+                    # --global 'Options[..' line if any.
-+                    if ($fs =~ /^\s*$/) {
-+                        $$flags{$t} = {};
-+                        next;
-+                    } else {
-+                        for my $f (split /\s*,\s*/,$fs) {
-+                            $$flags{$t}{$f} = "set";
-+                        }
-                     }
-                 }
-             }

mrtg-configure-c99.patch

@@ -0,0 +1,32 @@
+Avoid an implicit declaration of exit.  This prevents compilation
+failures in case compilers switch to rejecting implicit function
+declarations by default.
+
+Submitted upstream: <https://github.com/oetiker/mrtg/pull/104>
+
+diff --git a/configure b/configure
+index 07b0fbda88c3847a..8b87d2750822c02b 100755
+--- a/configure
++++ b/configure
+@@ -3670,7 +3670,7 @@ else
+                 char buffer[1000];
+                 sprintf (buffer, "%${format}u", a);
+                 sscanf (buffer, "%${format}u", &b);
+-                exit (b!=a);
++                return b!=a;
+             }
+ 
+ _ACEOF
+diff --git a/configure.ac b/configure.ac
+index 1416f3c2d6e2f645..939725ccf306fb2f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -37,7 +37,7 @@ AC_CACHE_VAL(mr_cv_long_long_format_specifier,[
+                 char buffer[1000];
+                 sprintf (buffer, "%${format}u", a);
+                 sscanf (buffer, "%${format}u", &b);
+-                exit (b!=a);
++                return b!=a;
+             }
+             ]])],[mr_cv_long_long_format_specifier="%${format}d"
+             mr_cv_long_long_format="${format}d"

mrtg.fc

@@ -0,0 +1,16 @@
+/etc/mrtg.*	gen_context(system_u:object_r:mrtg_etc_t,s0)
+/etc/mrtg/mrtg\.ok	--	gen_context(system_u:object_r:mrtg_lock_t,s0)
+
+/etc/rc\.d/init\.d/mrtg	--	gen_context(system_u:object_r:mrtg_initrc_exec_t,s0)
+
+/usr/bin/mrtg	--	gen_context(system_u:object_r:mrtg_exec_t,s0)
+
+/var/lib/mrtg(/.*)?	gen_context(system_u:object_r:mrtg_var_lib_t,s0)
+
+/run/lock/mrtg(/.*)?	gen_context(system_u:object_r:mrtg_lock_t,s0)
+/run/lock/mrtg-rrd(/.*)?	gen_context(system_u:object_r:mrtg_lock_t,s0)
+/run/lock/subsys/mrtg	--	gen_context(system_u:object_r:mrtg_lock_t,s0)
+
+/var/log/mrtg.*	gen_context(system_u:object_r:mrtg_log_t,s0)
+
+/run/mrtg\.pid	--	gen_context(system_u:object_r:mrtg_var_run_t,s0)

mrtg.if

@@ -0,0 +1,88 @@
+## <summary>Network traffic graphing.</summary>
+
+########################################
+## <summary>
+##	Read mrtg lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mrtg_read_lib_files',`
+	gen_require(`
+		type mrtg_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+    read_files_pattern($1, mrtg_var_lib_t, mrtg_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Create and append mrtg log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`mrtg_append_create_logs',`
+	gen_require(`
+		type mrtg_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, mrtg_log_t, mrtg_log_t)
+	create_files_pattern($1, mrtg_log_t, mrtg_log_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate an mrtg environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`mrtg_admin',`
+	gen_require(`
+		type mrtg_t, mrtg_var_run_t, mrtg_initrc_exec_t;
+		type mrtg_var_lib_t, mrtg_lock_t, mrtg_log_t;
+		type mrtg_etc_t;
+	')
+
+	allow $1 mrtg_t:process { ptrace signal_perms };
+	ps_process_pattern($1, mrtg_t)
+
+	init_labeled_script_domtrans($1, mrtg_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 mrtg_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	files_search_etc($1)
+	admin_pattern($1, mrtg_etc_t)
+
+	files_search_locks($1)
+	admin_pattern($1, mrtg_lock_t)
+
+	logging_search_logs($1)
+	admin_pattern($1, mrtg_log_t)
+
+	files_search_pids($1)
+	admin_pattern($1, mrtg_var_run_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, mrtg_var_lib_t)
+')

mrtg.service

@@ -30,7 +30,7 @@ ExecStart=/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --c
 # - RunAsDaemon: no; (periodic invocation) :
 #Type=oneshot
 Type=simple
-StandardOutput=syslog
+LogLevelMax=notice
 
 [Install]
 WantedBy=multi-user.target

mrtg.spec

@@ -3,10 +3,15 @@
 %global contentdir       %{_localstatedir}/www/%{name}
 %global libdir           %{_localstatedir}/lib/mrtg
 
+# defining macros needed by SELinux
+%global with_selinux 1
+%global selinuxtype targeted
+%global modulename mrtg
+
 Summary:   Multi Router Traffic Grapher
 Name:      mrtg
-Version:   2.17.4
-Release:   21%{?dist}
+Version:   2.17.10
+Release:   12%{?dist}
 URL:       http://oss.oetiker.ch/mrtg/
 Source0:   http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz
 Source1:   http://oss.oetiker.ch/mrtg/pub/mrtg-%{version}.tar.gz.md5
@@ -24,22 +29,32 @@ Source7:   mrtg.tmpfiles
 Source8:   mrtg.service
 # Source9: systemd timer file
 Source9:   mrtg.timer
+# Source100-102: selinux policy for mrtg, extracted
+# from https://github.com/fedora-selinux/selinux-policy
+Source100: %{modulename}.te
+Source101: %{modulename}.if
+Source102: %{modulename}.fc
 Patch0:    mrtg-2.15.0-lib64.patch
-Patch2:    mrtg-2.17.2-socket6-fix.patch
-# Patch3: some devices return 2**32-2 on ifSpeed (e. g. IBM FibreChannel switches)
-Patch3:    mrtg-2.17.4-cfgmaker-ifhighspeed.patch
-# Patch4: fix uninitialized value errors in cfgmaker
-Patch4:    mrtg-2.17.4-cfgmaker-uninitialized-value.patch
-License:   GPLv2+
-Group:     Applications/Internet
+Patch1:    mrtg-2.17.2-socket6-fix.patch
+# Patch2: some devices return 2**32-2 on ifSpeed (e. g. IBM FibreChannel switches)
+Patch2:    mrtg-2.17.4-cfgmaker-ifhighspeed.patch
+Patch3:    mrtg-configure-c99.patch
+License:   GPL-2.0-or-later
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
-Requires:  perl-Socket6 perl-IO-Socket-INET6
+Requires:  perl-Socket6 perl-IO-Socket-INET6 perl-locale
 Requires:  gd
+%if 0%{?with_selinux}
+# This ensures that the *-selinux package and all it’s dependencies are not pulled
+# into containers and other systems that do not use SELinux
+Requires:  (%{name}-selinux if selinux-policy-%{selinuxtype})
+%endif
+BuildRequires: make
 BuildRequires: gd-devel, libpng-devel
 BuildRequires: perl-generators
 BuildRequires: systemd-units
+BuildRequires: gcc
 
 %global __find_requires %{SOURCE3}
 %global __find_provides %{SOURCE6}
@@ -49,12 +64,26 @@ The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic
 load on network-links. MRTG generates HTML pages containing PNG
 images which provide a LIVE visual representation of this traffic.
 
+%if 0%{?with_selinux}
+# SELinux subpackage
+%package selinux
+Summary:   mrtg SELinux policy
+BuildArch: noarch
+Requires:  selinux-policy-%{selinuxtype}
+Requires(post): selinux-policy-%{selinuxtype}
+BuildRequires: selinux-policy-devel
+%{?selinux_requires}
+
+%description selinux
+Custom SELinux policy module
+%endif
+
 %prep
 %setup -q
-%patch0 -p1 -b .lib64
-%patch2 -p1 -b .socket6
-%patch3 -p1 -b .ifhighspeed
-%patch4 -p1 -b .cfgmaker-uninitialized-value
+%patch -P0 -p1 -b .lib64
+%patch -P1 -p1 -b .socket6
+%patch -P2 -p1 -b .ifhighspeed
+%patch -P3 -p1 -b .c99
 
 for i in doc/mrtg-forum.1 doc/mrtg-squid.1 CHANGES; do
     iconv -f iso-8859-1 -t utf-8 < "$i" > "${i}_"
@@ -74,6 +103,15 @@ find contrib -type f -exec \
 find contrib -name "*.pl" -exec %{__perl} -e 's;\015;;gi' -p -i \{\} \;
 find contrib -type f | xargs chmod a-x
 
+%if 0%{?with_selinux}
+# SELinux policy (originally from selinux-policy-contrib)
+# this policy module will override the production module
+mkdir selinux
+cp -p %{SOURCE100} %{SOURCE101} %{SOURCE102} selinux/
+make -f %{_datadir}/selinux/devel/Makefile %{modulename}.pp
+bzip2 -9 %{modulename}.pp
+%endif
+
 %install
 rm -rf   $RPM_BUILD_ROOT
 make install DESTDIR=$RPM_BUILD_ROOT
@@ -106,9 +144,13 @@ done
 
 sed -i 's;@@lib@@;%{_lib};g' "$RPM_BUILD_ROOT"%{_mandir}/man1/*.1
 
+%if 0%{?with_selinux}
+install -D -m 0644 %{modulename}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
+install -D -p -m 0644 selinux/%{modulename}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
+%endif
+
 %post
 install -d -m 0755 -o root -g root /var/lock/mrtg
-restorecon /var/lock/mrtg
 %systemd_post mrtg.service
 
 %preun
@@ -121,8 +163,31 @@ fi
 %postun
 %systemd_postun_with_restart mrtg.service 
 
+%if 0%{?with_selinux}
+# SELinux contexts are saved so that only affected files can be
+# relabeled after the policy module installation
+%pre selinux
+%selinux_relabel_pre -s %{selinuxtype}
+
+%post selinux
+%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.bz2
+%selinux_relabel_post -s %{selinuxtype}
+
+if [ "$1" -le "1" ]; then # First install
+   # the service needs to be restarted for the custom label to be applied
+   %systemd_postun_with_restart mrtg.service &> /dev/null || :
+fi
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s %{selinuxtype} %{modulename}
+    %selinux_relabel_post -s %{selinuxtype}
+fi
+%endif
+
 %files
-%doc contrib CHANGES COPYING COPYRIGHT README THANKS
+%license COPYING
+%doc contrib CHANGES COPYRIGHT README THANKS
 %dir %{_sysconfdir}/mrtg
 %config(noreplace) %{_sysconfdir}/mrtg/mrtg.cfg
 %config(noreplace) %{_sysconfdir}/httpd/conf.d/mrtg.conf
@@ -139,7 +204,114 @@ fi
 %{_unitdir}/mrtg.service
 %{_unitdir}/mrtg.timer
 
+%if 0%{?with_selinux}
+%files selinux
+%{_datadir}/selinux/packages/%{selinuxtype}/%{modulename}.pp.*
+%{_datadir}/selinux/devel/include/distributed/%{modulename}.if
+%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
+%endif
+
 %changelog
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue Feb 04 2025 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-11
+- Remove redundand restorecon call, redirect safe to ignore output
+  to /dev/null, mark module directory to avoid rpm verification
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Tue Apr 25 2023 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-5
+- SPDX migration
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Fri Dec 16 2022 Florian Weimer <fweimer@redhat.com> - 2.17.10-3
+- Port configure script to C99
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Thu Jan 20 2022 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.10-1
+- Update to mrtg-2.17.10
+  Resolves: #2041965
+
+* Thu Sep 23 2021 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.8-1
+- Update to mrtg-2.17.8
+  Resolves: #1990765
+
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Tue Jun 08 2021 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-12
+- Ship interface file within -selinux subpackage
+
+* Tue May 18 2021 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-11
+- Remove deprecated StandardOutput=syslog
+- Add LogLevelMax=notice to avoid loggin each start/stop of the service
+  when mrtg.timer is used
+  Resolves: #911766
+
+* Mon Apr 12 2021 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-10
+- Incorporate -selinux subpackage
+  See https://fedoraproject.org/wiki/SELinux/IndependentPolicy
+
+* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.17.7-9
+- Rebuilt for updated systemd-rpm-macros
+  See https://pagure.io/fesco/issue/2583.
+
+* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Mon Nov 09 2020 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-7
+- Add Requires perl-locale
+  Resolves: #1895580
+
+* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.7-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Oct 18 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-2
+- Fix mrtg-traffic-sum incorrectly ignores 'man' option
+  Resolves: #1612188
+
+* Thu Aug 09 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.7-1
+- Use %%license
+- Update to mrtg-2.17.7
+  Resolves: #1600933
+
+* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Thu Feb 22 2018 Vitezslav Crhonek <vcrhonek@redhat.com> - 2.17.4-23
+- Add BuildRequires gcc
+- Remove Group tag
+
+* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
 * Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.17.4-21
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
 

mrtg.te

@@ -0,0 +1,149 @@
+policy_module(mrtg, 1.9.0)
+
+########################################
+#
+# Declarations
+#
+
+type mrtg_t;
+type mrtg_exec_t;
+init_system_domain(mrtg_t, mrtg_exec_t)
+
+type mrtg_initrc_exec_t;
+init_script_file(mrtg_initrc_exec_t)
+
+type mrtg_etc_t;
+files_config_file(mrtg_etc_t)
+
+type mrtg_lock_t;
+files_lock_file(mrtg_lock_t)
+
+type mrtg_log_t;
+logging_log_file(mrtg_log_t)
+
+type mrtg_var_lib_t;
+files_type(mrtg_var_lib_t)
+
+type mrtg_var_run_t;
+files_pid_file(mrtg_var_run_t)
+
+########################################
+#
+# Local policy
+#
+
+allow mrtg_t self:capability { chown setgid setuid };
+dontaudit mrtg_t self:capability sys_tty_config;
+allow mrtg_t self:process signal_perms;
+allow mrtg_t self:fifo_file rw_fifo_file_perms;
+
+allow mrtg_t mrtg_etc_t:dir list_dir_perms;
+allow mrtg_t mrtg_etc_t:file read_file_perms;
+allow mrtg_t mrtg_etc_t:lnk_file read_lnk_file_perms;
+
+allow mrtg_t mrtg_lock_t:dir manage_dir_perms;
+allow mrtg_t mrtg_lock_t:file manage_file_perms;
+allow mrtg_t mrtg_lock_t:lnk_file manage_lnk_file_perms;
+files_lock_filetrans(mrtg_t, mrtg_lock_t, { dir file })
+
+manage_dirs_pattern(mrtg_t, mrtg_log_t, mrtg_log_t)
+append_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t)
+create_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t)
+setattr_files_pattern(mrtg_t, mrtg_log_t, mrtg_log_t)
+logging_log_filetrans(mrtg_t, mrtg_log_t, { dir file })
+
+manage_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t)
+manage_lnk_files_pattern(mrtg_t, mrtg_var_lib_t, mrtg_var_lib_t)
+
+allow mrtg_t mrtg_var_run_t:file manage_file_perms;
+files_pid_filetrans(mrtg_t, mrtg_var_run_t, file)
+
+kernel_read_system_state(mrtg_t)
+kernel_read_network_state(mrtg_t)
+kernel_read_kernel_sysctls(mrtg_t)
+
+corecmd_exec_bin(mrtg_t)
+corecmd_exec_shell(mrtg_t)
+
+corenet_all_recvfrom_netlabel(mrtg_t)
+corenet_tcp_sendrecv_generic_if(mrtg_t)
+corenet_tcp_sendrecv_generic_node(mrtg_t)
+
+corenet_sendrecv_all_client_packets(mrtg_t)
+corenet_tcp_connect_all_ports(mrtg_t)
+corenet_tcp_sendrecv_all_ports(mrtg_t)
+
+dev_read_sysfs(mrtg_t)
+dev_read_urand(mrtg_t)
+
+domain_use_interactive_fds(mrtg_t)
+domain_dontaudit_search_all_domains_state(mrtg_t)
+
+files_getattr_tmp_dirs(mrtg_t)
+files_read_etc_runtime_files(mrtg_t)
+files_search_var(mrtg_t)
+files_search_locks(mrtg_t)
+files_search_var_lib(mrtg_t)
+files_search_spool(mrtg_t)
+
+fs_search_auto_mountpoints(mrtg_t)
+fs_getattr_all_fs(mrtg_t)
+fs_list_inotifyfs(mrtg_t)
+
+term_dontaudit_use_console(mrtg_t)
+
+init_use_fds(mrtg_t)
+init_use_script_ptys(mrtg_t)
+init_read_utmp(mrtg_t)
+init_dontaudit_write_utmp(mrtg_t)
+
+auth_use_nsswitch(mrtg_t)
+
+libs_read_lib_files(mrtg_t)
+
+logging_send_syslog_msg(mrtg_t)
+
+selinux_dontaudit_getattr_dir(mrtg_t)
+
+userdom_use_inherited_user_terminals(mrtg_t)
+userdom_dontaudit_read_user_home_content_files(mrtg_t)
+userdom_dontaudit_use_unpriv_user_fds(mrtg_t)
+userdom_dontaudit_list_admin_dir(mrtg_t)
+
+netutils_domtrans_ping(mrtg_t)
+
+ifdef(`enable_mls',`
+	corenet_udp_sendrecv_lo_if(mrtg_t)
+')
+
+optional_policy(`
+	apache_manage_sys_content(mrtg_t)
+')
+
+optional_policy(`
+	cron_system_entry(mrtg_t, mrtg_exec_t)
+')
+
+optional_policy(`
+	hostname_exec(mrtg_t)
+')
+
+optional_policy(`
+	hddtemp_domtrans(mrtg_t)
+')
+
+optional_policy(`
+	seutil_sigchld_newrole(mrtg_t)
+')
+
+optional_policy(`
+	quota_dontaudit_getattr_db(mrtg_t)
+')
+
+optional_policy(`
+	snmp_read_snmp_var_lib_files(mrtg_t)
+')
+
+optional_policy(`
+	udev_read_db(mrtg_t)
+')

sources

@@ -1,2 +1,2 @@
-197565e97f97212eef7b414463c8d40c  mrtg-2.17.4.tar.gz
-606cfe9387ac7b43bf3981977189c124  mrtg-2.17.4.tar.gz.md5
+SHA512 (mrtg-2.17.10.tar.gz) = b1c5232f1b3dcec39adc4fb5a423738f9470ad470e91c6a918cf3f875e71af263d8e03694c3d66129b2653fa498d8d9d9b95349fe90e9d2e0b3ed6c09d06e080
+SHA512 (mrtg-2.17.10.tar.gz.md5) = 3969a24f542daa4e513ab03dc6ced38160818e7ddfdf35f7c4c4323442d8cd35314baba0f5c443634e1d409769b6a9f4bebfa5ea970bec8ff1fcd7bcfd1c7d5d

tests/tests-DSP.yml

@@ -0,0 +1,37 @@
+- hosts: localhost
+
+  roles:
+  - role: standard-test-beakerlib
+    tags:
+    - classic
+    repositories:
+      - repo: https://pagure.io/DSP_test.git
+        dest: DSP_test
+        version: master
+
+    tests:
+    - DSP_test
+    environment:
+      # RPM package containing the policy module
+      TEST_RPM: mrtg-selinux
+      # policy module name
+      TEST_POLICY: mrtg
+      # policy sources will be extracted from corresponding .src.rpm
+      # policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
+      # or empty string if policy sources are not inside a tar archive
+      POLICY_TAR: ''
+      # path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
+      # can contain wildcards (e.g. for versions etc.)
+      POLICY_PATH: .
+
+    required_packages:
+    - policycoreutils
+    - selinux-policy
+    - selinux-policy-targeted
+    - setools-console
+    - libselinux-utils
+    - rpm
+    - tar
+    - git
+    - mrtg