From 07240ecb026fe9603cc0eaa152d5340ada32e0bb Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <lautrbach@redhat.com>
Date: Tue, 20 Aug 2024 11:02:43 +0200
Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames

When a file name in type transition rule used in an interface is same as
a keyword, it needs to be M4 escaped so that the keyword is not expanded
by M4, e.g.

-	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
+	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")

But sepolgen-ifgen could not parse such string:

    # sepolgen-ifgen
    Illegal character '`'

This change allows M4 escaping inside quoted strings and fixed described
problem.

https://bugzilla.redhat.com/show_bug.cgi?id=2254206
---
 ...gen-ifgen-allow-M4-escaped-filenames.patch | 44 +++++++++++++++++++
 changelog                                     |  9 ++++
 policycoreutils.spec                          |  9 +---
 3 files changed, 55 insertions(+), 7 deletions(-)
 create mode 100644 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch

diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch
new file mode 100644
index 0000000..7468c97
--- /dev/null
+++ b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch
@@ -0,0 +1,44 @@
+From dc3eca6bd964e545fda4a1e19d07c26a347c5d9a Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Mon, 19 Aug 2024 19:51:51 +0200
+Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames
+Content-type: text/plain
+
+When a file name in type transition rule used in an interface is same as
+a keyword, it needs to be M4 escaped so that the keyword is not expanded
+by M4, e.g.
+
+-	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
++	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
+
+But sepolgen-ifgen could not parse such string:
+
+    # sepolgen-ifgen
+    Illegal character '`'
+
+This change allows M4 escaping inside quoted strings and fixed described
+problem.
+
+https://bugzilla.redhat.com/show_bug.cgi?id=2254206
+
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ python/sepolgen/src/sepolgen/refparser.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
+index e261d3f78f87..9622ee9a29ce 100644
+--- a/python/sepolgen/src/sepolgen/refparser.py
++++ b/python/sepolgen/src/sepolgen/refparser.py
+@@ -261,7 +261,7 @@ def t_IDENTIFIER(t):
+     return t
+ 
+ def t_FILENAME(t):
+-    r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"'
++    r'\"`*[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\'*\"'
+     # Handle any keywords
+     t.type = reserved.get(t.value,'FILENAME')
+     return t
+-- 
+2.46.0
+
diff --git a/changelog b/changelog
index 16332d6..250c934 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,12 @@
+* Tue Aug 20 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.7-4
+- sepolgen-ifgen: allow M4 escaped filenames
+
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.7-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.7-2
+- Rebuilt for the bin-sbin merge
+
 * Thu Jun 27 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.7-1
 - SELinux userspace 3.7 release
 
diff --git a/policycoreutils.spec b/policycoreutils.spec
index e38ebed..8c3dfa7 100644
--- a/policycoreutils.spec
+++ b/policycoreutils.spec
@@ -11,7 +11,7 @@
 Summary: SELinux policy core utilities
 Name:    policycoreutils
 Version: 3.7
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: GPL-2.0-or-later
 # https://github.com/SELinuxProject/selinux/wiki/Releases
 Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz
@@ -43,6 +43,7 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch
 Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
 Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch
 Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch
+Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch
 # Patch list end
 
 Obsoletes: policycoreutils < 2.0.61-2
@@ -446,10 +447,4 @@ The policycoreutils-restorecond package contains the restorecond service.
 %systemd_postun_with_restart restorecond.service
 
 %changelog
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.7-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.7-2
-- Rebuilt for the bin-sbin merge
-
 %autochangelog