diff --git a/0006-sepolicy-Fix-detection-of-writeable-locations.patch b/0006-sepolicy-Fix-detection-of-writeable-locations.patch deleted file mode 100644 index 2cd313a..0000000 --- a/0006-sepolicy-Fix-detection-of-writeable-locations.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 5 May 2025 18:28:40 +0200 -Subject: [PATCH] sepolicy: Fix detection of writeable locations - -- update substitutions from /etc/dnf/var - -It seems that by default dnf api does not read /etc/dnf/var/* files to -update substitutions and so it can't resolve correct mirror list when a -variable is part of the link. - -- alway run query.run() - -Fixes: - Traceback (most recent call last): - File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load - ret = self._repo.load() - ^^^^^^^^^^^^^^^^^ - File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load - return _repo.Repo_load(self) - ^^^^^^^^^^^^^^^^^^^^^ - libdnf._error.Error: Failed to download metadata for repo 'baseos': - Cannot prepare internal mirrorlist: Status code: 404 for - https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198) - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy/generate.py | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py -index f726ad51..a0314a70 100644 ---- a/python/sepolicy/sepolicy/generate.py -+++ b/python/sepolicy/sepolicy/generate.py -@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s; - import dnf - - with dnf.Base() as base: -+ base.conf.substitutions.update_from_etc('/') - base.read_all_repos() - base.fill_sack(load_system_repo=True) - - query = base.sack.query() - -- pq = query.available() -- pq = pq.filter(file=self.program) -+ pq = query.filter(file=self.program) - -- for pkg in pq: -+ for pkg in pq.run(): - self.rpms.append(pkg.name) - for fname in pkg.files: - for b in self.DEFAULT_DIRS: -@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s; - self.add_dir(fname) - sq = query.available() - sq = sq.filter(provides=pkg.source_name) -- for bpkg in sq: -+ for bpkg in sq.run(): - for fname in bpkg.files: - for b in self.DEFAULT_DIRS: - if b == "/etc": --- -2.49.0 - diff --git a/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch deleted file mode 100644 index e8ec6ff..0000000 --- a/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch +++ /dev/null @@ -1,91 +0,0 @@ -From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001 -From: "Richard W.M. Jones" -Date: Wed, 10 Sep 2025 11:42:09 +0100 -Subject: [PATCH] setfiles: Add -A option to disable - SELINUX_RESTORECON_ADD_ASSOC - -SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with -multiple hard links or bind mounts that have differing contexts. -However doing this involves building a large internal hashtable that -stores the full path of every file examined by setfiles. For -filesystems that have very large numbers of files or long pathnames, -this uses a lot of memory, which makes SELinux relabelling in -constrained memory environments infeasible. - -This adds a new setfiles -A option that disables this tracking. - -For example, using setfiles to relabel a filesystem with 15 million -files took 3.7GB of RAM. Using this option, the same filesystem can -be relabelled in 121MB (albeit with no warnings or errors possible for -conflicting labels, but for our use case we don't care about that.) - -Fixes: https://issues.redhat.com/browse/RHEL-111505 -Signed-off-by: Richard W.M. Jones -Acked-by: Stephen Smalley ---- - policycoreutils/setfiles/setfiles.8 | 5 +++++ - policycoreutils/setfiles/setfiles.c | 11 +++++++---- - 2 files changed, 12 insertions(+), 4 deletions(-) - -diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index 187f4513..458f3f9f 100644 ---- a/policycoreutils/setfiles/setfiles.8 -+++ b/policycoreutils/setfiles/setfiles.8 -@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. - .RB [ \-I | \-D ] - .RB [ \-T - .IR nthreads ] -+.RB [ \-A ] - .I spec_file - .IR pathname \ ... - -@@ -187,6 +188,10 @@ use up to - threads. Specify 0 to create as many threads as there are available - CPU cores; 1 to use only a single thread (default); or any positive - number to use the given number of threads (if possible). -+.TP -+.B \-A -+do not track inodes with multiple hard links or bind mounts that would -+match different contexts (saves memory) - - .SH "ARGUMENTS" - .TP -diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c -index ad09f840..31034316 100644 ---- a/policycoreutils/setfiles/setfiles.c -+++ b/policycoreutils/setfiles/setfiles.c -@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) - name, name); - } else { - fprintf(stderr, -- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" -- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" -- "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", -+ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" -+ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" -+ "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", - name, name, name); - } - exit(-1); -@@ -147,7 +147,7 @@ int main(int argc, char **argv) - const char *base; - int errors = 0; - const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; -- const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; -+ const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; - const char *opts; - union selinux_callback cb; - long unsigned skipped_errors; -@@ -375,6 +375,9 @@ int main(int argc, char **argv) - if (*optarg == '\0' || *endptr != '\0') - usage(argv[0]); - break; -+ case 'A': -+ r_opts.add_assoc = 0; -+ break; - case 'h': - case '?': - usage(argv[0]); --- -2.49.0 - diff --git a/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch deleted file mode 100644 index 470fde9..0000000 --- a/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch +++ /dev/null @@ -1,98 +0,0 @@ -From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Mon, 1 Sep 2025 18:17:10 +0200 -Subject: [PATCH] semanage: Reset active value when deleting boolean - customizations - -Currently, removal of boolean local customizations leaves their current -(active) value untouched. - -After the removal is complete, semanage_bool_query will return the -default value. But it needs to be called in a separate transaction. -This makes the fix a bit awkward, but I have not found a way to query -the default value before the first transation is committed. - -Fixes: - # getsebool smbd_anon_write - smbd_anon_write --> off - # semanage boolean -m1 smbd_anon_write - # semanage boolean -D - # getsebool smbd_anon_write - smbd_anon_write --> on - # manage boolean -l isemanage boolean --list | grep smbd_anon_write - smbd_anon_write (on , off) Allow smbd to anon write - -Signed-off-by: Vit Mojzis ---- - python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++ - 1 file changed, 43 insertions(+) - -diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py -index 10963e81..6d6188fd 100644 ---- a/python/semanage/seobject.py -+++ b/python/semanage/seobject.py -@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords): - self.__delete(name) - self.commit() - -+ # New transaction to reset the boolean to its default value. -+ # Calling __reset_value in the same transaction as the removal of -+ # local customizations does nothing -+ self.begin() -+ self.__reset_value(name) -+ self.commit() -+ - def deleteall(self): -+ deleted = [] - (rc, self.blist) = semanage_bool_list_local(self.sh) - if rc < 0: - raise ValueError(_("Could not list booleans")) -@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords): - - for boolean in self.blist: - name = semanage_bool_get_name(boolean) -+ deleted.append(name) - self.__delete(name) - - self.commit() - -+ # New transaction to reset all affected booleans to their default values. -+ # Calling __reset_value in the same transaction as the removal of -+ # local customizations does nothing -+ self.begin() -+ -+ for boolean in deleted: -+ self.__reset_value(boolean) -+ -+ self.commit() -+ -+ # Set active value to default -+ # Note: this needs to be called in a new transaction after removing local customizations -+ # in order for semanage_bool_query to fetch the default value -+ # (as opposed to the current one -- set by the local customizations) -+ def __reset_value(self, name): -+ name = selinux.selinux_boolean_sub(name) -+ -+ (rc, k) = semanage_bool_key_create(self.sh, name) -+ if rc < 0: -+ raise ValueError(_("Could not create a key for %s") % name) -+ -+ (rc, b) = semanage_bool_query(self.sh, k) -+ if rc < 0: -+ raise ValueError(_("Could not query boolean %s") % name) -+ -+ semanage_bool_set_value(b, semanage_bool_get_value(b)) -+ -+ rc = semanage_bool_set_active(self.sh, k, b) -+ if rc < 0: -+ raise ValueError(_("Could not set active value of boolean %s") % name) -+ -+ semanage_bool_key_free(k) -+ semanage_bool_free(b) -+ - def get_all(self, locallist=0): - ddict = {} - if locallist: --- -2.49.0 - diff --git a/changelog b/changelog index 45f063d..956ef08 100644 --- a/changelog +++ b/changelog @@ -1,17 +1,3 @@ -* Thu Dec 11 2025 Vit Mojzis - 3.9-7 -- semanage: Reset active value when deleting boolean customizations (RHEL-111421) -- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) -- sepolicy: Fix detection of writeable locations - -* Thu Dec 11 2025 Petr Lautrbach - 3.9-6 -- Bring back patches unintentionally dropped before - -* Fri Sep 19 2025 Python Maint - 3.9-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.9-4 -- Rebuilt for Python 3.14.0rc2 bytecode - * Tue Jul 29 2025 Miro Hrončok - 3.9-3 - Drop unused BuildRequires on python3-wheel diff --git a/macros b/macros deleted file mode 100644 index 7587d10..0000000 --- a/macros +++ /dev/null @@ -1,8 +0,0 @@ -%add_changelog(changelog:) %{lua: - local f = io.open(arg[1], 'r') - if f then - local content = f:read('*all') - f:close() - print(content) - end -} diff --git a/policycoreutils.spec b/policycoreutils.spec index 29b6242..ca70bcc 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,14 +11,12 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 7%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg -Source3: changelog -Source4: macros URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -40,19 +38,8 @@ Source23: selinux-sandbox.zip # $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch -Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch -Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch -Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end -# gen_changelog -%{load:%{SOURCE4}} - Obsoletes: policycoreutils < 2.0.61-2 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138 # initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel @@ -182,9 +169,6 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ %find_lang selinux-gui %find_lang selinux-sandbox -# Install changelog to %{_docdir}/%{name} -install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name} - %package python-utils Summary: SELinux policy core python utilities Requires: python3-policycoreutils = %{version}-%{release} @@ -337,7 +321,7 @@ or level of a logged in user. %files newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole -%{_mandir}/man1/newrole.1* +%{_mandir}/man1/newrole.1.gz %config(noreplace) %{_sysconfdir}/pam.d/newrole %package gui @@ -402,8 +386,8 @@ system-config-selinux is a utility for managing the SELinux environment %{_unitdir}/selinux-autorelabel.target %{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf -%{_mandir}/man5/selinux_config.5* -%{_mandir}/man5/sestatus.conf.5* +%{_mandir}/man5/selinux_config.5.gz +%{_mandir}/man5/sestatus.conf.5.gz %{_mandir}/man8/fixfiles.8* %{_mandir}/man8/load_policy.8* %{_mandir}/man8/restorecon.8* @@ -423,7 +407,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} %license policycoreutils/LICENSE -%doc %{_docdir}/%{name} +%doc %{_usr}/share/doc/%{name} %package restorecond Summary: SELinux restorecond utilities @@ -461,4 +445,10 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -%add_changelog %SOURCE3 +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + +%autochangelog diff --git a/selinux-autorelabel b/selinux-autorelabel index 1ce0e87..5290c8c 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -30,9 +30,8 @@ efi_set_boot_next() { } relabel_selinux() { - # Switch SELinux to permissive mode, fix labeling issues (or execute shell - # and have the user fix them) and reboot the machine so that the correct - # labels are applied to all services. + # if /sbin/init is not labeled correctly this process is running in the + # wrong context, so a reboot will be required after relabel AUTORELABEL= . /etc/selinux/config echo "0" > /sys/fs/selinux/enforce