From 2f22660c9f93c0371b729741bd20c7752847b52d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 07:33:59 +0100 Subject: [PATCH 1/6] Fix manpages pattern https://docs.fedoraproject.org/en-US/packaging-guidelines/#_manpages When installing man pages, note that RPM will re-compress them into its preferred format. So the %files section MUST reference manpages with a pattern that takes this into account: %files %{_mandir}/man1/foo.1* --- policycoreutils.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ca70bcc..7a56a2a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -321,7 +321,7 @@ or level of a logged in user. %files newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole -%{_mandir}/man1/newrole.1.gz +%{_mandir}/man1/newrole.1* %config(noreplace) %{_sysconfdir}/pam.d/newrole %package gui @@ -386,8 +386,8 @@ system-config-selinux is a utility for managing the SELinux environment %{_unitdir}/selinux-autorelabel.target %{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf -%{_mandir}/man5/selinux_config.5.gz -%{_mandir}/man5/sestatus.conf.5.gz +%{_mandir}/man5/selinux_config.5* +%{_mandir}/man5/sestatus.conf.5* %{_mandir}/man8/fixfiles.8* %{_mandir}/man8/load_policy.8* %{_mandir}/man8/restorecon.8* From 3a3585431961a73db8413c40bd67f7e8a401a7a1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 08:06:57 +0100 Subject: [PATCH 2/6] Move %changelog entries to changelog --- changelog | 6 ++++++ policycoreutils.spec | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/changelog b/changelog index 956ef08..faed1db 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + * Tue Jul 29 2025 Miro Hrončok - 3.9-3 - Drop unused BuildRequires on python3-wheel diff --git a/policycoreutils.spec b/policycoreutils.spec index 7a56a2a..ef17aee 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -445,10 +445,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Sep 19 2025 Python Maint - 3.9-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.9-4 -- Rebuilt for Python 3.14.0rc2 bytecode - %autochangelog From 668dfbb056f2ae83b1897683c4792b736a37959e Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 11 Dec 2025 07:31:22 +0100 Subject: [PATCH 3/6] Bring back patches unintentionally dropped before --- changelog | 3 +++ policycoreutils.spec | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/changelog b/changelog index faed1db..c39d307 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Thu Dec 11 2025 Petr Lautrbach - 3.9-6 +- Bring back patches unintentionally dropped before + * Fri Sep 19 2025 Python Maint - 3.9-5 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/policycoreutils.spec b/policycoreutils.spec index ef17aee..19c599d 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -38,6 +38,11 @@ Source23: selinux-sandbox.zip # $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start +Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch +Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 109f2b2f0746042e9106c5466624dafc3a5fb641 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 24 Jul 2025 13:36:35 +0200 Subject: [PATCH 4/6] selinux-autorelabel: Improve comments The original comment of relabel_selinux() no longer applies. The system is restarted either way. Resolves: RHEL-93949 --- selinux-autorelabel | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-autorelabel b/selinux-autorelabel index 5290c8c..1ce0e87 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -30,8 +30,9 @@ efi_set_boot_next() { } relabel_selinux() { - # if /sbin/init is not labeled correctly this process is running in the - # wrong context, so a reboot will be required after relabel + # Switch SELinux to permissive mode, fix labeling issues (or execute shell + # and have the user fix them) and reboot the machine so that the correct + # labels are applied to all services. AUTORELABEL= . /etc/selinux/config echo "0" > /sys/fs/selinux/enforce From e0a0eb0859ae38b1d870c9960074a020b37f6fbd Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 7 Oct 2025 12:26:46 +0200 Subject: [PATCH 5/6] policycoreutils-3.9-7 - semanage: Reset active value when deleting boolean customizations (RHEL-111421) - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) - sepolicy: Fix detection of writeable locations Resolves: RHEL-111421, RHEL-111505 --- ...Fix-detection-of-writeable-locations.patch | 65 ++++++++++++ ...ption-to-disable-SELINUX_RESTORECON_.patch | 91 +++++++++++++++++ ...ctive-value-when-deleting-boolean-cu.patch | 98 +++++++++++++++++++ changelog | 5 + policycoreutils.spec | 5 +- 5 files changed, 263 insertions(+), 1 deletion(-) create mode 100644 0006-sepolicy-Fix-detection-of-writeable-locations.patch create mode 100644 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch create mode 100644 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch diff --git a/0006-sepolicy-Fix-detection-of-writeable-locations.patch b/0006-sepolicy-Fix-detection-of-writeable-locations.patch new file mode 100644 index 0000000..2cd313a --- /dev/null +++ b/0006-sepolicy-Fix-detection-of-writeable-locations.patch @@ -0,0 +1,65 @@ +From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 5 May 2025 18:28:40 +0200 +Subject: [PATCH] sepolicy: Fix detection of writeable locations + +- update substitutions from /etc/dnf/var + +It seems that by default dnf api does not read /etc/dnf/var/* files to +update substitutions and so it can't resolve correct mirror list when a +variable is part of the link. + +- alway run query.run() + +Fixes: + Traceback (most recent call last): + File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load + ret = self._repo.load() + ^^^^^^^^^^^^^^^^^ + File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load + return _repo.Repo_load(self) + ^^^^^^^^^^^^^^^^^^^^^ + libdnf._error.Error: Failed to download metadata for repo 'baseos': + Cannot prepare internal mirrorlist: Status code: 404 for + https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198) + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/generate.py | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index f726ad51..a0314a70 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s; + import dnf + + with dnf.Base() as base: ++ base.conf.substitutions.update_from_etc('/') + base.read_all_repos() + base.fill_sack(load_system_repo=True) + + query = base.sack.query() + +- pq = query.available() +- pq = pq.filter(file=self.program) ++ pq = query.filter(file=self.program) + +- for pkg in pq: ++ for pkg in pq.run(): + self.rpms.append(pkg.name) + for fname in pkg.files: + for b in self.DEFAULT_DIRS: +@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s; + self.add_dir(fname) + sq = query.available() + sq = sq.filter(provides=pkg.source_name) +- for bpkg in sq: ++ for bpkg in sq.run(): + for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": +-- +2.49.0 + diff --git a/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch new file mode 100644 index 0000000..e8ec6ff --- /dev/null +++ b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch @@ -0,0 +1,91 @@ +From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 10 Sep 2025 11:42:09 +0100 +Subject: [PATCH] setfiles: Add -A option to disable + SELINUX_RESTORECON_ADD_ASSOC + +SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with +multiple hard links or bind mounts that have differing contexts. +However doing this involves building a large internal hashtable that +stores the full path of every file examined by setfiles. For +filesystems that have very large numbers of files or long pathnames, +this uses a lot of memory, which makes SELinux relabelling in +constrained memory environments infeasible. + +This adds a new setfiles -A option that disables this tracking. + +For example, using setfiles to relabel a filesystem with 15 million +files took 3.7GB of RAM. Using this option, the same filesystem can +be relabelled in 121MB (albeit with no warnings or errors possible for +conflicting labels, but for our use case we don't care about that.) + +Fixes: https://issues.redhat.com/browse/RHEL-111505 +Signed-off-by: Richard W.M. Jones +Acked-by: Stephen Smalley +--- + policycoreutils/setfiles/setfiles.8 | 5 +++++ + policycoreutils/setfiles/setfiles.c | 11 +++++++---- + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 +index 187f4513..458f3f9f 100644 +--- a/policycoreutils/setfiles/setfiles.8 ++++ b/policycoreutils/setfiles/setfiles.8 +@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. + .RB [ \-I | \-D ] + .RB [ \-T + .IR nthreads ] ++.RB [ \-A ] + .I spec_file + .IR pathname \ ... + +@@ -187,6 +188,10 @@ use up to + threads. Specify 0 to create as many threads as there are available + CPU cores; 1 to use only a single thread (default); or any positive + number to use the given number of threads (if possible). ++.TP ++.B \-A ++do not track inodes with multiple hard links or bind mounts that would ++match different contexts (saves memory) + + .SH "ARGUMENTS" + .TP +diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c +index ad09f840..31034316 100644 +--- a/policycoreutils/setfiles/setfiles.c ++++ b/policycoreutils/setfiles/setfiles.c +@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) + name, name); + } else { + fprintf(stderr, +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" +- "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" ++ "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", + name, name, name); + } + exit(-1); +@@ -147,7 +147,7 @@ int main(int argc, char **argv) + const char *base; + int errors = 0; + const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; +- const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; ++ const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; + const char *opts; + union selinux_callback cb; + long unsigned skipped_errors; +@@ -375,6 +375,9 @@ int main(int argc, char **argv) + if (*optarg == '\0' || *endptr != '\0') + usage(argv[0]); + break; ++ case 'A': ++ r_opts.add_assoc = 0; ++ break; + case 'h': + case '?': + usage(argv[0]); +-- +2.49.0 + diff --git a/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch new file mode 100644 index 0000000..470fde9 --- /dev/null +++ b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch @@ -0,0 +1,98 @@ +From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 1 Sep 2025 18:17:10 +0200 +Subject: [PATCH] semanage: Reset active value when deleting boolean + customizations + +Currently, removal of boolean local customizations leaves their current +(active) value untouched. + +After the removal is complete, semanage_bool_query will return the +default value. But it needs to be called in a separate transaction. +This makes the fix a bit awkward, but I have not found a way to query +the default value before the first transation is committed. + +Fixes: + # getsebool smbd_anon_write + smbd_anon_write --> off + # semanage boolean -m1 smbd_anon_write + # semanage boolean -D + # getsebool smbd_anon_write + smbd_anon_write --> on + # manage boolean -l isemanage boolean --list | grep smbd_anon_write + smbd_anon_write (on , off) Allow smbd to anon write + +Signed-off-by: Vit Mojzis +--- + python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index 10963e81..6d6188fd 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords): + self.__delete(name) + self.commit() + ++ # New transaction to reset the boolean to its default value. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ self.__reset_value(name) ++ self.commit() ++ + def deleteall(self): ++ deleted = [] + (rc, self.blist) = semanage_bool_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list booleans")) +@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords): + + for boolean in self.blist: + name = semanage_bool_get_name(boolean) ++ deleted.append(name) + self.__delete(name) + + self.commit() + ++ # New transaction to reset all affected booleans to their default values. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ ++ for boolean in deleted: ++ self.__reset_value(boolean) ++ ++ self.commit() ++ ++ # Set active value to default ++ # Note: this needs to be called in a new transaction after removing local customizations ++ # in order for semanage_bool_query to fetch the default value ++ # (as opposed to the current one -- set by the local customizations) ++ def __reset_value(self, name): ++ name = selinux.selinux_boolean_sub(name) ++ ++ (rc, k) = semanage_bool_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) ++ ++ (rc, b) = semanage_bool_query(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not query boolean %s") % name) ++ ++ semanage_bool_set_value(b, semanage_bool_get_value(b)) ++ ++ rc = semanage_bool_set_active(self.sh, k, b) ++ if rc < 0: ++ raise ValueError(_("Could not set active value of boolean %s") % name) ++ ++ semanage_bool_key_free(k) ++ semanage_bool_free(b) ++ + def get_all(self, locallist=0): + ddict = {} + if locallist: +-- +2.49.0 + diff --git a/changelog b/changelog index c39d307..45f063d 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,8 @@ +* Thu Dec 11 2025 Vit Mojzis - 3.9-7 +- semanage: Reset active value when deleting boolean customizations (RHEL-111421) +- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) +- sepolicy: Fix detection of writeable locations + * Thu Dec 11 2025 Petr Lautrbach - 3.9-6 - Bring back patches unintentionally dropped before diff --git a/policycoreutils.spec b/policycoreutils.spec index 19c599d..bd0d6c5 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -43,6 +43,9 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch +Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch +Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 1e699f4433984366beee3846578c9d4a030cce21 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 16 Dec 2025 11:00:45 +0100 Subject: [PATCH 6/6] Do not use %autochangelog It can't be used without %autorelease. Use our own macro to add entries from SOURCE3: changelog to %changelog %add_changelog %SOURCE3 Also install changelog to /usr/share/doc/policycoreutils/changelog --- macros | 8 ++++++++ policycoreutils.spec | 12 ++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 macros diff --git a/macros b/macros new file mode 100644 index 0000000..7587d10 --- /dev/null +++ b/macros @@ -0,0 +1,8 @@ +%add_changelog(changelog:) %{lua: + local f = io.open(arg[1], 'r') + if f then + local content = f:read('*all') + f:close() + print(content) + end +} diff --git a/policycoreutils.spec b/policycoreutils.spec index bd0d6c5..29b6242 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -17,6 +17,8 @@ License: GPL-2.0-or-later Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg +Source3: changelog +Source4: macros URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -48,6 +50,9 @@ Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end +# gen_changelog +%{load:%{SOURCE4}} + Obsoletes: policycoreutils < 2.0.61-2 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138 # initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel @@ -177,6 +182,9 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ %find_lang selinux-gui %find_lang selinux-sandbox +# Install changelog to %{_docdir}/%{name} +install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name} + %package python-utils Summary: SELinux policy core python utilities Requires: python3-policycoreutils = %{version}-%{release} @@ -415,7 +423,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} %license policycoreutils/LICENSE -%doc %{_usr}/share/doc/%{name} +%doc %{_docdir}/%{name} %package restorecond Summary: SELinux restorecond utilities @@ -453,4 +461,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -%autochangelog +%add_changelog %SOURCE3