From 1959cc983fc2598d5032c85c70849ef5ef94842b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 28 Nov 2024 21:58:25 +0100 Subject: [PATCH 01/22] SELinux userspace 3.8-rc1 release --- .gitignore | 2 + ...t-be-verbose-if-you-are-not-on-a-tty.patch | 6 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 4 +- 0004-Use-SHA-2-instead-of-SHA-1.patch | 4 +- ...-sepolicy-Fix-spec-file-dependencies.patch | 4 +- ...gen-ifgen-allow-M4-escaped-filenames.patch | 4 +- ...les-use-grep-F-when-search-in-mounts.patch | 59 --------- bachradsusi.gpg | 121 +++++++++++++++++- policycoreutils.spec | 21 +-- sources | 4 +- 11 files changed, 147 insertions(+), 86 deletions(-) delete mode 100644 0007-fixfiles-use-grep-F-when-search-in-mounts.patch diff --git a/.gitignore b/.gitignore index 1b551bf..ddc70f1 100644 --- a/.gitignore +++ b/.gitignore @@ -357,3 +357,5 @@ policycoreutils-2.0.83.tgz /selinux-3.6.tar.gz /selinux-3.7.tar.gz /selinux-3.7.tar.gz.asc +/selinux-3.8-rc1.tar.gz +/selinux-3.8-rc1.tar.gz.asc diff --git a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index aaea883..e319d1d 100644 --- a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 7030465cd94d22aef6824e46df69f82b256195c8 Mon Sep 17 00:00:00 2001 +From 12f57453e8b53a8aab6d3581fd1a4c921fe36918 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -9,7 +9,7 @@ Content-type: text/plain 1 file changed, 1 insertion(+) diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index cb50fef3ca65..13ac07414c14 100755 +index b7cd765c15e4..f2518e96e34c 100755 --- a/policycoreutils/scripts/fixfiles +++ b/policycoreutils/scripts/fixfiles @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() { @@ -21,5 +21,5 @@ index cb50fef3ca65..13ac07414c14 100755 THREADS="" RPMFILES="" -- -2.44.0 +2.47.0 diff --git a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch index 1ff3536..996113f 100644 --- a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From 856ac05345d8557a38e82d012a4d13b4d34efd6f Mon Sep 17 00:00:00 2001 +From fb7357cd097801fcdfa21ed49a17a3875db05e42 Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index adf65f27a822..f726ad51b775 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.44.0 +2.47.0 diff --git a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 91b36be..9c77d93 100644 --- a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From 8f7a90cb77a79aaef2ceca75bc25679a7b17ff98 Mon Sep 17 00:00:00 2001 +From f2092a1b859a028f2c5c79b41c70b135ba3ad0fa Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -71,5 +71,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644 if [ -z "$WAYLAND_DISPLAY" ]; then DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -- -2.44.0 +2.47.0 diff --git a/0004-Use-SHA-2-instead-of-SHA-1.patch b/0004-Use-SHA-2-instead-of-SHA-1.patch index 96f6d1d..bcebe4f 100644 --- a/0004-Use-SHA-2-instead-of-SHA-1.patch +++ b/0004-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 4884c917237e53e34d3fc75dcf4f07217cfd7584 Mon Sep 17 00:00:00 2001 +From 4780b755bb1171f5aa4cd7545535839d451a2070 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644 and provided the .B \-n -- -2.44.0 +2.47.0 diff --git a/0005-python-sepolicy-Fix-spec-file-dependencies.patch b/0005-python-sepolicy-Fix-spec-file-dependencies.patch index ff76509..27f1ea1 100644 --- a/0005-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0005-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,4 +1,4 @@ -From cb1b3bdca016edaa90e92b49d51544f8a38cba19 Mon Sep 17 00:00:00 2001 +From 7e8d67e63daebd675284afaf98aa07530659272f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies @@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644 mid_section="""\ -- -2.44.0 +2.47.0 diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch index 7468c97..1149167 100644 --- a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch +++ b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch @@ -1,4 +1,4 @@ -From dc3eca6bd964e545fda4a1e19d07c26a347c5d9a Mon Sep 17 00:00:00 2001 +From d95931cc190b18e9c405e19dccfa6290269a84df Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 19 Aug 2024 19:51:51 +0200 Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames @@ -40,5 +40,5 @@ index e261d3f78f87..9622ee9a29ce 100644 t.type = reserved.get(t.value,'FILENAME') return t -- -2.46.0 +2.47.0 diff --git a/0007-fixfiles-use-grep-F-when-search-in-mounts.patch b/0007-fixfiles-use-grep-F-when-search-in-mounts.patch deleted file mode 100644 index b36d220..0000000 --- a/0007-fixfiles-use-grep-F-when-search-in-mounts.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 23e9ed5aa00cab872ad18f492eab25af464885b4 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 13 Nov 2024 12:20:32 +0100 -Subject: [PATCH] fixfiles: use `grep -F` when search in mounts -Content-type: text/plain - -systemd escapes luks uid so that mount points contain '\' and grep -should not consider this as regexp -Fixes: - $ cat /proc/self/mounts | sort | uniq | awk '{print $2}' - /run/credentials/systemd-cryptsetup@luks\134x2d6d1f41e6\134x2d5538\134x2d41a0\134x2db383\134x2cd41c2ddcacaa.service - - $ sudo fixfiles -B onboot - grep: Invalid back reference - grep: Invalid back reference - System will relabel on next boot - -Suggested-by: Christopher Tubbs -Signed-off-by: Petr Lautrbach ---- - policycoreutils/scripts/fixfiles | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles -index 13ac07414c14..f2518e96e34c 100755 ---- a/policycoreutils/scripts/fixfiles -+++ b/policycoreutils/scripts/fixfiles -@@ -45,9 +45,9 @@ FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`" - for i in $FS; do - if [ `useseclabel` -ge 0 ] - then -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i - else -- grep " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i -+ grep -F " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i - fi - done - } -@@ -55,14 +55,14 @@ done - get_rw_labeled_mounts() { - FS=`get_all_labeled_mounts | sort | uniq` - for i in $FS; do -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i - done - } - - get_ro_labeled_mounts() { - FS=`get_all_labeled_mounts | sort | uniq` - for i in $FS; do -- grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i -+ grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i - done - } - --- -2.47.0 - diff --git a/bachradsusi.gpg b/bachradsusi.gpg index ff4e382..aa060bb 100644 --- a/bachradsusi.gpg +++ b/bachradsusi.gpg @@ -316,6 +316,123 @@ kAIi0B1szn0K13qRqBIwjnWL+orP1KLzvczCH6yD0FZY90CDdMtM0VB6AqT4BFh6 5+ygjA4YiA7fFYBm8510ybUcNfzU3gUIJ5pF8MdGizO54tCPSK6U+iVRY4qfCFdu IiOZ7FUUn78VIxQUMYMrozy7kn/0PQZa7KKRbXJ8sg0sgrQapwpgUjdMwuYZPGGv 1Jw5/+WUGWMbGxmlpHcEOmsPZpITH557M/kHyk9Ud0iKwciBI2mGLxiafCuLrUY4 -TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfg== -=I8Dr +TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfpkCDQRnKRF7ARAAo5H9/6cStbyjWFeb +G6qDn6pT+4v1rlbRZo0rYwWkDmEAjOZMRC9SJipTCdQeNFlv6HEiiCvl3bmZIqrZ ++zvLI6U1+2dH7k06xNqIFLTV0zbr+tUkOwspg5nr59KsuNP01WBS0ELzunO/zHj+ +BOEdPg1KvB0IQFtqAwaAfuny67YvTr9O7Yz07ZCfTxPtHf6FJ80FPeRa0LoZYnW4 +UmSGtm1f59VD9+qe4yhRtNanamXUKjf8BTw0rQwjoJhVT5Mg0Z6hW6fhFrD57Lgd +8fBi5ZHHUlR4z1+nqGCUoHlHjc0JVyK8j8fofKafow/79ITaOqBzv+P3psY9ecBg +7wGaOHrqzRzRxAfKYRO2IaFHRGnsEE8FnwSEL00uPVxpiiTavrLJFEjku9GmP3OY +3rbwIPXbw1m9mZG1yAVbSEEf58WSWeoBp0O6qrwAdIbdgUX4BkQ8bX5MtUjXp5tm +0StmjQiZ7O91cg0VuWtrfj/I4E3xtloNzhtG2QLI4s7iAL1orhClxEuZRO9alUCS +cnRvhmw2Dh6sB6i56evcZdUFwxMXOByxfWr0fxX4QlR8jYqMPj7UMNj2PccTBOQX +umIW2cdGEeni9vrE9cLfZRSNCwPWAXWtr1zQW54Jx5DjCGHobQk53Z7kE+MZVAje +gOaT0u50cljBNfJootuln4+gbGMAEQEAAbQlUGV0ciBMYXV0cmJhY2ggPGxhdXRy +YmFjaEByZWRoYXQuY29tPokCVwQTAQgAQRYhBGjSGCM0KhNoOus+TvtMaFtdwcE+ +BQJnKRF7AhsDBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEPtM +aFtdwcE+doMQAI5mnNA8aH0dfeOZnz/NrMwY6H7jK/+lYatCx05e1TfK+zz9feRK +sxgP3Pjj0p9igo3jIdPcN5/YnlmVEeplDmSiKOOdendviy+sA8sukMo07Q+m1pYW +NzFtyiZd+c44mp9I1l7h6rktIY9XDedrlAkNog1VlUet9eNpmgXt2OmJNDmYftWc +KIpyw/ZLaubjRcAmxwsn7I6dWnT66Ffg9H8trcRlWipVWP8imO0EIpwC8RbhuNgk +xjt/cVf3CEpzokF4n0k3nqYmt90NNtGc0kG5QAlTvlUuHpNWzuzvdAPtMy3KEaXI +fu3IEZeIKCxSgWXTm7zRKUn0F6jKAsLXhK/WOA1Aa7NdAUwMxrEndfNoqBrusaLD +lpzWU7USv2YT+Pf3aQ7u1szg2J8V5eqRP+E8wwe54RNCgQrcDgUq5abyncsvull3 +GqJvzvZC7/Q3Th/g5Wc+dRaGBz0O9FBuRPQwjrnB932xW1fDf17cScpVKAvV/jwn +tpWXf7nSv2M0o9fihnTBl4d2c2EBKtTdp5W0IpeRl5uLad3AYoouP6RoZ+/Id/Zg +NeaQKH/ZlCxk5S9GLzYhm665ysOYRkh7NfoThRtvAqAeDcTKWGDG1nQok2KKOSyq +S81PT2AlMz7A26R0vsH/9lQ1uZFIhIGbxZXlGERZwXd1s+lgfWTbB5K+iQIzBBAB +CAAdFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmcpGAUACgkQvDkF8jUXnPFdGQ/+ +L7uA7EMB+Yh0urhZuOltZSNtge6b+UbLZTd8DRsf044e+Z0NJWdQ2saLBptGhIcn +as4Qd0gS+QkWB7lMrJ31uux15ZBjFsGtyqK+VoH8JIPvV8Mr5XojqA+UYUpXP6ns +ILrdkUvNzpeA51IxYuVMWcut8SUVYzjD11YG1P8LFzydsImaYe7se+RE85F3/2Po +kZNe0d0Gh36uyfJSND80XrrxLpROgabQgHNG0drL/DHjdoa3F0V5EUoG7NBwUrmB +RlWKYCLUFfW+8mQn6RVK8JIV9WaHrzi/KAZLonZb5dCjO0e+Ol16pyUofLA8SN7B +aqjens8ho297GtE3darkXmj5p3p4YPur/D+oZCNIH+BYMsht46VtE3v6V10P8KA2 +6MgNo5qME1Q0kC1DUYi68cPeDgrQBMWa+nF+m9i2aGeAyi3qDhZu03JLhOYAhv45 +OVRawm9vFqyKiBRANVogTRr+ch4zywaapwfVLQ+xiwVLqlT5n/iIzWCQ0hA15eKZ +gJV0kTXL4OWKBeJqSNnnLVm4AhZ2OpKHMsjE7BEopvCe9JZWFIrjtQ9TrriByOx0 +3anWkmm7b4lZ1HKDOI/Cxyz8BZvYizo7hSOdGjLrFBTD/Wk0swvpzB4NKh5I6N7k +gppXMTaWp36+KmQx66JzaZjepGl1VMNFdgiP6Sw6pO+5Ag0EZykRewEQAK4EY+06 +GeuX4wLlUqAMWCnbFELuhBZGWFLEIvP6WJS1WOvee45RVcpVfYMp3AqymiNRahAl +RMtSQ9YtXSdlBPkhtNcoV/hqjcNywMdbsy+Rs27pRk/DJVC0yVL4ABrSSlwhfNa4 +6X4ZvPr8GGDvjAUhK6NXQ7WrZJxYR9/U0nqRGtGuPBLhFey1H60n5axP8+2f9pFC +NbDJ13HbrhVju+RUeE8Gq5WJI5dea5SfYnXFERsT/zO+pw7ZaaSDmWKR1a88P6Bk +DD7e63ZIaAa849M/Dz+OgzNEgbyRjvgbO0OEIrS2x61lGoW7F9prEgzj97NIiBu6 +qpNCYJefkpfPENrk+wmOUthJfh6E7uphlliQams6dqXAc3Z+xBN9jFf74RpzVmIP +K/MFNr0EcUMFgURpBtaTrk4dGMh++v5i4qKxxwJHf4RsGCDsgH9ZZDemKz5q8uFN +TI1kbTnsKNt+d7L45U+3/mRm4l22g8eu+AvD6R4GfKjsyzEFCyGK7TmVYj0Y+EGR +9+YbRQ1GahXqtrR/aLC09LSyxQTqYfKU8KusnoceEbBOigEZUNPybpzibwHl1VEV +9crR5eT8MPHgs8xdpjQ7gRuPi12fvc83unpUsNIHSCxZqXoilGsz2+zpX2si3PxB +tK/tTo6ZFRLijhHs250Y1agp4MyXYq91A2VTABEBAAGJAjwEGAEIACYWIQRo0hgj +NCoTaDrrPk77TGhbXcHBPgUCZykRewIbDAUJA8JnAAAKCRD7TGhbXcHBPozGD/0Y +fkktGwGq2vPZUI/Fscv+VnEqVt94dBnS0/6GyYvhI7Tf81v+72URlQeX8TUQox9B +8d3Aru5b2+iSkPcvH70PbY8jt/yTwHtSlFzf6+YPIl+oyTz7DoiILSjrO51ntl8g +KmIb8Q9W74xV6VFIJ4m8rH04MKFpIlzUDq660JYQIGtOUFugSfg7aLVU/0j4WKKE +KfAfg93wYTKKd+JgRFy4FZPriem7HvlUSi2VKffdrrUF/PX35X74iKdPQoEADZi8 +KkMZULDtyQ6ZOu2hiDpArjo5hDadKM314Z65VnM11hjiEhmTF3IyGBllb0qBIk0L +nBVHuMYmiqBNJEbaqHLqIju8/RvFlYV+AMISeA7B68knbJcao13ogtDpuJ4hpgCj +j2B1n0NWMcju0gteu1sfsIaQbWHevH2vgl5LJDCNtUJN/NoWB2Uov27wEvsongwY +3du40TnM+5ejwf4r8D3wX+JpVCAhfr3Oc0knw14nRqFPAe1E7DNURJ8xfEV9iPRA +swo6qoh7IIxNETUG1rywRExNt6tHsojx0Wb0I0IB7CnWRK9F6oNRp0S4kVgp+Jeh +a9NGXFK2hn8qBD/rpUPsj/OdkiBN+C7Ai07rCNez+IKdnUfXkOJqLCOyeUwC9WPl +uFPB9RnnghYM4xhMWf8XvSLOOk/vgPxiqR5ANLObsbkCDQRnKRLhARAAuh+b2Oxj +9q+RRZ+pkDVf/M6P01yDmDhwtYHzi/LW8PFHC6iQlzMReyv1R5n3uCEpAZ++mdUe +Cgo2TmFnYdpmxEgdaMIW98uqe4fuHhoXU2Mh4eiN7jyJvXQCsijCDYzifoj03HY7 +nTVjw4+BSSu9kA3/vEqU9A5YjG01MmVSMaIaTrqZqsnypK6r2exJa7YVRYwRqpLY +C5ksikDVK9ftdfhjnsnYGS4pYyfMNSHY1KBMpHjT7wEkM+KZ2WRpjTZZ7nP9u4Lf +fJMKgcclRgf+13CeSaJfVIhjJlxGVLkloE8XJbOeh2vkK257e9BenEFgQnyLCpGJ +8YNsnsJVhxU1aA62dT7jmnOVMBhnGoNhMyzzfvUw0REz2VbpZBkiwZRfZ9MWUBsy +bneH8NwzZMQQLCc/yo/jnPrmDS+tgl4CXGzBtpxPUZSMuY4tHZZ2vBb0zcfhY7P1 +CrHuylXLFzkOO/XRP3w1F8I1UqJCjdTKjdjCDF/VWtedHee1iEsSHxPGH8fHp4Qp +rBDDwZ4NnfilYNHMDWm6U1bzhX2ynqcGArQSd1Ny/oL7JzE1qoH/nNrwVvOSSNWF +UTXFXeLy+SOXJdFJpGP+/wV+gYfyczoUP6vmCdK1Hs15WQvKzyP/nmLS5uLilfxV +KrxZDI6SNrS4f/XkHcGnYByFKUhq5gVN0ZcAEQEAAYkEcgQYAQgAJhYhBGjSGCM0 +KhNoOus+TvtMaFtdwcE+BQJnKRLhAhsCBQkDwmcAAkAJEPtMaFtdwcE+wXQgBBkB +CAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmcpEuEACgkQzcroySfGvjExiQ// +TKQ2Ci+sqNSVIcwg/k0Go1i4cA7lhKNdYRBCaIThB9jMqNg2zgPzgELBcaVJL8xw +0E2x2ZvBejM4X+eTrmkdufcxHR8B/zBF8oPlD2pgs/zZmZEO1gq4Cdab7yIoVNNr +foCZShxOCPR2wIixcYZtt5f7Z3zSXqkjIec6sTOedT75ZXrpQbvINeUkvOJfMCOi +ailauvDfv8k5iJUVbP+Dx1vOc88bvewVJcbLID4HIRr/PS+k1D10zGbnF71TnxGZ +r7anMZCSFCHJ5WV+BSwHHKtxRy+bJ1x9ML45Jcr1anTXeaHIeSKNzFBigJQSgHv0 +euegkD3Rmw+IcxNb4l536selaNR0UAwx1DC1qpjBtnE9/pXdTEsZQxq9kMrj0d+f +VKFjOKADVIpkx7o0dZ1jmbUmdjQVyGDgHE+Emgdd726/2ftWriW2uPeUC6YZiqbt +vBnCnwF+aV6P1nrE0BWJchLyBjDCe5Y2oXBAYF6xwpDPfMPr4oscqzPV4TWVULBi +brtRWgSxmvinIGFx9T9wQCVfX254dqBaAEhRMImoT/YP+6evRZKqQODRhI44OG7u +V71IVAJ8BHEBN8hxvQM3WPs1fhwMBFCyGfr/x/U4/c78R9JhxkU9VwmMbLGQP7VP +1QgfiHqZpHMk8ZUmQn6KLeurzWcnwPFkwgFPZED8OQOMXxAAio3DhWr5KDd3mICH +ALNY0A2ipb/JH6LSHxu0S3MLa/bF6PbqRY1+fKMT/cFVxln99rNUrX+hDRbc7qbh +KkxvGmcnXnkcTHah9bfUghEanlKkBr1g1ik3zgEnpO/x3+X39Ov+ge92MDawV0nq +k9R/9tS+ZD/ph72Q9kx3ZfVNSL0eWxjuwBzFW0Zwh5TAX4raSmyQCmAXi05O3YmN +iq4arSUg5oAOMRZ+d96DsrAS4Sdtlx6/CuKTBzEaGPQLQ9wJNB0Vmd/eQWTP99KY +cAdIwj5BJ5P0Z7+xhsVjQOntn4otnP6vN6RuDtYrS6M7TCN/ZeKCvN/G0nRac4D+ +IJX3CYYtYXgaoDuoetUWtc7O5PzHRETaBt/46ob2lzf6cT5QyVujTfz+i0rGEc63 +pvXK8mV+K7BFY/DHpdEhl1pDw2YYLbBmUthQWdsL6/TVvpMe/wZadvJ/by3AeRzQ +eusUucuSo9UNN7Yj8u3dRhxNgsSiU96A/SFlAoB5s3Onh5K4WEVCBu/INjdi+r2B +LJePSnA3I7VkRE9Haf1D28jtBzm3Xbft2rs3lO18FcCqw6kd7Ih3e0tZ8uUG9UDv +qTDHTUHLAWvwrq38gKKAu2RMaU06A5kR87RcQiizxOwBIwiHuUWMU4/Hyx6fXsOD +hEs0O6AFDarNDZGee2amKTAyZpG5Ag0EZykTxQEQAOwGV1boBD3vDLsoAT62nGxb +SqXiBsObxnpWbNifOzM9BUGPOIpHsSH32PZGG/+LNjNdECfyyP1RysH5OT7j92Q8 +vgRQoG3X985gbOjYyZc0xvAkTSvWxOiy5CuF3X8sJ3NSerQDXwjP9qVqLVj/3FB8 +nka1HFS7KzC3Zo/kzCoxeZ3/hV3PTWIjcoJvtBSCKPZyOJxnRqWfi5BNJo3S2SR1 +mxV967zawXiZ8MeeBl6rLhOfCBtz9g+bqrXZYoenuMn5Js2mcH0haYeMSV3UWIC4 +kinzr1EJxs+L1/hVCVBNiiDc6DXcFXoz9ZVc9kjpZTOMoZVDkRkyOeen+5Sya9wK +4teLmDLME4+pgeHCS/Wa4KrYyEWe7NpG1VTkSJnRS+fyYGTWtwEiuwT6J9U0t1d5 +hbxhM7YAhlnOEnNVmqa3Bq3yqJs9G/7gicZ7CIJ9JBHKTJzOnKfpGhxBSOgOoCOa +WW6uVCzDqfrYPmCUIKQmanB441xJFGuHVPMLBjVjswoMKGkK3gM6KMRCDYQ53u6s +FK+Jcl8HobBSezVIUKpKVX3IW9d506cE0FhSW/NvWJv0FIMVloyC2BpOjSWVgEwX +tk/m3SKPsgCAcCqzi7xlloR8+E9C2xci9cdGG5faghgSjaP6j0qDww/slRPQJc5A +DIeukkOYTCiSiDwQtblJABEBAAGJAjMEGAEIACcWIQRo0hgjNCoTaDrrPk77TGhb +XcHBPgUCZykTxQMbIAQFCQPCZwAAADcWD/4qJRLn7TcMtRMF43Yn+dX+O13YrxBC +T4n1QVmiPsGrUca4Vg1J+trV6IMsGrhktpiaV0qeL/km0h02m4gEDZKDyWWXdeWh +EXFaTVy9yCpSXUWJl5gSXTSwxrqBWyWLlLLk4UT9l9sk5mMdy0JA8unobV4M/eXQ +ggR11DL3ji7aO0hsqxyxXkJcawWjVGW5KL1EaoDKIJ/CwxOI5ipFueMIRQjQvw9A +o/w2fq11qVXY9zknk6pFkp/RDHLes+wVHDtebZfJ9xV7Mb1mf/k03dT56GaA/U3E +XvJ2FdgWR+zf+YMEa9MPDHYo2UNEvk9mOk247M8s+OeexdlkPgyKW5A8mtYuY/dR +j8W6C4pLcMWa+d/vIUpm5Guw0F5q0AWk9/FbBe9HLztEevvRnuHXmfTZeto/nCAi +Yg4pCj6p3JoN5CLebR8YtWm9AJBbX1kgVvqSU2VgwYIFsxBEz8Wu2h7z/eSCSeIg +ARFbTlJ6cBrRkXCVyhbv0LPWWUfAUqiEtdGxrA4Xx/jKrI02JjRdW/bZkXjSka8K ++cDlpcr9ixBWW5LkWsOdiL8jExfTGw25FA7Wd1HiHnBv36Mu/zb+0/I63d+fLq93 +e3lmmVx9qQF8p5Okf4ojY9YoIHVkLS7t9AgFjm/ucmpEGbXxyPk2Cr3l+b5R41x3 +dBW9kxiuWpZN3Q== +=iuRK -----END PGP PUBLIC KEY BLOCK----- \ No newline at end of file diff --git a/policycoreutils.spec b/policycoreutils.spec index bcded22..ee0dd61 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.7-1 -%global libsemanagever 3.7-1 -%global libselinuxver 3.7-1 +%global libsepolver 3.8-0 +%global libsemanagever 3.8-0 +%global libselinuxver 3.8-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,12 +10,12 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.7 -Release: 5%{?dist} +Version: 3.8 +Release: 0.rc1.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,7 +35,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.7 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.8 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -44,7 +44,6 @@ Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch -Patch0007: 0007-fixfiles-use-grep-F-when-search-in-mounts.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -93,7 +92,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version} +%autosetup -p 1 -n selinux-%{version}-rc1 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ @@ -373,6 +372,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_sbindir}/genhomedircon %{_sbindir}/setsebool %{_sbindir}/semodule +%{_sbindir}/unsetfiles %if "%{_sbindir}" != "%{_bindir}" # symlink to %%{_bindir}/sestatus %{_sbindir}/sestatus @@ -401,6 +401,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_mandir}/man8/setfiles.8* %{_mandir}/man8/setsebool.8* %{_mandir}/man1/secon.1* +%{_mandir}/man1/unsetfiles.1* %{_mandir}/man8/genhomedircon.8* %{_mandir}/man8/semodule_expand.8* %{_mandir}/man8/semodule_link.8* diff --git a/sources b/sources index 80536c5..1fa9725 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.7.tar.gz) = f16c3731e27a09306147ffd5b929f55357642da663326edf5837885b36e8fe763ba6a1d18e8ae4001f6091545d06bb11f2d9ed78d69711c0211fbb406bc52345 -SHA512 (selinux-3.7.tar.gz.asc) = d433765388e40b80429eb74784bf107457ef0dd8bdbc2c35c2ad3e687da11d4526a513e344bc6404383cbc61d9ac8e6a8aa5ce8a535db06ce4e2f11aa5b38056 +SHA512 (selinux-3.8-rc1.tar.gz) = 64e4ca41d3558ef4f2af0b26ca1d55d3d2b9badb685dde7acda866fa5ebfb71d80e924a4e314ae1fe83be70a1250dbd1df1c78118cff2b845ccffaf3b4a5c55c +SHA512 (selinux-3.8-rc1.tar.gz.asc) = e974331b53df020367270885a1a54b458b4f8eea4429c5a8bd65770b8ea72ad2d4e46ca4349a730d7db40f5e0796be6fe846e888cb215c750649e98fd7cefc2c From a8be26778e3b6b66f65915aaef6ad5d2c9c7905d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Dec 2024 16:14:46 +0100 Subject: [PATCH 02/22] SELinux userspace 3.8-rc3 release --- .gitignore | 2 + ...gen-ifgen-allow-M4-escaped-filenames.patch | 44 ------------------- changelog | 6 +++ policycoreutils.spec | 15 +++---- sources | 4 +- 5 files changed, 17 insertions(+), 54 deletions(-) delete mode 100644 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch diff --git a/.gitignore b/.gitignore index ddc70f1..2ca0051 100644 --- a/.gitignore +++ b/.gitignore @@ -359,3 +359,5 @@ policycoreutils-2.0.83.tgz /selinux-3.7.tar.gz.asc /selinux-3.8-rc1.tar.gz /selinux-3.8-rc1.tar.gz.asc +/selinux-3.8-rc3.tar.gz +/selinux-3.8-rc3.tar.gz.asc diff --git a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch b/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch deleted file mode 100644 index 1149167..0000000 --- a/0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch +++ /dev/null @@ -1,44 +0,0 @@ -From d95931cc190b18e9c405e19dccfa6290269a84df Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Mon, 19 Aug 2024 19:51:51 +0200 -Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames -Content-type: text/plain - -When a file name in type transition rule used in an interface is same as -a keyword, it needs to be M4 escaped so that the keyword is not expanded -by M4, e.g. - -- filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface") -+ filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''") - -But sepolgen-ifgen could not parse such string: - - # sepolgen-ifgen - Illegal character '`' - -This change allows M4 escaping inside quoted strings and fixed described -problem. - -https://bugzilla.redhat.com/show_bug.cgi?id=2254206 - -Signed-off-by: Petr Lautrbach ---- - python/sepolgen/src/sepolgen/refparser.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py -index e261d3f78f87..9622ee9a29ce 100644 ---- a/python/sepolgen/src/sepolgen/refparser.py -+++ b/python/sepolgen/src/sepolgen/refparser.py -@@ -261,7 +261,7 @@ def t_IDENTIFIER(t): - return t - - def t_FILENAME(t): -- r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"' -+ r'\"`*[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\'*\"' - # Handle any keywords - t.type = reserved.get(t.value,'FILENAME') - return t --- -2.47.0 - diff --git a/changelog b/changelog index 69ae898..d16cc32 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Wed Dec 18 2024 Petr Lautrbach - 3.8-0.rc3.1 +- SELinux userspace 3.8-rc3 release + +* Thu Nov 28 2024 Petr Lautrbach - 3.8-0.rc1.1 +- SELinux userspace 3.8-rc1 release + * Wed Nov 13 2024 Petr Lautrbach - 3.7-5 - fixfiles: use `grep -F` when search in mounts (bz#2323728) diff --git a/policycoreutils.spec b/policycoreutils.spec index ee0dd61..8ba751a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-0 -%global libsemanagever 3.8-0 -%global libselinuxver 3.8-0 +%global libsepolver 3.8-0.rc3 +%global libsemanagever 3.8-0.rc3 +%global libselinuxver 3.8-0.rc3 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc1.1%{?dist} +Release: 0.rc3.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc1/selinux-%{version}-rc1.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -43,7 +43,6 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -92,7 +91,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc1 +%autosetup -p 1 -n selinux-%{version}-rc3 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 1fa9725..aabc995 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8-rc1.tar.gz) = 64e4ca41d3558ef4f2af0b26ca1d55d3d2b9badb685dde7acda866fa5ebfb71d80e924a4e314ae1fe83be70a1250dbd1df1c78118cff2b845ccffaf3b4a5c55c -SHA512 (selinux-3.8-rc1.tar.gz.asc) = e974331b53df020367270885a1a54b458b4f8eea4429c5a8bd65770b8ea72ad2d4e46ca4349a730d7db40f5e0796be6fe846e888cb215c750649e98fd7cefc2c +SHA512 (selinux-3.8-rc3.tar.gz) = 952cf58fd236949df96580f1e98cdde9003c8e783663c8cff391a4b56d3399a71694c756d1ba3141a494386c9b053ad0ca3665ac7dcdd5c6c252be4df6539c31 +SHA512 (selinux-3.8-rc3.tar.gz.asc) = 5149d362dea727edf40d88fcb3ad277b0c510b9799fd2e5ab420e98cafd60b33c208563c3ba93a6949c4592946a6ab87b4477bc413702942691fa2c676f51dad From 4ede7dad3761a6f32b6cf2f99922596dd2dcabda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Sun, 12 Jan 2025 14:39:08 +0100 Subject: [PATCH 03/22] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 8ba751a..f7e4d10 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist} +Release: 0.rc3.1%{?dist}.1 License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -448,4 +448,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 +- Rebuilt for the bin-sbin merge (2nd attempt) + %autochangelog From ff9ef4f536b5377067dca23ae7e907c69f108053 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 10:31:59 +0000 Subject: [PATCH 04/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index f7e4d10..3e490dd 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist}.1 +Release: 0.rc3.1%{?dist}.2 License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -448,6 +448,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 - Rebuilt for the bin-sbin merge (2nd attempt) From 5ab4154096343cc4163be84be571d1839ab87f74 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Jan 2025 08:45:34 +0100 Subject: [PATCH 05/22] Fix changelog --- changelog | 6 ++++++ policycoreutils.spec | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/changelog b/changelog index d16cc32..4a864cc 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Wed Dec 18 2024 Petr Lautrbach - 3.8-0.rc3.1 - SELinux userspace 3.8-rc3 release diff --git a/policycoreutils.spec b/policycoreutils.spec index 3e490dd..1effba0 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -448,10 +448,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek - 3.8-0.rc3.1.1 -- Rebuilt for the bin-sbin merge (2nd attempt) - %autochangelog From 0d18a959c76579106658d72d210d4356ccdf90b2 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Jan 2025 08:47:43 +0100 Subject: [PATCH 06/22] Make `rpm` a weak dependency The goal is to allow systems based on bootc without rpm installed. Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2338647 --- changelog | 3 +++ policycoreutils.spec | 5 +++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changelog b/changelog index 4a864cc..668e444 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Jan 22 2025 Petr Lautrbach - 3.8-rc3.2 +- Make `rpm` a weak dependency (bz#2338647) + * Sat Jan 18 2025 Fedora Release Engineering - 3.8-0.rc3.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/policycoreutils.spec b/policycoreutils.spec index 1effba0..85e98ba 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.1%{?dist}.2 +Release: 0.rc3.2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz @@ -70,8 +70,9 @@ BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip BuildRequires: systemd BuildRequires: git-core BuildRequires: gnupg2 -Requires: util-linux grep gawk diffutils rpm sed +Requires: util-linux grep gawk diffutils sed Requires: libsepol >= %{libsepolver} coreutils libselinux-utils >= %{libselinuxver} +Recommends: rpm %description Security-enhanced Linux is a feature of the Linux® kernel and a number From 5d6ff857413043a6150e55a7dc97af5f032db555 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 30 Jan 2025 15:51:05 +0100 Subject: [PATCH 07/22] SELinux userspace 3.8 release --- .gitignore | 2 ++ changelog | 3 +++ policycoreutils.spec | 14 +++++++------- sources | 4 ++-- 4 files changed, 14 insertions(+), 9 deletions(-) diff --git a/.gitignore b/.gitignore index 2ca0051..b37fa8e 100644 --- a/.gitignore +++ b/.gitignore @@ -361,3 +361,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8-rc1.tar.gz.asc /selinux-3.8-rc3.tar.gz /selinux-3.8-rc3.tar.gz.asc +/selinux-3.8.tar.gz +/selinux-3.8.tar.gz.asc diff --git a/changelog b/changelog index 668e444..8b6cf27 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Thu Jan 30 2025 Petr Lautrbach - 3.8-1 +- SELinux userspace 3.8 release + * Wed Jan 22 2025 Petr Lautrbach - 3.8-rc3.2 - Make `rpm` a weak dependency (bz#2338647) diff --git a/policycoreutils.spec b/policycoreutils.spec index 85e98ba..41eb359 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-0.rc3 -%global libsemanagever 3.8-0.rc3 -%global libselinuxver 3.8-0.rc3 +%global libsepolver 3.8-1 +%global libsemanagever 3.8-1 +%global libselinuxver 3.8-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 0.rc3.2%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc3/selinux-%{version}-rc3.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -92,7 +92,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc3 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index aabc995..347f300 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8-rc3.tar.gz) = 952cf58fd236949df96580f1e98cdde9003c8e783663c8cff391a4b56d3399a71694c756d1ba3141a494386c9b053ad0ca3665ac7dcdd5c6c252be4df6539c31 -SHA512 (selinux-3.8-rc3.tar.gz.asc) = 5149d362dea727edf40d88fcb3ad277b0c510b9799fd2e5ab420e98cafd60b33c208563c3ba93a6949c4592946a6ab87b4477bc413702942691fa2c676f51dad +SHA512 (selinux-3.8.tar.gz) = 58d05cd17ebcb4975e49573d2019304e6bbe0692f0ec230d79dfbcd144c2ff695c137b83318cc5e04c618031db7764e697162a3a8ff753ecfa314e552ccb8b81 +SHA512 (selinux-3.8.tar.gz.asc) = b4cd45bd66b7ae716123efde2ba0acddabc25cf3728e30ef101c7c001b6114c2b37fdc5e1cb09d75dc87f4d544da2f4a2e5803091334685c69c4c52e004e8434 From ba57ad88565a5fba5d891b6ed61fcca57d69dc41 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Mon, 2 Jun 2025 21:22:44 +0200 Subject: [PATCH 08/22] Rebuilt for Python 3.14 --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 41eb359..d1bee76 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -449,4 +449,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Mon Jun 02 2025 Python Maint - 3.8-2 +- Rebuilt for Python 3.14 + %autochangelog From 6ebaf8c522fcbd3c3bf0fff832110db698d3d917 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 25 Jun 2025 16:58:23 +0200 Subject: [PATCH 09/22] policycoreutils-3.8-3 - Use multiprocessing 'fork' method (rhbz#2374569) --- ...licy-use-multiprocessing-fork-method.patch | 57 +++++++++++++++++++ changelog | 6 ++ policycoreutils.spec | 6 +- 3 files changed, 65 insertions(+), 4 deletions(-) create mode 100644 0006-sepolicy-use-multiprocessing-fork-method.patch diff --git a/0006-sepolicy-use-multiprocessing-fork-method.patch b/0006-sepolicy-use-multiprocessing-fork-method.patch new file mode 100644 index 0000000..51ba23f --- /dev/null +++ b/0006-sepolicy-use-multiprocessing-fork-method.patch @@ -0,0 +1,57 @@ +From 9e26190295f01d74f70eed7ea3a78c00e38eafbb Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Wed, 25 Jun 2025 16:45:43 +0200 +Subject: [PATCH] sepolicy: use multiprocessing 'fork' method +Content-type: text/plain + +'fork' was the default starting method in Python before 3.14. + +Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2374569 + + sh-5.2# sepolicy manpage -a -p /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT/usr/share/man/man8/ -w -r /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT + ValueError: No SELinux Policy installed + Exception ignored while calling deallocator : + Traceback (most recent call last): + File "/usr/lib64/python3.14/multiprocessing/pool.py", line 271, in __del__ + self._change_notifier.put(None) + File "/usr/lib64/python3.14/multiprocessing/queues.py", line 397, in put + self._writer.send_bytes(obj) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 206, in send_bytes + self._send_bytes(m[offset:offset + size]) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 444, in _send_bytes + self._send(header + buf) + File "/usr/lib64/python3.14/multiprocessing/connection.py", line 400, in _send + n = write(self._handle, buf) + BrokenPipeError: [Errno 32] Broken pipe + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy.py | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py +index 82ff6af2bc2d..febb2fc103ed 100755 +--- a/python/sepolicy/sepolicy.py ++++ b/python/sepolicy/sepolicy.py +@@ -25,7 +25,7 @@ import os + import sys + import selinux + import sepolicy +-from multiprocessing import Pool ++import multiprocessing + from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text + import argparse + PROGNAME = "selinux-python" +@@ -350,7 +350,8 @@ def manpage(args): + + manpage_domains = set() + manpage_roles = set() +- p = Pool() ++ multiprocessing.set_start_method('fork') ++ p = multiprocessing.Pool() + async_results = [] + for domain in test_domains: + async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) +-- +2.50.0 + diff --git a/changelog b/changelog index 8b6cf27..92a6186 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Wed Jun 25 2025 Petr Lautrbach - 3.8-3 +- Use multiprocessing 'fork' method (rhbz#2374569) + +* Mon Jun 02 2025 Python Maint - 3.8-2 +- Rebuilt for Python 3.14 + * Thu Jan 30 2025 Petr Lautrbach - 3.8-1 - SELinux userspace 3.8 release diff --git a/policycoreutils.spec b/policycoreutils.spec index d1bee76..96499e7 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.8 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -43,6 +43,7 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -449,7 +450,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Mon Jun 02 2025 Python Maint - 3.8-2 -- Rebuilt for Python 3.14 - %autochangelog From 552779a79e09a64f99bb1bae249ae8176b96e45b Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 4 Jul 2025 13:39:25 +0200 Subject: [PATCH 10/22] SELinux userspace 3.9-rc2 release --- .gitignore | 2 + ...utils-use-pkg-config-for-libsemanage.patch | 77 +++++++++++++++++++ ...Make-pkg-config-work-for-more-types-.patch | 41 ++++++++++ changelog | 3 + policycoreutils.spec | 20 ++--- sources | 4 +- 6 files changed, 136 insertions(+), 11 deletions(-) create mode 100644 0007-policycoreutils-use-pkg-config-for-libsemanage.patch create mode 100644 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch diff --git a/.gitignore b/.gitignore index b37fa8e..2bcddbf 100644 --- a/.gitignore +++ b/.gitignore @@ -363,3 +363,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8-rc3.tar.gz.asc /selinux-3.8.tar.gz /selinux-3.8.tar.gz.asc +/selinux-3.9-rc2.tar.gz +/selinux-3.9-rc2.tar.gz.asc diff --git a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch new file mode 100644 index 0000000..ebcd5a3 --- /dev/null +++ b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch @@ -0,0 +1,77 @@ +From 6509a337599845279baa8070f5c2113b73805f74 Mon Sep 17 00:00:00 2001 +From: Alyssa Ross +Date: Wed, 25 Jun 2025 12:41:03 +0200 +Subject: [PATCH] policycoreutils: use pkg-config for libsemanage +Content-type: text/plain + +libaudit and libbz2 are only required to be in the linker path for +static builds. For dynamic builds, they'll be discovered through ELF +metadata. pkg-config knows how to do the right thing in both cases, +so just use it rather than listing libsemanage's dependencies +manually. + +Fixes: da6cd3d8 ("Support static-only builds") +Closes: https://lore.kernel.org/r/87bjqebpre.fsf@redhat.com +Signed-off-by: Alyssa Ross +Acked-by: James Carter +--- + policycoreutils/Makefile | 3 ++- + policycoreutils/semodule/Makefile | 3 +-- + policycoreutils/setsebool/Makefile | 3 +-- + 3 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile +index 7acd51ddd646..0f3d62f26830 100644 +--- a/policycoreutils/Makefile ++++ b/policycoreutils/Makefile +@@ -3,7 +3,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo + PKG_CONFIG ?= pkg-config + + LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) +-export LIBSELINUX_LDLIBS ++LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) ++export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS + + all install relabel clean indent: + @for subdir in $(SUBDIRS); do \ +diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile +index 7c45831fcd4e..018ee2ca7d39 100644 +--- a/policycoreutils/semodule/Makefile ++++ b/policycoreutils/semodule/Makefile +@@ -7,12 +7,11 @@ MANDIR = $(PREFIX)/share/man + CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I../../libselinux/include -I../../libsemanage/include + override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src +-override LDLIBS += -lsemanage -lsepol $(LIBSELINUX_LDLIBS) ++override LDLIBS += $(LIBSEMANAGE_LDLIBS) -lsepol $(LIBSELINUX_LDLIBS) + SEMODULE_OBJS = semodule.o + + all: semodule genhomedircon + +-semodule: LDLIBS += -laudit -lbz2 + semodule: $(SEMODULE_OBJS) + + genhomedircon: +diff --git a/policycoreutils/setsebool/Makefile b/policycoreutils/setsebool/Makefile +index 1d5148469f01..87494c559c17 100644 +--- a/policycoreutils/setsebool/Makefile ++++ b/policycoreutils/setsebool/Makefile +@@ -8,14 +8,13 @@ BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions + CFLAGS ?= -Werror -Wall -W + override CFLAGS += -I../../libselinux/include -I../../libsemanage/include + override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src +-override LDLIBS += -lsemanage $(LIBSELINUX_LDLIBS) ++override LDLIBS += $(LIBSEMANAGE_LDLIBS) $(LIBSELINUX_LDLIBS) + SETSEBOOL_OBJS = setsebool.o + + BASHCOMPLETIONS=setsebool-bash-completion.sh + + all: setsebool + +-setsebool: LDLIBS += -laudit -lbz2 + setsebool: $(SETSEBOOL_OBJS) + + install: all +-- +2.50.0 + diff --git a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch new file mode 100644 index 0000000..eba501d --- /dev/null +++ b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch @@ -0,0 +1,41 @@ +From 13d2f412bd1d32b2e5948b70ecba25d05632fd41 Mon Sep 17 00:00:00 2001 +From: James Carter +Date: Tue, 1 Jul 2025 09:03:09 -0400 +Subject: [PATCH] Policycoreutils: Make pkg-config work for more types of + builds +Content-type: text/plain + +To support static builds, pkg-config is used to add the libraries +needed for libselinux and libsemanage during the build. Unforunately, +pkg-config will always use the installed pc files for libselinux and +libsemanage. + +Instead set PKG_CONFIG_PATH when invoking pkg-config so that +it searches in order: +1) The directory specified by PKG_CONFIG_PATH, if already set. +2) The local src directories of libselinux and libsemaange. +3) The default directories specified by the system. + +Signed-off-by: James Carter +--- + policycoreutils/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile +index 0f3d62f26830..7c9706e3fe72 100644 +--- a/policycoreutils/Makefile ++++ b/policycoreutils/Makefile +@@ -2,8 +2,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo + + PKG_CONFIG ?= pkg-config + +-LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) +-LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) ++LIBSELINUX_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libselinux/src" $(PKG_CONFIG) --libs libselinux) ++LIBSEMANAGE_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libsemanage/src" $(PKG_CONFIG) --libs libsemanage) + export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS + + all install relabel clean indent: +-- +2.50.0 + diff --git a/changelog b/changelog index 92a6186..f7bf768 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Fri Jul 04 2025 Petr Lautrbach - 3.9-0.rc2.1 +- SELinux userspace 3.9-rc2 release + * Wed Jun 25 2025 Petr Lautrbach - 3.8-3 - Use multiprocessing 'fork' method (rhbz#2374569) diff --git a/policycoreutils.spec b/policycoreutils.spec index 96499e7..62b2aa6 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.8-1 -%global libsemanagever 3.8-1 -%global libselinuxver 3.8-1 +%global libsepolver 3.9-0 +%global libsemanagever 3.9-0 +%global libselinuxver 3.9-0 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -10,12 +10,12 @@ Summary: SELinux policy core utilities Name: policycoreutils -Version: 3.8 -Release: 3%{?dist} +Version: 3.9 +Release: 0.rc2.1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,7 +35,7 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.8 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.9-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -44,6 +44,8 @@ Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch +Patch0007: 0007-policycoreutils-use-pkg-config-for-libsemanage.patch +Patch0008: 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -93,7 +95,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version} +%autosetup -p 1 -n selinux-%{version}-rc2 cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 347f300..26bad72 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.8.tar.gz) = 58d05cd17ebcb4975e49573d2019304e6bbe0692f0ec230d79dfbcd144c2ff695c137b83318cc5e04c618031db7764e697162a3a8ff753ecfa314e552ccb8b81 -SHA512 (selinux-3.8.tar.gz.asc) = b4cd45bd66b7ae716123efde2ba0acddabc25cf3728e30ef101c7c001b6114c2b37fdc5e1cb09d75dc87f4d544da2f4a2e5803091334685c69c4c52e004e8434 +SHA512 (selinux-3.9-rc2.tar.gz) = d05d7633826154007117fc17a22de5dfb5f929fa124123341e98039ecf68a133b9ca70c575ca5e4aaa390daa930ffb6dda43b016b9cfcda8d8a901fb5204ba89 +SHA512 (selinux-3.9-rc2.tar.gz.asc) = 0fec5c55f48978829bbb61ac9e3330fbd42be08ecc89b9abb318ccd86feda41f7a5dea58aef73979c471b95b539202336a7336feb8c9014e32c7d7684ed081f1 From dd082a7b126533e042476d35a93cbb19c4cf250c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 16 Jul 2025 16:24:54 +0200 Subject: [PATCH 11/22] SELinux userspace 3.9 release --- .gitignore | 2 + ...t-be-verbose-if-you-are-not-on-a-tty.patch | 4 +- ...rate-Handle-more-reserved-port-types.patch | 4 +- ...hbox-window-manager-instead-of-openb.patch | 4 +- 0004-Use-SHA-2-instead-of-SHA-1.patch | 20 ++--- ...-sepolicy-Fix-spec-file-dependencies.patch | 4 +- ...licy-use-multiprocessing-fork-method.patch | 57 -------------- ...utils-use-pkg-config-for-libsemanage.patch | 77 ------------------- ...Make-pkg-config-work-for-more-types-.patch | 41 ---------- changelog | 3 + policycoreutils.spec | 24 ++---- sources | 4 +- 12 files changed, 33 insertions(+), 211 deletions(-) delete mode 100644 0006-sepolicy-use-multiprocessing-fork-method.patch delete mode 100644 0007-policycoreutils-use-pkg-config-for-libsemanage.patch delete mode 100644 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch diff --git a/.gitignore b/.gitignore index 2bcddbf..5686001 100644 --- a/.gitignore +++ b/.gitignore @@ -365,3 +365,5 @@ policycoreutils-2.0.83.tgz /selinux-3.8.tar.gz.asc /selinux-3.9-rc2.tar.gz /selinux-3.9-rc2.tar.gz.asc +/selinux-3.9.tar.gz +/selinux-3.9.tar.gz.asc diff --git a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch index e319d1d..43396d2 100644 --- a/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +++ b/0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch @@ -1,4 +1,4 @@ -From 12f57453e8b53a8aab6d3581fd1a4c921fe36918 Mon Sep 17 00:00:00 2001 +From ce28d432bef8d1a346054b56a989e58533fecfa7 Mon Sep 17 00:00:00 2001 From: Dan Walsh Date: Fri, 14 Feb 2014 12:32:12 -0500 Subject: [PATCH] Don't be verbose if you are not on a tty @@ -21,5 +21,5 @@ index b7cd765c15e4..f2518e96e34c 100755 THREADS="" RPMFILES="" -- -2.47.0 +2.50.1 diff --git a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch index 996113f..f8433da 100644 --- a/0002-sepolicy-generate-Handle-more-reserved-port-types.patch +++ b/0002-sepolicy-generate-Handle-more-reserved-port-types.patch @@ -1,4 +1,4 @@ -From fb7357cd097801fcdfa21ed49a17a3875db05e42 Mon Sep 17 00:00:00 2001 +From 618ae48ebf1334f9380a9ae7460c553515f9c4ca Mon Sep 17 00:00:00 2001 From: Masatake YAMATO Date: Thu, 14 Dec 2017 15:57:58 +0900 Subject: [PATCH] sepolicy-generate: Handle more reserved port types @@ -68,5 +68,5 @@ index adf65f27a822..f726ad51b775 100644 dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range')) return dict -- -2.47.0 +2.50.1 diff --git a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch index 9c77d93..f876b7b 100644 --- a/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +++ b/0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch @@ -1,4 +1,4 @@ -From f2092a1b859a028f2c5c79b41c70b135ba3ad0fa Mon Sep 17 00:00:00 2001 +From 16fd581da479f80b8f8ff8ae8ff58a4f0a610d54 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 18 Jul 2018 09:09:35 +0200 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox @@ -71,5 +71,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644 if [ -z "$WAYLAND_DISPLAY" ]; then DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null' -- -2.47.0 +2.50.1 diff --git a/0004-Use-SHA-2-instead-of-SHA-1.patch b/0004-Use-SHA-2-instead-of-SHA-1.patch index bcebe4f..d1847c1 100644 --- a/0004-Use-SHA-2-instead-of-SHA-1.patch +++ b/0004-Use-SHA-2-instead-of-SHA-1.patch @@ -1,4 +1,4 @@ -From 4780b755bb1171f5aa4cd7545535839d451a2070 Mon Sep 17 00:00:00 2001 +From 1a3fc195c6dc7fe51ef76e4484910f7b41161ccc Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 30 Jul 2021 14:14:37 +0200 Subject: [PATCH] Use SHA-2 instead of SHA-1 @@ -13,10 +13,10 @@ The use of SHA-1 in RHEL9 is deprecated 4 files changed, 20 insertions(+), 20 deletions(-) diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8 -index c3cc5c9b0e52..6160aced5922 100644 +index 1134420e0e28..77dd05421d11 100644 --- a/policycoreutils/setfiles/restorecon.8 +++ b/policycoreutils/setfiles/restorecon.8 -@@ -95,14 +95,14 @@ display usage information and exit. +@@ -103,14 +103,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -34,7 +34,7 @@ index c3cc5c9b0e52..6160aced5922 100644 enable usage of the .IR security.sehash extended attribute. -@@ -200,7 +200,7 @@ the +@@ -208,7 +208,7 @@ the .B \-D option to .B restorecon @@ -43,7 +43,7 @@ index c3cc5c9b0e52..6160aced5922 100644 attribute named .IR security.sehash on each directory specified in -@@ -217,7 +217,7 @@ for further details. +@@ -225,7 +225,7 @@ for further details. .sp The .B \-I @@ -134,10 +134,10 @@ index 31fb82fd2099..bc22d3fd4560 100644 } diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 -index ee01725050bb..57c663a99d67 100644 +index eabf0a1cf755..187f45131a1f 100644 --- a/policycoreutils/setfiles/setfiles.8 +++ b/policycoreutils/setfiles/setfiles.8 -@@ -95,14 +95,14 @@ display usage information and exit. +@@ -104,14 +104,14 @@ display usage information and exit. ignore files that do not exist. .TP .B \-I @@ -155,7 +155,7 @@ index ee01725050bb..57c663a99d67 100644 enable usage of the .IR security.sehash extended attribute. -@@ -261,7 +261,7 @@ the +@@ -270,7 +270,7 @@ the .B \-D option to .B setfiles @@ -164,7 +164,7 @@ index ee01725050bb..57c663a99d67 100644 .B spec_file set in an extended attribute named .IR security.sehash -@@ -282,7 +282,7 @@ for further details. +@@ -291,7 +291,7 @@ for further details. .sp The .B \-I @@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644 and provided the .B \-n -- -2.47.0 +2.50.1 diff --git a/0005-python-sepolicy-Fix-spec-file-dependencies.patch b/0005-python-sepolicy-Fix-spec-file-dependencies.patch index 27f1ea1..abecd7b 100644 --- a/0005-python-sepolicy-Fix-spec-file-dependencies.patch +++ b/0005-python-sepolicy-Fix-spec-file-dependencies.patch @@ -1,4 +1,4 @@ -From 7e8d67e63daebd675284afaf98aa07530659272f Mon Sep 17 00:00:00 2001 +From 84b051139ab536519cc8e9c333483475d830d40b Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 30 May 2023 09:07:28 +0200 Subject: [PATCH] python/sepolicy: Fix spec file dependencies @@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644 mid_section="""\ -- -2.47.0 +2.50.1 diff --git a/0006-sepolicy-use-multiprocessing-fork-method.patch b/0006-sepolicy-use-multiprocessing-fork-method.patch deleted file mode 100644 index 51ba23f..0000000 --- a/0006-sepolicy-use-multiprocessing-fork-method.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 9e26190295f01d74f70eed7ea3a78c00e38eafbb Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Wed, 25 Jun 2025 16:45:43 +0200 -Subject: [PATCH] sepolicy: use multiprocessing 'fork' method -Content-type: text/plain - -'fork' was the default starting method in Python before 3.14. - -Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2374569 - - sh-5.2# sepolicy manpage -a -p /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT/usr/share/man/man8/ -w -r /builddir/build/BUILD/selinux-policy-41.43-build/BUILDROOT - ValueError: No SELinux Policy installed - Exception ignored while calling deallocator : - Traceback (most recent call last): - File "/usr/lib64/python3.14/multiprocessing/pool.py", line 271, in __del__ - self._change_notifier.put(None) - File "/usr/lib64/python3.14/multiprocessing/queues.py", line 397, in put - self._writer.send_bytes(obj) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 206, in send_bytes - self._send_bytes(m[offset:offset + size]) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 444, in _send_bytes - self._send(header + buf) - File "/usr/lib64/python3.14/multiprocessing/connection.py", line 400, in _send - n = write(self._handle, buf) - BrokenPipeError: [Errno 32] Broken pipe - -Signed-off-by: Petr Lautrbach ---- - python/sepolicy/sepolicy.py | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/python/sepolicy/sepolicy.py b/python/sepolicy/sepolicy.py -index 82ff6af2bc2d..febb2fc103ed 100755 ---- a/python/sepolicy/sepolicy.py -+++ b/python/sepolicy/sepolicy.py -@@ -25,7 +25,7 @@ import os - import sys - import selinux - import sepolicy --from multiprocessing import Pool -+import multiprocessing - from sepolicy import get_os_version, get_conditionals, get_conditionals_format_text - import argparse - PROGNAME = "selinux-python" -@@ -350,7 +350,8 @@ def manpage(args): - - manpage_domains = set() - manpage_roles = set() -- p = Pool() -+ multiprocessing.set_start_method('fork') -+ p = multiprocessing.Pool() - async_results = [] - for domain in test_domains: - async_results.append(p.apply_async(manpage_work, [domain, path, args.root, args.source_files, args.web])) --- -2.50.0 - diff --git a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch b/0007-policycoreutils-use-pkg-config-for-libsemanage.patch deleted file mode 100644 index ebcd5a3..0000000 --- a/0007-policycoreutils-use-pkg-config-for-libsemanage.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 6509a337599845279baa8070f5c2113b73805f74 Mon Sep 17 00:00:00 2001 -From: Alyssa Ross -Date: Wed, 25 Jun 2025 12:41:03 +0200 -Subject: [PATCH] policycoreutils: use pkg-config for libsemanage -Content-type: text/plain - -libaudit and libbz2 are only required to be in the linker path for -static builds. For dynamic builds, they'll be discovered through ELF -metadata. pkg-config knows how to do the right thing in both cases, -so just use it rather than listing libsemanage's dependencies -manually. - -Fixes: da6cd3d8 ("Support static-only builds") -Closes: https://lore.kernel.org/r/87bjqebpre.fsf@redhat.com -Signed-off-by: Alyssa Ross -Acked-by: James Carter ---- - policycoreutils/Makefile | 3 ++- - policycoreutils/semodule/Makefile | 3 +-- - policycoreutils/setsebool/Makefile | 3 +-- - 3 files changed, 4 insertions(+), 5 deletions(-) - -diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile -index 7acd51ddd646..0f3d62f26830 100644 ---- a/policycoreutils/Makefile -+++ b/policycoreutils/Makefile -@@ -3,7 +3,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo - PKG_CONFIG ?= pkg-config - - LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) --export LIBSELINUX_LDLIBS -+LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) -+export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS - - all install relabel clean indent: - @for subdir in $(SUBDIRS); do \ -diff --git a/policycoreutils/semodule/Makefile b/policycoreutils/semodule/Makefile -index 7c45831fcd4e..018ee2ca7d39 100644 ---- a/policycoreutils/semodule/Makefile -+++ b/policycoreutils/semodule/Makefile -@@ -7,12 +7,11 @@ MANDIR = $(PREFIX)/share/man - CFLAGS ?= -Werror -Wall -W - override CFLAGS += -I../../libselinux/include -I../../libsemanage/include - override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src --override LDLIBS += -lsemanage -lsepol $(LIBSELINUX_LDLIBS) -+override LDLIBS += $(LIBSEMANAGE_LDLIBS) -lsepol $(LIBSELINUX_LDLIBS) - SEMODULE_OBJS = semodule.o - - all: semodule genhomedircon - --semodule: LDLIBS += -laudit -lbz2 - semodule: $(SEMODULE_OBJS) - - genhomedircon: -diff --git a/policycoreutils/setsebool/Makefile b/policycoreutils/setsebool/Makefile -index 1d5148469f01..87494c559c17 100644 ---- a/policycoreutils/setsebool/Makefile -+++ b/policycoreutils/setsebool/Makefile -@@ -8,14 +8,13 @@ BASHCOMPLETIONDIR ?= $(PREFIX)/share/bash-completion/completions - CFLAGS ?= -Werror -Wall -W - override CFLAGS += -I../../libselinux/include -I../../libsemanage/include - override LDFLAGS+= -L../../libselinux/src -L../../libsemanage/src --override LDLIBS += -lsemanage $(LIBSELINUX_LDLIBS) -+override LDLIBS += $(LIBSEMANAGE_LDLIBS) $(LIBSELINUX_LDLIBS) - SETSEBOOL_OBJS = setsebool.o - - BASHCOMPLETIONS=setsebool-bash-completion.sh - - all: setsebool - --setsebool: LDLIBS += -laudit -lbz2 - setsebool: $(SETSEBOOL_OBJS) - - install: all --- -2.50.0 - diff --git a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch b/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch deleted file mode 100644 index eba501d..0000000 --- a/0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 13d2f412bd1d32b2e5948b70ecba25d05632fd41 Mon Sep 17 00:00:00 2001 -From: James Carter -Date: Tue, 1 Jul 2025 09:03:09 -0400 -Subject: [PATCH] Policycoreutils: Make pkg-config work for more types of - builds -Content-type: text/plain - -To support static builds, pkg-config is used to add the libraries -needed for libselinux and libsemanage during the build. Unforunately, -pkg-config will always use the installed pc files for libselinux and -libsemanage. - -Instead set PKG_CONFIG_PATH when invoking pkg-config so that -it searches in order: -1) The directory specified by PKG_CONFIG_PATH, if already set. -2) The local src directories of libselinux and libsemaange. -3) The default directories specified by the system. - -Signed-off-by: James Carter ---- - policycoreutils/Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/policycoreutils/Makefile b/policycoreutils/Makefile -index 0f3d62f26830..7c9706e3fe72 100644 ---- a/policycoreutils/Makefile -+++ b/policycoreutils/Makefile -@@ -2,8 +2,8 @@ SUBDIRS = setfiles load_policy newrole run_init secon sestatus semodule setseboo - - PKG_CONFIG ?= pkg-config - --LIBSELINUX_LDLIBS := $(shell $(PKG_CONFIG) --libs libselinux) --LIBSEMANAGE_LDLIBS := $(shell $(PKG_CONFIG) --libs libsemanage) -+LIBSELINUX_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libselinux/src" $(PKG_CONFIG) --libs libselinux) -+LIBSEMANAGE_LDLIBS := $(shell PKG_CONFIG_PATH="$(PKG_CONFIG_PATH):../libsemanage/src" $(PKG_CONFIG) --libs libsemanage) - export LIBSELINUX_LDLIBS LIBSEMANAGE_LDLIBS - - all install relabel clean indent: --- -2.50.0 - diff --git a/changelog b/changelog index f7bf768..8125bdb 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Wed Jul 16 2025 Petr Lautrbach - 3.9-1 +- SELinux userspace 3.9 release + * Fri Jul 04 2025 Petr Lautrbach - 3.9-0.rc2.1 - SELinux userspace 3.9-rc2 release diff --git a/policycoreutils.spec b/policycoreutils.spec index 62b2aa6..a78333e 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -1,7 +1,7 @@ %global libauditver 3.0 -%global libsepolver 3.9-0 -%global libsemanagever 3.9-0 -%global libselinuxver 3.9-0 +%global libsepolver 3.9-1 +%global libsemanagever 3.9-1 +%global libselinuxver 3.9-1 %global generatorsdir %{_prefix}/lib/systemd/system-generators @@ -11,11 +11,11 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 0.rc2.1%{?dist} +Release: 1%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases -Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz -Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}-rc2/selinux-%{version}-rc2.tar.gz.asc +Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz +Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png @@ -35,17 +35,9 @@ Source22: selinux-gui.zip # wlc --key --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./ Source23: selinux-sandbox.zip # https://github.com/fedora-selinux/selinux -# $ git format-patch -N 3.9-rc2 -- policycoreutils python gui sandbox dbus semodule-utils restorecond +# $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch -Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch -Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch -Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch -Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch -Patch0006: 0006-sepolicy-use-multiprocessing-fork-method.patch -Patch0007: 0007-policycoreutils-use-pkg-config-for-libsemanage.patch -Patch0008: 0008-Policycoreutils-Make-pkg-config-work-for-more-types-.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 @@ -95,7 +87,7 @@ to switch roles. %prep -p /usr/bin/bash %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%autosetup -p 1 -n selinux-%{version}-rc2 +%autosetup -p 1 -n selinux-%{version} cp %{SOURCE13} gui/ tar -xvf %{SOURCE14} -C python/sepolicy/ diff --git a/sources b/sources index 26bad72..2f274a6 100644 --- a/sources +++ b/sources @@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7 -SHA512 (selinux-3.9-rc2.tar.gz) = d05d7633826154007117fc17a22de5dfb5f929fa124123341e98039ecf68a133b9ca70c575ca5e4aaa390daa930ffb6dda43b016b9cfcda8d8a901fb5204ba89 -SHA512 (selinux-3.9-rc2.tar.gz.asc) = 0fec5c55f48978829bbb61ac9e3330fbd42be08ecc89b9abb318ccd86feda41f7a5dea58aef73979c471b95b539202336a7336feb8c9014e32c7d7684ed081f1 +SHA512 (selinux-3.9.tar.gz) = ccfe9c8907ef50e35cda1e8282a4e02e8d2e1749dabde856343f236724214c89d0bcd4e799f383961b990c5fb9a6b0191880a478a8930af447951c8b36689720 +SHA512 (selinux-3.9.tar.gz.asc) = 598498e3919c72e1b7e6db85250ac7b1ff26e33598fb94c29ee74569dddee407fca73961d9fbb245ecf5ff5a7ee0eaa83031f79b7f0b2d89661119d45bbf5954 From 9613beb188c622f435426851633077d0a93713ea Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 06:00:45 +0000 Subject: [PATCH 12/22] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index a78333e..ed59a07 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -444,4 +444,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + %autochangelog From 13fd9c38cc8bf803d52d8dbb1084ff3c37e0b361 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 29 Jul 2025 14:07:06 +0200 Subject: [PATCH 13/22] Drop unused BuildRequires on python3-wheel See https://github.com/fedora-eln/eln/issues/284 When pip sees a setup.py file and it has setuptools and wheel installed it does not use build isolation (by default). When we remove wheel, the default changes, so we need to be explicit. Note that setting PIP_NO_BUILD_ISOLATION=0 disables build isolation, which is a tad confusing, see https://github.com/pypa/pip/issues/5735 --- policycoreutils.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ed59a07..c43ec0f 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -61,7 +61,8 @@ Provides: /usr/sbin/semodule BuildRequires: gcc make BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver} libcap-devel audit-libs-devel >= %{libauditver} gettext BuildRequires: desktop-file-utils dbus-devel glib2-devel -BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip +BuildRequires: python3-devel python3-setuptools python3-pip +BuildRequires: (python3-wheel if python3-setuptools < 71) BuildRequires: systemd BuildRequires: git-core BuildRequires: gnupg2 @@ -128,7 +129,7 @@ mkdir -p %{buildroot}%{_mandir}/man8 %make_install -C policycoreutils LSPP_PRIV=y SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" SEMODULE_PATH="/usr/sbin" LIBSEPOLA="%{_libdir}/libsepol.a" -%make_install -C python PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" +%make_install -C python PYTHON=%{__python3} PIP_NO_BUILD_ISOLATION=0 SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" %make_install -C gui PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a" From 6c0adeff6972263b4618fb750e51beddc82b7f39 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 11 Aug 2025 10:04:30 +0200 Subject: [PATCH 14/22] policycoreutils-3.9-3 - Drop unused BuildRequires on python3-wheel --- changelog | 6 ++++++ policycoreutils.spec | 5 +---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changelog b/changelog index 8125bdb..956ef08 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Tue Jul 29 2025 Miro Hrončok - 3.9-3 +- Drop unused BuildRequires on python3-wheel + +* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Wed Jul 16 2025 Petr Lautrbach - 3.9-1 - SELinux userspace 3.9 release diff --git a/policycoreutils.spec b/policycoreutils.spec index c43ec0f..c384a52 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 2%{?dist} +Release: 3%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,7 +445,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Jul 25 2025 Fedora Release Engineering - 3.9-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - %autochangelog From 1c3d6107fc572693a25dc1f177a3a7e2806f508e Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 13:07:03 +0200 Subject: [PATCH 15/22] Rebuilt for Python 3.14.0rc2 bytecode --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index c384a52..4a34cfa 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,4 +445,7 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + %autochangelog From 7a130bd9c17ed9eb87a4f81aca8a3dac25882553 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 12:37:25 +0200 Subject: [PATCH 16/22] Rebuilt for Python 3.14.0rc3 bytecode --- policycoreutils.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index 4a34cfa..ca70bcc 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 4%{?dist} +Release: 5%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -445,6 +445,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + * Fri Aug 15 2025 Python Maint - 3.9-4 - Rebuilt for Python 3.14.0rc2 bytecode From 2f22660c9f93c0371b729741bd20c7752847b52d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 07:33:59 +0100 Subject: [PATCH 17/22] Fix manpages pattern https://docs.fedoraproject.org/en-US/packaging-guidelines/#_manpages When installing man pages, note that RPM will re-compress them into its preferred format. So the %files section MUST reference manpages with a pattern that takes this into account: %files %{_mandir}/man1/foo.1* --- policycoreutils.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/policycoreutils.spec b/policycoreutils.spec index ca70bcc..7a56a2a 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -321,7 +321,7 @@ or level of a logged in user. %files newrole %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole -%{_mandir}/man1/newrole.1.gz +%{_mandir}/man1/newrole.1* %config(noreplace) %{_sysconfdir}/pam.d/newrole %package gui @@ -386,8 +386,8 @@ system-config-selinux is a utility for managing the SELinux environment %{_unitdir}/selinux-autorelabel.target %{generatorsdir}/selinux-autorelabel-generator.sh %config(noreplace) %{_sysconfdir}/sestatus.conf -%{_mandir}/man5/selinux_config.5.gz -%{_mandir}/man5/sestatus.conf.5.gz +%{_mandir}/man5/selinux_config.5* +%{_mandir}/man5/sestatus.conf.5* %{_mandir}/man8/fixfiles.8* %{_mandir}/man8/load_policy.8* %{_mandir}/man8/restorecon.8* From 3a3585431961a73db8413c40bd67f7e8a401a7a1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 9 Dec 2025 08:06:57 +0100 Subject: [PATCH 18/22] Move %changelog entries to changelog --- changelog | 6 ++++++ policycoreutils.spec | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/changelog b/changelog index 956ef08..faed1db 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,9 @@ +* Fri Sep 19 2025 Python Maint - 3.9-5 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 3.9-4 +- Rebuilt for Python 3.14.0rc2 bytecode + * Tue Jul 29 2025 Miro Hrončok - 3.9-3 - Drop unused BuildRequires on python3-wheel diff --git a/policycoreutils.spec b/policycoreutils.spec index 7a56a2a..ef17aee 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -445,10 +445,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -* Fri Sep 19 2025 Python Maint - 3.9-5 -- Rebuilt for Python 3.14.0rc3 bytecode - -* Fri Aug 15 2025 Python Maint - 3.9-4 -- Rebuilt for Python 3.14.0rc2 bytecode - %autochangelog From 668dfbb056f2ae83b1897683c4792b736a37959e Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 11 Dec 2025 07:31:22 +0100 Subject: [PATCH 19/22] Bring back patches unintentionally dropped before --- changelog | 3 +++ policycoreutils.spec | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/changelog b/changelog index faed1db..c39d307 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,6 @@ +* Thu Dec 11 2025 Petr Lautrbach - 3.9-6 +- Bring back patches unintentionally dropped before + * Fri Sep 19 2025 Python Maint - 3.9-5 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/policycoreutils.spec b/policycoreutils.spec index ef17aee..19c599d 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 5%{?dist} +Release: 6%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -38,6 +38,11 @@ Source23: selinux-sandbox.zip # $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start +Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch +Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch +Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch +Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch +Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 109f2b2f0746042e9106c5466624dafc3a5fb641 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 24 Jul 2025 13:36:35 +0200 Subject: [PATCH 20/22] selinux-autorelabel: Improve comments The original comment of relabel_selinux() no longer applies. The system is restarted either way. Resolves: RHEL-93949 --- selinux-autorelabel | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-autorelabel b/selinux-autorelabel index 5290c8c..1ce0e87 100755 --- a/selinux-autorelabel +++ b/selinux-autorelabel @@ -30,8 +30,9 @@ efi_set_boot_next() { } relabel_selinux() { - # if /sbin/init is not labeled correctly this process is running in the - # wrong context, so a reboot will be required after relabel + # Switch SELinux to permissive mode, fix labeling issues (or execute shell + # and have the user fix them) and reboot the machine so that the correct + # labels are applied to all services. AUTORELABEL= . /etc/selinux/config echo "0" > /sys/fs/selinux/enforce From e0a0eb0859ae38b1d870c9960074a020b37f6fbd Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 7 Oct 2025 12:26:46 +0200 Subject: [PATCH 21/22] policycoreutils-3.9-7 - semanage: Reset active value when deleting boolean customizations (RHEL-111421) - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) - sepolicy: Fix detection of writeable locations Resolves: RHEL-111421, RHEL-111505 --- ...Fix-detection-of-writeable-locations.patch | 65 ++++++++++++ ...ption-to-disable-SELINUX_RESTORECON_.patch | 91 +++++++++++++++++ ...ctive-value-when-deleting-boolean-cu.patch | 98 +++++++++++++++++++ changelog | 5 + policycoreutils.spec | 5 +- 5 files changed, 263 insertions(+), 1 deletion(-) create mode 100644 0006-sepolicy-Fix-detection-of-writeable-locations.patch create mode 100644 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch create mode 100644 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch diff --git a/0006-sepolicy-Fix-detection-of-writeable-locations.patch b/0006-sepolicy-Fix-detection-of-writeable-locations.patch new file mode 100644 index 0000000..2cd313a --- /dev/null +++ b/0006-sepolicy-Fix-detection-of-writeable-locations.patch @@ -0,0 +1,65 @@ +From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 5 May 2025 18:28:40 +0200 +Subject: [PATCH] sepolicy: Fix detection of writeable locations + +- update substitutions from /etc/dnf/var + +It seems that by default dnf api does not read /etc/dnf/var/* files to +update substitutions and so it can't resolve correct mirror list when a +variable is part of the link. + +- alway run query.run() + +Fixes: + Traceback (most recent call last): + File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load + ret = self._repo.load() + ^^^^^^^^^^^^^^^^^ + File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load + return _repo.Repo_load(self) + ^^^^^^^^^^^^^^^^^^^^^ + libdnf._error.Error: Failed to download metadata for repo 'baseos': + Cannot prepare internal mirrorlist: Status code: 404 for + https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198) + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/generate.py | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index f726ad51..a0314a70 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s; + import dnf + + with dnf.Base() as base: ++ base.conf.substitutions.update_from_etc('/') + base.read_all_repos() + base.fill_sack(load_system_repo=True) + + query = base.sack.query() + +- pq = query.available() +- pq = pq.filter(file=self.program) ++ pq = query.filter(file=self.program) + +- for pkg in pq: ++ for pkg in pq.run(): + self.rpms.append(pkg.name) + for fname in pkg.files: + for b in self.DEFAULT_DIRS: +@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s; + self.add_dir(fname) + sq = query.available() + sq = sq.filter(provides=pkg.source_name) +- for bpkg in sq: ++ for bpkg in sq.run(): + for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": +-- +2.49.0 + diff --git a/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch new file mode 100644 index 0000000..e8ec6ff --- /dev/null +++ b/0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch @@ -0,0 +1,91 @@ +From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 10 Sep 2025 11:42:09 +0100 +Subject: [PATCH] setfiles: Add -A option to disable + SELINUX_RESTORECON_ADD_ASSOC + +SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with +multiple hard links or bind mounts that have differing contexts. +However doing this involves building a large internal hashtable that +stores the full path of every file examined by setfiles. For +filesystems that have very large numbers of files or long pathnames, +this uses a lot of memory, which makes SELinux relabelling in +constrained memory environments infeasible. + +This adds a new setfiles -A option that disables this tracking. + +For example, using setfiles to relabel a filesystem with 15 million +files took 3.7GB of RAM. Using this option, the same filesystem can +be relabelled in 121MB (albeit with no warnings or errors possible for +conflicting labels, but for our use case we don't care about that.) + +Fixes: https://issues.redhat.com/browse/RHEL-111505 +Signed-off-by: Richard W.M. Jones +Acked-by: Stephen Smalley +--- + policycoreutils/setfiles/setfiles.8 | 5 +++++ + policycoreutils/setfiles/setfiles.c | 11 +++++++---- + 2 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8 +index 187f4513..458f3f9f 100644 +--- a/policycoreutils/setfiles/setfiles.8 ++++ b/policycoreutils/setfiles/setfiles.8 +@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts. + .RB [ \-I | \-D ] + .RB [ \-T + .IR nthreads ] ++.RB [ \-A ] + .I spec_file + .IR pathname \ ... + +@@ -187,6 +188,10 @@ use up to + threads. Specify 0 to create as many threads as there are available + CPU cores; 1 to use only a single thread (default); or any positive + number to use the given number of threads (if possible). ++.TP ++.B \-A ++do not track inodes with multiple hard links or bind mounts that would ++match different contexts (saves memory) + + .SH "ARGUMENTS" + .TP +diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c +index ad09f840..31034316 100644 +--- a/policycoreutils/setfiles/setfiles.c ++++ b/policycoreutils/setfiles/setfiles.c +@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name) + name, name); + } else { + fprintf(stderr, +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" +- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" +- "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n", ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n" ++ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n" ++ "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n", + name, name, name); + } + exit(-1); +@@ -147,7 +147,7 @@ int main(int argc, char **argv) + const char *base; + int errors = 0; + const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:"; +- const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:"; ++ const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:"; + const char *opts; + union selinux_callback cb; + long unsigned skipped_errors; +@@ -375,6 +375,9 @@ int main(int argc, char **argv) + if (*optarg == '\0' || *endptr != '\0') + usage(argv[0]); + break; ++ case 'A': ++ r_opts.add_assoc = 0; ++ break; + case 'h': + case '?': + usage(argv[0]); +-- +2.49.0 + diff --git a/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch new file mode 100644 index 0000000..470fde9 --- /dev/null +++ b/0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch @@ -0,0 +1,98 @@ +From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Mon, 1 Sep 2025 18:17:10 +0200 +Subject: [PATCH] semanage: Reset active value when deleting boolean + customizations + +Currently, removal of boolean local customizations leaves their current +(active) value untouched. + +After the removal is complete, semanage_bool_query will return the +default value. But it needs to be called in a separate transaction. +This makes the fix a bit awkward, but I have not found a way to query +the default value before the first transation is committed. + +Fixes: + # getsebool smbd_anon_write + smbd_anon_write --> off + # semanage boolean -m1 smbd_anon_write + # semanage boolean -D + # getsebool smbd_anon_write + smbd_anon_write --> on + # manage boolean -l isemanage boolean --list | grep smbd_anon_write + smbd_anon_write (on , off) Allow smbd to anon write + +Signed-off-by: Vit Mojzis +--- + python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py +index 10963e81..6d6188fd 100644 +--- a/python/semanage/seobject.py ++++ b/python/semanage/seobject.py +@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords): + self.__delete(name) + self.commit() + ++ # New transaction to reset the boolean to its default value. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ self.__reset_value(name) ++ self.commit() ++ + def deleteall(self): ++ deleted = [] + (rc, self.blist) = semanage_bool_list_local(self.sh) + if rc < 0: + raise ValueError(_("Could not list booleans")) +@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords): + + for boolean in self.blist: + name = semanage_bool_get_name(boolean) ++ deleted.append(name) + self.__delete(name) + + self.commit() + ++ # New transaction to reset all affected booleans to their default values. ++ # Calling __reset_value in the same transaction as the removal of ++ # local customizations does nothing ++ self.begin() ++ ++ for boolean in deleted: ++ self.__reset_value(boolean) ++ ++ self.commit() ++ ++ # Set active value to default ++ # Note: this needs to be called in a new transaction after removing local customizations ++ # in order for semanage_bool_query to fetch the default value ++ # (as opposed to the current one -- set by the local customizations) ++ def __reset_value(self, name): ++ name = selinux.selinux_boolean_sub(name) ++ ++ (rc, k) = semanage_bool_key_create(self.sh, name) ++ if rc < 0: ++ raise ValueError(_("Could not create a key for %s") % name) ++ ++ (rc, b) = semanage_bool_query(self.sh, k) ++ if rc < 0: ++ raise ValueError(_("Could not query boolean %s") % name) ++ ++ semanage_bool_set_value(b, semanage_bool_get_value(b)) ++ ++ rc = semanage_bool_set_active(self.sh, k, b) ++ if rc < 0: ++ raise ValueError(_("Could not set active value of boolean %s") % name) ++ ++ semanage_bool_key_free(k) ++ semanage_bool_free(b) ++ + def get_all(self, locallist=0): + ddict = {} + if locallist: +-- +2.49.0 + diff --git a/changelog b/changelog index c39d307..45f063d 100644 --- a/changelog +++ b/changelog @@ -1,3 +1,8 @@ +* Thu Dec 11 2025 Vit Mojzis - 3.9-7 +- semanage: Reset active value when deleting boolean customizations (RHEL-111421) +- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505) +- sepolicy: Fix detection of writeable locations + * Thu Dec 11 2025 Petr Lautrbach - 3.9-6 - Bring back patches unintentionally dropped before diff --git a/policycoreutils.spec b/policycoreutils.spec index 19c599d..bd0d6c5 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.9 -Release: 6%{?dist} +Release: 7%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz @@ -43,6 +43,9 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch +Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch +Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch +Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 From 1e699f4433984366beee3846578c9d4a030cce21 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 16 Dec 2025 11:00:45 +0100 Subject: [PATCH 22/22] Do not use %autochangelog It can't be used without %autorelease. Use our own macro to add entries from SOURCE3: changelog to %changelog %add_changelog %SOURCE3 Also install changelog to /usr/share/doc/policycoreutils/changelog --- macros | 8 ++++++++ policycoreutils.spec | 12 ++++++++++-- 2 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 macros diff --git a/macros b/macros new file mode 100644 index 0000000..7587d10 --- /dev/null +++ b/macros @@ -0,0 +1,8 @@ +%add_changelog(changelog:) %{lua: + local f = io.open(arg[1], 'r') + if f then + local content = f:read('*all') + f:close() + print(content) + end +} diff --git a/policycoreutils.spec b/policycoreutils.spec index bd0d6c5..29b6242 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -17,6 +17,8 @@ License: GPL-2.0-or-later Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc Source2: https://github.com/bachradsusi.gpg +Source3: changelog +Source4: macros URL: https://github.com/SELinuxProject/selinux Source13: system-config-selinux.png Source14: sepolicy-icons.tgz @@ -48,6 +50,9 @@ Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch # Patch list end +# gen_changelog +%{load:%{SOURCE4}} + Obsoletes: policycoreutils < 2.0.61-2 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138 # initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel @@ -177,6 +182,9 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/ %find_lang selinux-gui %find_lang selinux-sandbox +# Install changelog to %{_docdir}/%{name} +install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name} + %package python-utils Summary: SELinux policy core python utilities Requires: python3-policycoreutils = %{version}-%{release} @@ -415,7 +423,7 @@ system-config-selinux is a utility for managing the SELinux environment %{_datadir}/bash-completion/completions/setsebool %{!?_licensedir:%global license %%doc} %license policycoreutils/LICENSE -%doc %{_usr}/share/doc/%{name} +%doc %{_docdir}/%{name} %package restorecond Summary: SELinux restorecond utilities @@ -453,4 +461,4 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog -%autochangelog +%add_changelog %SOURCE3