Do not use %autochangelog

It can't be used without %autorelease.
Use our own macro to add entries from SOURCE3: changelog to %changelog

    %add_changelog %SOURCE3

Also install changelog to /usr/share/doc/policycoreutils/changelog

.gitignore

@@ -357,3 +357,13 @@ policycoreutils-2.0.83.tgz
 /selinux-3.6.tar.gz
 /selinux-3.7.tar.gz
 /selinux-3.7.tar.gz.asc
+/selinux-3.8-rc1.tar.gz
+/selinux-3.8-rc1.tar.gz.asc
+/selinux-3.8-rc3.tar.gz
+/selinux-3.8-rc3.tar.gz.asc
+/selinux-3.8.tar.gz
+/selinux-3.8.tar.gz.asc
+/selinux-3.9-rc2.tar.gz
+/selinux-3.9-rc2.tar.gz.asc
+/selinux-3.9.tar.gz
+/selinux-3.9.tar.gz.asc

0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch

@@ -1,4 +1,4 @@
-From 7030465cd94d22aef6824e46df69f82b256195c8 Mon Sep 17 00:00:00 2001
+From ce28d432bef8d1a346054b56a989e58533fecfa7 Mon Sep 17 00:00:00 2001
 From: Dan Walsh <dwalsh@redhat.com>
 Date: Fri, 14 Feb 2014 12:32:12 -0500
 Subject: [PATCH] Don't be verbose if you are not on a tty
@@ -9,7 +9,7 @@ Content-type: text/plain
  1 file changed, 1 insertion(+)
 
 diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
-index cb50fef3ca65..13ac07414c14 100755
+index b7cd765c15e4..f2518e96e34c 100755
 --- a/policycoreutils/scripts/fixfiles
 +++ b/policycoreutils/scripts/fixfiles
 @@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
@@ -21,5 +21,5 @@ index cb50fef3ca65..13ac07414c14 100755
  THREADS=""
  RPMFILES=""
 -- 
-2.44.0
+2.50.1
 

0002-sepolicy-generate-Handle-more-reserved-port-types.patch

@@ -1,4 +1,4 @@
-From 856ac05345d8557a38e82d012a4d13b4d34efd6f Mon Sep 17 00:00:00 2001
+From 618ae48ebf1334f9380a9ae7460c553515f9c4ca Mon Sep 17 00:00:00 2001
 From: Masatake YAMATO <yamato@redhat.com>
 Date: Thu, 14 Dec 2017 15:57:58 +0900
 Subject: [PATCH] sepolicy-generate: Handle more reserved port types
@@ -68,5 +68,5 @@ index adf65f27a822..f726ad51b775 100644
          dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
      return dict
 -- 
-2.44.0
+2.50.1
 

0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch

@@ -1,4 +1,4 @@
-From 8f7a90cb77a79aaef2ceca75bc25679a7b17ff98 Mon Sep 17 00:00:00 2001
+From 16fd581da479f80b8f8ff8ae8ff58a4f0a610d54 Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Wed, 18 Jul 2018 09:09:35 +0200
 Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
@@ -71,5 +71,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644
      if [ -z "$WAYLAND_DISPLAY" ]; then
          DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null'
 -- 
-2.44.0
+2.50.1
 

0004-Use-SHA-2-instead-of-SHA-1.patch

@@ -1,4 +1,4 @@
-From 4884c917237e53e34d3fc75dcf4f07217cfd7584 Mon Sep 17 00:00:00 2001
+From 1a3fc195c6dc7fe51ef76e4484910f7b41161ccc Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Fri, 30 Jul 2021 14:14:37 +0200
 Subject: [PATCH] Use SHA-2 instead of SHA-1
@@ -13,10 +13,10 @@ The use of SHA-1 in RHEL9 is deprecated
  4 files changed, 20 insertions(+), 20 deletions(-)
 
 diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
-index c3cc5c9b0e52..6160aced5922 100644
+index 1134420e0e28..77dd05421d11 100644
 --- a/policycoreutils/setfiles/restorecon.8
 +++ b/policycoreutils/setfiles/restorecon.8
-@@ -95,14 +95,14 @@ display usage information and exit.
+@@ -103,14 +103,14 @@ display usage information and exit.
  ignore files that do not exist.
  .TP
  .B \-I
@@ -34,7 +34,7 @@ index c3cc5c9b0e52..6160aced5922 100644
  enable usage of the
  .IR security.sehash
  extended attribute.
-@@ -200,7 +200,7 @@ the
+@@ -208,7 +208,7 @@ the
  .B \-D
  option to
  .B restorecon
@@ -43,7 +43,7 @@ index c3cc5c9b0e52..6160aced5922 100644
  attribute named
  .IR security.sehash
  on each directory specified in
-@@ -217,7 +217,7 @@ for further details.
+@@ -225,7 +225,7 @@ for further details.
  .sp
  The
  .B \-I
@@ -134,10 +134,10 @@ index 31fb82fd2099..bc22d3fd4560 100644
  	}
  
 diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
-index ee01725050bb..57c663a99d67 100644
+index eabf0a1cf755..187f45131a1f 100644
 --- a/policycoreutils/setfiles/setfiles.8
 +++ b/policycoreutils/setfiles/setfiles.8
-@@ -95,14 +95,14 @@ display usage information and exit.
+@@ -104,14 +104,14 @@ display usage information and exit.
  ignore files that do not exist.
  .TP
  .B \-I
@@ -155,7 +155,7 @@ index ee01725050bb..57c663a99d67 100644
  enable usage of the
  .IR security.sehash
  extended attribute.
-@@ -261,7 +261,7 @@ the
+@@ -270,7 +270,7 @@ the
  .B \-D
  option to
  .B setfiles
@@ -164,7 +164,7 @@ index ee01725050bb..57c663a99d67 100644
  .B spec_file
  set in an extended attribute named
  .IR security.sehash
-@@ -282,7 +282,7 @@ for further details.
+@@ -291,7 +291,7 @@ for further details.
  .sp
  The
  .B \-I
@@ -174,5 +174,5 @@ index ee01725050bb..57c663a99d67 100644
  and provided the
  .B \-n
 -- 
-2.44.0
+2.50.1
 

0005-python-sepolicy-Fix-spec-file-dependencies.patch

@@ -1,4 +1,4 @@
-From cb1b3bdca016edaa90e92b49d51544f8a38cba19 Mon Sep 17 00:00:00 2001
+From 84b051139ab536519cc8e9c333483475d830d40b Mon Sep 17 00:00:00 2001
 From: Vit Mojzis <vmojzis@redhat.com>
 Date: Tue, 30 May 2023 09:07:28 +0200
 Subject: [PATCH] python/sepolicy: Fix spec file dependencies
@@ -44,5 +44,5 @@ index 433c298a17e0..a6d4508bb670 100644
  
  mid_section="""\
 -- 
-2.44.0
+2.50.1
 

0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch

@@ -1,44 +0,0 @@
-From dc3eca6bd964e545fda4a1e19d07c26a347c5d9a Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <lautrbach@redhat.com>
-Date: Mon, 19 Aug 2024 19:51:51 +0200
-Subject: [PATCH] sepolgen-ifgen: allow M4 escaped filenames
-Content-type: text/plain
-
-When a file name in type transition rule used in an interface is same as
-a keyword, it needs to be M4 escaped so that the keyword is not expanded
-by M4, e.g.
-
--	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "interface")
-+	filetrans_pattern($1, virt_var_run_t, virtinterfaced_var_run_t, dir, "``interface''")
-
-But sepolgen-ifgen could not parse such string:
-
-    # sepolgen-ifgen
-    Illegal character '`'
-
-This change allows M4 escaping inside quoted strings and fixed described
-problem.
-
-https://bugzilla.redhat.com/show_bug.cgi?id=2254206
-
-Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
----
- python/sepolgen/src/sepolgen/refparser.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/python/sepolgen/src/sepolgen/refparser.py b/python/sepolgen/src/sepolgen/refparser.py
-index e261d3f78f87..9622ee9a29ce 100644
---- a/python/sepolgen/src/sepolgen/refparser.py
-+++ b/python/sepolgen/src/sepolgen/refparser.py
-@@ -261,7 +261,7 @@ def t_IDENTIFIER(t):
-     return t
- 
- def t_FILENAME(t):
--    r'\"[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\"'
-+    r'\"`*[a-zA-Z0-9_\-\+\.\$\*~ :\[\]]+\'*\"'
-     # Handle any keywords
-     t.type = reserved.get(t.value,'FILENAME')
-     return t
--- 
-2.46.0
-

0006-sepolicy-Fix-detection-of-writeable-locations.patch

@@ -0,0 +1,65 @@
+From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Mon, 5 May 2025 18:28:40 +0200
+Subject: [PATCH] sepolicy: Fix detection of writeable locations
+
+- update substitutions from /etc/dnf/var
+
+It seems that by default dnf api does not read /etc/dnf/var/* files to
+update substitutions and so it can't resolve correct mirror list when a
+variable is part of the link.
+
+- alway run query.run()
+
+Fixes:
+    Traceback (most recent call last):
+      File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load
+        ret = self._repo.load()
+              ^^^^^^^^^^^^^^^^^
+      File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load
+        return _repo.Repo_load(self)
+               ^^^^^^^^^^^^^^^^^^^^^
+    libdnf._error.Error: Failed to download metadata for repo 'baseos':
+    Cannot prepare internal mirrorlist: Status code: 404 for
+    https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198)
+
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ python/sepolicy/sepolicy/generate.py | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index f726ad51..a0314a70 100644
+--- a/python/sepolicy/sepolicy/generate.py
++++ b/python/sepolicy/sepolicy/generate.py
+@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s;
+         import dnf
+ 
+         with dnf.Base() as base:
++            base.conf.substitutions.update_from_etc('/')
+             base.read_all_repos()
+             base.fill_sack(load_system_repo=True)
+ 
+             query = base.sack.query()
+ 
+-            pq = query.available()
+-            pq = pq.filter(file=self.program)
++            pq = query.filter(file=self.program)
+ 
+-            for pkg in pq:
++            for pkg in pq.run():
+                 self.rpms.append(pkg.name)
+                 for fname in pkg.files:
+                     for b in self.DEFAULT_DIRS:
+@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s;
+                                 self.add_dir(fname)
+                 sq = query.available()
+                 sq = sq.filter(provides=pkg.source_name)
+-                for bpkg in sq:
++                for bpkg in sq.run():
+                     for fname in bpkg.files:
+                         for b in self.DEFAULT_DIRS:
+                             if b == "/etc":
+-- 
+2.49.0
+

0007-fixfiles-use-grep-F-when-search-in-mounts.patch

@@ -1,59 +0,0 @@
-From 23e9ed5aa00cab872ad18f492eab25af464885b4 Mon Sep 17 00:00:00 2001
-From: Petr Lautrbach <lautrbach@redhat.com>
-Date: Wed, 13 Nov 2024 12:20:32 +0100
-Subject: [PATCH] fixfiles: use `grep -F` when search in mounts
-Content-type: text/plain
-
-systemd escapes luks uid so that mount points contain '\' and grep
-should not consider this as regexp
-Fixes:
-    $ cat /proc/self/mounts | sort | uniq | awk '{print $2}'
-    /run/credentials/systemd-cryptsetup@luks\134x2d6d1f41e6\134x2d5538\134x2d41a0\134x2db383\134x2cd41c2ddcacaa.service
-
-    $ sudo fixfiles -B onboot
-    grep: Invalid back reference
-    grep: Invalid back reference
-    System will relabel on next boot
-
-Suggested-by: Christopher Tubbs <ctubbsii@fedoraproject.org>
-Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
----
- policycoreutils/scripts/fixfiles | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
-index 13ac07414c14..f2518e96e34c 100755
---- a/policycoreutils/scripts/fixfiles
-+++ b/policycoreutils/scripts/fixfiles
-@@ -45,9 +45,9 @@ FS="`cat /proc/self/mounts | sort | uniq | awk '{print $2}'`"
- for i in $FS; do
- 	if [ `useseclabel` -ge 0 ]
- 	then
--		grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i
-+		grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)seclabel(,|$)' && echo $i
- 	else
--		grep " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i
-+		grep -F " $i " /proc/self/mounts | grep -v "context=" | grep -E --silent '(ext[234]| ext4dev | gfs2 | xfs | jfs | btrfs )' && echo $i
- 	fi
- done
- }
-@@ -55,14 +55,14 @@ done
- get_rw_labeled_mounts() {
- FS=`get_all_labeled_mounts | sort | uniq`
- for i in $FS; do
--	grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i
-+	grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)rw(,|$)' && echo $i
- done
- }
- 
- get_ro_labeled_mounts() {
- FS=`get_all_labeled_mounts | sort | uniq`
- for i in $FS; do
--	grep " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i
-+	grep -F " $i " /proc/self/mounts | awk '{print $4}' | grep -E --silent '(^|,)ro(,|$)' && echo $i
- done
- }
- 
--- 
-2.47.0
-

0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch

@@ -0,0 +1,91 @@
+From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001
+From: "Richard W.M. Jones" <rjones@redhat.com>
+Date: Wed, 10 Sep 2025 11:42:09 +0100
+Subject: [PATCH] setfiles: Add -A option to disable
+ SELINUX_RESTORECON_ADD_ASSOC
+
+SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with
+multiple hard links or bind mounts that have differing contexts.
+However doing this involves building a large internal hashtable that
+stores the full path of every file examined by setfiles.  For
+filesystems that have very large numbers of files or long pathnames,
+this uses a lot of memory, which makes SELinux relabelling in
+constrained memory environments infeasible.
+
+This adds a new setfiles -A option that disables this tracking.
+
+For example, using setfiles to relabel a filesystem with 15 million
+files took 3.7GB of RAM.  Using this option, the same filesystem can
+be relabelled in 121MB (albeit with no warnings or errors possible for
+conflicting labels, but for our use case we don't care about that.)
+
+Fixes: https://issues.redhat.com/browse/RHEL-111505
+Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+---
+ policycoreutils/setfiles/setfiles.8 |  5 +++++
+ policycoreutils/setfiles/setfiles.c | 11 +++++++----
+ 2 files changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
+index 187f4513..458f3f9f 100644
+--- a/policycoreutils/setfiles/setfiles.8
++++ b/policycoreutils/setfiles/setfiles.8
+@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
+ .RB [ \-I | \-D ]
+ .RB [ \-T
+ .IR nthreads ]
++.RB [ \-A ]
+ .I spec_file
+ .IR pathname \ ...
+ 
+@@ -187,6 +188,10 @@ use up to
+ threads.  Specify 0 to create as many threads as there are available
+ CPU cores; 1 to use only a single thread (default); or any positive
+ number to use the given number of threads (if possible).
++.TP
++.B \-A
++do not track inodes with multiple hard links or bind mounts that would
++match different contexts (saves memory)
+ 
+ .SH "ARGUMENTS"
+ .TP
+diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
+index ad09f840..31034316 100644
+--- a/policycoreutils/setfiles/setfiles.c
++++ b/policycoreutils/setfiles/setfiles.c
+@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
+ 			name, name);
+ 	} else {
+ 		fprintf(stderr,
+-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
+-			"usage:  %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
+-			"usage:  %s -s [-diIDlmnpqvFUWT] spec_file\n",
++			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
++			"usage:  %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
++			"usage:  %s -s [-diIDlmnpqvAFUWT] spec_file\n",
+ 			name, name, name);
+ 	}
+ 	exit(-1);
+@@ -147,7 +147,7 @@ int main(int argc, char **argv)
+ 	const char *base;
+ 	int errors = 0;
+ 	const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
+-	const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
++	const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:";
+ 	const char *opts;
+ 	union selinux_callback cb;
+ 	long unsigned skipped_errors;
+@@ -375,6 +375,9 @@ int main(int argc, char **argv)
+ 			if (*optarg == '\0' || *endptr != '\0')
+ 				usage(argv[0]);
+ 			break;
++		case 'A':
++			r_opts.add_assoc = 0;
++			break;
+ 		case 'h':
+ 		case '?':
+ 			usage(argv[0]);
+-- 
+2.49.0
+

0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch

@@ -0,0 +1,98 @@
+From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 1 Sep 2025 18:17:10 +0200
+Subject: [PATCH] semanage: Reset active value when deleting boolean
+ customizations
+
+Currently, removal of boolean local customizations leaves their current
+(active) value untouched.
+
+After the removal is complete, semanage_bool_query will return the
+default value. But it needs to be called in a separate transaction.
+This makes the fix a bit awkward, but I have not found a way to query
+the default value before the first transation is committed.
+
+Fixes:
+  # getsebool smbd_anon_write
+  smbd_anon_write --> off
+  # semanage boolean -m1 smbd_anon_write
+  # semanage boolean -D
+  # getsebool smbd_anon_write
+  smbd_anon_write --> on
+  # manage boolean -l isemanage boolean --list | grep smbd_anon_write
+  smbd_anon_write                (on   ,  off)  Allow smbd to anon write
+
+Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
+---
+ python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 43 insertions(+)
+
+diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
+index 10963e81..6d6188fd 100644
+--- a/python/semanage/seobject.py
++++ b/python/semanage/seobject.py
+@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords):
+         self.__delete(name)
+         self.commit()
+ 
++        # New transaction to reset the boolean to its default value.
++        # Calling __reset_value in the same transaction as the removal of
++        # local customizations does nothing
++        self.begin()
++        self.__reset_value(name)
++        self.commit()
++
+     def deleteall(self):
++        deleted = []
+         (rc, self.blist) = semanage_bool_list_local(self.sh)
+         if rc < 0:
+             raise ValueError(_("Could not list booleans"))
+@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords):
+ 
+         for boolean in self.blist:
+             name = semanage_bool_get_name(boolean)
++            deleted.append(name)
+             self.__delete(name)
+ 
+         self.commit()
+ 
++        # New transaction to reset all affected booleans to their default values.
++        # Calling __reset_value in the same transaction as the removal of
++        # local customizations does nothing
++        self.begin()
++
++        for boolean in deleted:
++            self.__reset_value(boolean)
++
++        self.commit()
++
++    # Set active value to default
++    # Note: this needs to be called in a new transaction after removing local customizations
++    # in order for semanage_bool_query to fetch the default value
++    # (as opposed to the current one -- set by the local customizations)
++    def __reset_value(self, name):
++        name = selinux.selinux_boolean_sub(name)
++
++        (rc, k) = semanage_bool_key_create(self.sh, name)
++        if rc < 0:
++            raise ValueError(_("Could not create a key for %s") % name)
++
++        (rc, b) = semanage_bool_query(self.sh, k)
++        if rc < 0:
++            raise ValueError(_("Could not query boolean %s") % name)
++
++        semanage_bool_set_value(b, semanage_bool_get_value(b))
++
++        rc = semanage_bool_set_active(self.sh, k, b)
++        if rc < 0:
++            raise ValueError(_("Could not set active value of boolean %s") % name)
++
++        semanage_bool_key_free(k)
++        semanage_bool_free(b)
++
+     def get_all(self, locallist=0):
+         ddict = {}
+         if locallist:
+-- 
+2.49.0
+

bachradsusi.gpg

@@ -316,6 +316,123 @@ kAIi0B1szn0K13qRqBIwjnWL+orP1KLzvczCH6yD0FZY90CDdMtM0VB6AqT4BFh6
 5+ygjA4YiA7fFYBm8510ybUcNfzU3gUIJ5pF8MdGizO54tCPSK6U+iVRY4qfCFdu
 IiOZ7FUUn78VIxQUMYMrozy7kn/0PQZa7KKRbXJ8sg0sgrQapwpgUjdMwuYZPGGv
 1Jw5/+WUGWMbGxmlpHcEOmsPZpITH557M/kHyk9Ud0iKwciBI2mGLxiafCuLrUY4
-TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfg==
-=I8Dr
+TknzOqbZgjdllcUG4cDBEQuBO/GSj1LUfpkCDQRnKRF7ARAAo5H9/6cStbyjWFeb
+G6qDn6pT+4v1rlbRZo0rYwWkDmEAjOZMRC9SJipTCdQeNFlv6HEiiCvl3bmZIqrZ
++zvLI6U1+2dH7k06xNqIFLTV0zbr+tUkOwspg5nr59KsuNP01WBS0ELzunO/zHj+
+BOEdPg1KvB0IQFtqAwaAfuny67YvTr9O7Yz07ZCfTxPtHf6FJ80FPeRa0LoZYnW4
+UmSGtm1f59VD9+qe4yhRtNanamXUKjf8BTw0rQwjoJhVT5Mg0Z6hW6fhFrD57Lgd
+8fBi5ZHHUlR4z1+nqGCUoHlHjc0JVyK8j8fofKafow/79ITaOqBzv+P3psY9ecBg
+7wGaOHrqzRzRxAfKYRO2IaFHRGnsEE8FnwSEL00uPVxpiiTavrLJFEjku9GmP3OY
+3rbwIPXbw1m9mZG1yAVbSEEf58WSWeoBp0O6qrwAdIbdgUX4BkQ8bX5MtUjXp5tm
+0StmjQiZ7O91cg0VuWtrfj/I4E3xtloNzhtG2QLI4s7iAL1orhClxEuZRO9alUCS
+cnRvhmw2Dh6sB6i56evcZdUFwxMXOByxfWr0fxX4QlR8jYqMPj7UMNj2PccTBOQX
+umIW2cdGEeni9vrE9cLfZRSNCwPWAXWtr1zQW54Jx5DjCGHobQk53Z7kE+MZVAje
+gOaT0u50cljBNfJootuln4+gbGMAEQEAAbQlUGV0ciBMYXV0cmJhY2ggPGxhdXRy
+YmFjaEByZWRoYXQuY29tPokCVwQTAQgAQRYhBGjSGCM0KhNoOus+TvtMaFtdwcE+
+BQJnKRF7AhsDBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEPtM
+aFtdwcE+doMQAI5mnNA8aH0dfeOZnz/NrMwY6H7jK/+lYatCx05e1TfK+zz9feRK
+sxgP3Pjj0p9igo3jIdPcN5/YnlmVEeplDmSiKOOdendviy+sA8sukMo07Q+m1pYW
+NzFtyiZd+c44mp9I1l7h6rktIY9XDedrlAkNog1VlUet9eNpmgXt2OmJNDmYftWc
+KIpyw/ZLaubjRcAmxwsn7I6dWnT66Ffg9H8trcRlWipVWP8imO0EIpwC8RbhuNgk
+xjt/cVf3CEpzokF4n0k3nqYmt90NNtGc0kG5QAlTvlUuHpNWzuzvdAPtMy3KEaXI
+fu3IEZeIKCxSgWXTm7zRKUn0F6jKAsLXhK/WOA1Aa7NdAUwMxrEndfNoqBrusaLD
+lpzWU7USv2YT+Pf3aQ7u1szg2J8V5eqRP+E8wwe54RNCgQrcDgUq5abyncsvull3
+GqJvzvZC7/Q3Th/g5Wc+dRaGBz0O9FBuRPQwjrnB932xW1fDf17cScpVKAvV/jwn
+tpWXf7nSv2M0o9fihnTBl4d2c2EBKtTdp5W0IpeRl5uLad3AYoouP6RoZ+/Id/Zg
+NeaQKH/ZlCxk5S9GLzYhm665ysOYRkh7NfoThRtvAqAeDcTKWGDG1nQok2KKOSyq
+S81PT2AlMz7A26R0vsH/9lQ1uZFIhIGbxZXlGERZwXd1s+lgfWTbB5K+iQIzBBAB
+CAAdFiEEuGgoR3ZN9g31LZksvDkF8jUXnPEFAmcpGAUACgkQvDkF8jUXnPFdGQ/+
+L7uA7EMB+Yh0urhZuOltZSNtge6b+UbLZTd8DRsf044e+Z0NJWdQ2saLBptGhIcn
+as4Qd0gS+QkWB7lMrJ31uux15ZBjFsGtyqK+VoH8JIPvV8Mr5XojqA+UYUpXP6ns
+ILrdkUvNzpeA51IxYuVMWcut8SUVYzjD11YG1P8LFzydsImaYe7se+RE85F3/2Po
+kZNe0d0Gh36uyfJSND80XrrxLpROgabQgHNG0drL/DHjdoa3F0V5EUoG7NBwUrmB
+RlWKYCLUFfW+8mQn6RVK8JIV9WaHrzi/KAZLonZb5dCjO0e+Ol16pyUofLA8SN7B
+aqjens8ho297GtE3darkXmj5p3p4YPur/D+oZCNIH+BYMsht46VtE3v6V10P8KA2
+6MgNo5qME1Q0kC1DUYi68cPeDgrQBMWa+nF+m9i2aGeAyi3qDhZu03JLhOYAhv45
+OVRawm9vFqyKiBRANVogTRr+ch4zywaapwfVLQ+xiwVLqlT5n/iIzWCQ0hA15eKZ
+gJV0kTXL4OWKBeJqSNnnLVm4AhZ2OpKHMsjE7BEopvCe9JZWFIrjtQ9TrriByOx0
+3anWkmm7b4lZ1HKDOI/Cxyz8BZvYizo7hSOdGjLrFBTD/Wk0swvpzB4NKh5I6N7k
+gppXMTaWp36+KmQx66JzaZjepGl1VMNFdgiP6Sw6pO+5Ag0EZykRewEQAK4EY+06
+GeuX4wLlUqAMWCnbFELuhBZGWFLEIvP6WJS1WOvee45RVcpVfYMp3AqymiNRahAl
+RMtSQ9YtXSdlBPkhtNcoV/hqjcNywMdbsy+Rs27pRk/DJVC0yVL4ABrSSlwhfNa4
+6X4ZvPr8GGDvjAUhK6NXQ7WrZJxYR9/U0nqRGtGuPBLhFey1H60n5axP8+2f9pFC
+NbDJ13HbrhVju+RUeE8Gq5WJI5dea5SfYnXFERsT/zO+pw7ZaaSDmWKR1a88P6Bk
+DD7e63ZIaAa849M/Dz+OgzNEgbyRjvgbO0OEIrS2x61lGoW7F9prEgzj97NIiBu6
+qpNCYJefkpfPENrk+wmOUthJfh6E7uphlliQams6dqXAc3Z+xBN9jFf74RpzVmIP
+K/MFNr0EcUMFgURpBtaTrk4dGMh++v5i4qKxxwJHf4RsGCDsgH9ZZDemKz5q8uFN
+TI1kbTnsKNt+d7L45U+3/mRm4l22g8eu+AvD6R4GfKjsyzEFCyGK7TmVYj0Y+EGR
+9+YbRQ1GahXqtrR/aLC09LSyxQTqYfKU8KusnoceEbBOigEZUNPybpzibwHl1VEV
+9crR5eT8MPHgs8xdpjQ7gRuPi12fvc83unpUsNIHSCxZqXoilGsz2+zpX2si3PxB
+tK/tTo6ZFRLijhHs250Y1agp4MyXYq91A2VTABEBAAGJAjwEGAEIACYWIQRo0hgj
+NCoTaDrrPk77TGhbXcHBPgUCZykRewIbDAUJA8JnAAAKCRD7TGhbXcHBPozGD/0Y
+fkktGwGq2vPZUI/Fscv+VnEqVt94dBnS0/6GyYvhI7Tf81v+72URlQeX8TUQox9B
+8d3Aru5b2+iSkPcvH70PbY8jt/yTwHtSlFzf6+YPIl+oyTz7DoiILSjrO51ntl8g
+KmIb8Q9W74xV6VFIJ4m8rH04MKFpIlzUDq660JYQIGtOUFugSfg7aLVU/0j4WKKE
+KfAfg93wYTKKd+JgRFy4FZPriem7HvlUSi2VKffdrrUF/PX35X74iKdPQoEADZi8
+KkMZULDtyQ6ZOu2hiDpArjo5hDadKM314Z65VnM11hjiEhmTF3IyGBllb0qBIk0L
+nBVHuMYmiqBNJEbaqHLqIju8/RvFlYV+AMISeA7B68knbJcao13ogtDpuJ4hpgCj
+j2B1n0NWMcju0gteu1sfsIaQbWHevH2vgl5LJDCNtUJN/NoWB2Uov27wEvsongwY
+3du40TnM+5ejwf4r8D3wX+JpVCAhfr3Oc0knw14nRqFPAe1E7DNURJ8xfEV9iPRA
+swo6qoh7IIxNETUG1rywRExNt6tHsojx0Wb0I0IB7CnWRK9F6oNRp0S4kVgp+Jeh
+a9NGXFK2hn8qBD/rpUPsj/OdkiBN+C7Ai07rCNez+IKdnUfXkOJqLCOyeUwC9WPl
+uFPB9RnnghYM4xhMWf8XvSLOOk/vgPxiqR5ANLObsbkCDQRnKRLhARAAuh+b2Oxj
+9q+RRZ+pkDVf/M6P01yDmDhwtYHzi/LW8PFHC6iQlzMReyv1R5n3uCEpAZ++mdUe
+Cgo2TmFnYdpmxEgdaMIW98uqe4fuHhoXU2Mh4eiN7jyJvXQCsijCDYzifoj03HY7
+nTVjw4+BSSu9kA3/vEqU9A5YjG01MmVSMaIaTrqZqsnypK6r2exJa7YVRYwRqpLY
+C5ksikDVK9ftdfhjnsnYGS4pYyfMNSHY1KBMpHjT7wEkM+KZ2WRpjTZZ7nP9u4Lf
+fJMKgcclRgf+13CeSaJfVIhjJlxGVLkloE8XJbOeh2vkK257e9BenEFgQnyLCpGJ
+8YNsnsJVhxU1aA62dT7jmnOVMBhnGoNhMyzzfvUw0REz2VbpZBkiwZRfZ9MWUBsy
+bneH8NwzZMQQLCc/yo/jnPrmDS+tgl4CXGzBtpxPUZSMuY4tHZZ2vBb0zcfhY7P1
+CrHuylXLFzkOO/XRP3w1F8I1UqJCjdTKjdjCDF/VWtedHee1iEsSHxPGH8fHp4Qp
+rBDDwZ4NnfilYNHMDWm6U1bzhX2ynqcGArQSd1Ny/oL7JzE1qoH/nNrwVvOSSNWF
+UTXFXeLy+SOXJdFJpGP+/wV+gYfyczoUP6vmCdK1Hs15WQvKzyP/nmLS5uLilfxV
+KrxZDI6SNrS4f/XkHcGnYByFKUhq5gVN0ZcAEQEAAYkEcgQYAQgAJhYhBGjSGCM0
+KhNoOus+TvtMaFtdwcE+BQJnKRLhAhsCBQkDwmcAAkAJEPtMaFtdwcE+wXQgBBkB
+CAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmcpEuEACgkQzcroySfGvjExiQ//
+TKQ2Ci+sqNSVIcwg/k0Go1i4cA7lhKNdYRBCaIThB9jMqNg2zgPzgELBcaVJL8xw
+0E2x2ZvBejM4X+eTrmkdufcxHR8B/zBF8oPlD2pgs/zZmZEO1gq4Cdab7yIoVNNr
+foCZShxOCPR2wIixcYZtt5f7Z3zSXqkjIec6sTOedT75ZXrpQbvINeUkvOJfMCOi
+ailauvDfv8k5iJUVbP+Dx1vOc88bvewVJcbLID4HIRr/PS+k1D10zGbnF71TnxGZ
+r7anMZCSFCHJ5WV+BSwHHKtxRy+bJ1x9ML45Jcr1anTXeaHIeSKNzFBigJQSgHv0
+euegkD3Rmw+IcxNb4l536selaNR0UAwx1DC1qpjBtnE9/pXdTEsZQxq9kMrj0d+f
+VKFjOKADVIpkx7o0dZ1jmbUmdjQVyGDgHE+Emgdd726/2ftWriW2uPeUC6YZiqbt
+vBnCnwF+aV6P1nrE0BWJchLyBjDCe5Y2oXBAYF6xwpDPfMPr4oscqzPV4TWVULBi
+brtRWgSxmvinIGFx9T9wQCVfX254dqBaAEhRMImoT/YP+6evRZKqQODRhI44OG7u
+V71IVAJ8BHEBN8hxvQM3WPs1fhwMBFCyGfr/x/U4/c78R9JhxkU9VwmMbLGQP7VP
+1QgfiHqZpHMk8ZUmQn6KLeurzWcnwPFkwgFPZED8OQOMXxAAio3DhWr5KDd3mICH
+ALNY0A2ipb/JH6LSHxu0S3MLa/bF6PbqRY1+fKMT/cFVxln99rNUrX+hDRbc7qbh
+KkxvGmcnXnkcTHah9bfUghEanlKkBr1g1ik3zgEnpO/x3+X39Ov+ge92MDawV0nq
+k9R/9tS+ZD/ph72Q9kx3ZfVNSL0eWxjuwBzFW0Zwh5TAX4raSmyQCmAXi05O3YmN
+iq4arSUg5oAOMRZ+d96DsrAS4Sdtlx6/CuKTBzEaGPQLQ9wJNB0Vmd/eQWTP99KY
+cAdIwj5BJ5P0Z7+xhsVjQOntn4otnP6vN6RuDtYrS6M7TCN/ZeKCvN/G0nRac4D+
+IJX3CYYtYXgaoDuoetUWtc7O5PzHRETaBt/46ob2lzf6cT5QyVujTfz+i0rGEc63
+pvXK8mV+K7BFY/DHpdEhl1pDw2YYLbBmUthQWdsL6/TVvpMe/wZadvJ/by3AeRzQ
+eusUucuSo9UNN7Yj8u3dRhxNgsSiU96A/SFlAoB5s3Onh5K4WEVCBu/INjdi+r2B
+LJePSnA3I7VkRE9Haf1D28jtBzm3Xbft2rs3lO18FcCqw6kd7Ih3e0tZ8uUG9UDv
+qTDHTUHLAWvwrq38gKKAu2RMaU06A5kR87RcQiizxOwBIwiHuUWMU4/Hyx6fXsOD
+hEs0O6AFDarNDZGee2amKTAyZpG5Ag0EZykTxQEQAOwGV1boBD3vDLsoAT62nGxb
+SqXiBsObxnpWbNifOzM9BUGPOIpHsSH32PZGG/+LNjNdECfyyP1RysH5OT7j92Q8
+vgRQoG3X985gbOjYyZc0xvAkTSvWxOiy5CuF3X8sJ3NSerQDXwjP9qVqLVj/3FB8
+nka1HFS7KzC3Zo/kzCoxeZ3/hV3PTWIjcoJvtBSCKPZyOJxnRqWfi5BNJo3S2SR1
+mxV967zawXiZ8MeeBl6rLhOfCBtz9g+bqrXZYoenuMn5Js2mcH0haYeMSV3UWIC4
+kinzr1EJxs+L1/hVCVBNiiDc6DXcFXoz9ZVc9kjpZTOMoZVDkRkyOeen+5Sya9wK
+4teLmDLME4+pgeHCS/Wa4KrYyEWe7NpG1VTkSJnRS+fyYGTWtwEiuwT6J9U0t1d5
+hbxhM7YAhlnOEnNVmqa3Bq3yqJs9G/7gicZ7CIJ9JBHKTJzOnKfpGhxBSOgOoCOa
+WW6uVCzDqfrYPmCUIKQmanB441xJFGuHVPMLBjVjswoMKGkK3gM6KMRCDYQ53u6s
+FK+Jcl8HobBSezVIUKpKVX3IW9d506cE0FhSW/NvWJv0FIMVloyC2BpOjSWVgEwX
+tk/m3SKPsgCAcCqzi7xlloR8+E9C2xci9cdGG5faghgSjaP6j0qDww/slRPQJc5A
+DIeukkOYTCiSiDwQtblJABEBAAGJAjMEGAEIACcWIQRo0hgjNCoTaDrrPk77TGhb
+XcHBPgUCZykTxQMbIAQFCQPCZwAAADcWD/4qJRLn7TcMtRMF43Yn+dX+O13YrxBC
+T4n1QVmiPsGrUca4Vg1J+trV6IMsGrhktpiaV0qeL/km0h02m4gEDZKDyWWXdeWh
+EXFaTVy9yCpSXUWJl5gSXTSwxrqBWyWLlLLk4UT9l9sk5mMdy0JA8unobV4M/eXQ
+ggR11DL3ji7aO0hsqxyxXkJcawWjVGW5KL1EaoDKIJ/CwxOI5ipFueMIRQjQvw9A
+o/w2fq11qVXY9zknk6pFkp/RDHLes+wVHDtebZfJ9xV7Mb1mf/k03dT56GaA/U3E
+XvJ2FdgWR+zf+YMEa9MPDHYo2UNEvk9mOk247M8s+OeexdlkPgyKW5A8mtYuY/dR
+j8W6C4pLcMWa+d/vIUpm5Guw0F5q0AWk9/FbBe9HLztEevvRnuHXmfTZeto/nCAi
+Yg4pCj6p3JoN5CLebR8YtWm9AJBbX1kgVvqSU2VgwYIFsxBEz8Wu2h7z/eSCSeIg
+ARFbTlJ6cBrRkXCVyhbv0LPWWUfAUqiEtdGxrA4Xx/jKrI02JjRdW/bZkXjSka8K
++cDlpcr9ixBWW5LkWsOdiL8jExfTGw25FA7Wd1HiHnBv36Mu/zb+0/I63d+fLq93
+e3lmmVx9qQF8p5Okf4ojY9YoIHVkLS7t9AgFjm/ucmpEGbXxyPk2Cr3l+b5R41x3
+dBW9kxiuWpZN3Q==
+=iuRK
 -----END PGP PUBLIC KEY BLOCK-----

changelog

@@ -1,3 +1,53 @@
+* Thu Dec 11 2025 Vit Mojzis <vmojzis@redhat.com> - 3.9-7
+- semanage: Reset active value when deleting boolean customizations (RHEL-111421)
+- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)
+- sepolicy: Fix detection of writeable locations
+
+* Thu Dec 11 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.9-6
+- Bring back patches unintentionally dropped before
+
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 3.9-5
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 3.9-4
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Tue Jul 29 2025 Miro Hrončok <miro@hroncok.cz> - 3.9-3
+- Drop unused BuildRequires on python3-wheel
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.9-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Wed Jul 16 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.9-1
+- SELinux userspace 3.9 release
+
+* Fri Jul 04 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.9-0.rc2.1
+- SELinux userspace 3.9-rc2 release
+
+* Wed Jun 25 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.8-3
+- Use multiprocessing 'fork' method (rhbz#2374569)
+
+* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 3.8-2
+- Rebuilt for Python 3.14
+
+* Thu Jan 30 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.8-1
+- SELinux userspace 3.8 release
+
+* Wed Jan 22 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.8-rc3.2
+- Make `rpm` a weak dependency (bz#2338647)
+
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.8-0.rc3.1.2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8-0.rc3.1.1
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Wed Dec 18 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.8-0.rc3.1
+- SELinux userspace 3.8-rc3 release
+
+* Thu Nov 28 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.8-0.rc1.1
+- SELinux userspace 3.8-rc1 release
+
 * Wed Nov 13 2024 Petr Lautrbach <lautrbach@redhat.com> - 3.7-5
 - fixfiles: use `grep -F` when search in mounts (bz#2323728)
 

macros

@@ -0,0 +1,8 @@
+%add_changelog(changelog:) %{lua:
+  local f = io.open(arg[1], 'r')
+  if f then
+    local content = f:read('*all')
+    f:close()
+    print(content)
+  end
+}

policycoreutils.spec

@@ -1,7 +1,7 @@
 %global libauditver     3.0
-%global libsepolver     3.7-1
-%global libsemanagever  3.7-1
-%global libselinuxver   3.7-1
+%global libsepolver     3.9-1
+%global libsemanagever  3.9-1
+%global libselinuxver   3.9-1
 
 %global generatorsdir %{_prefix}/lib/systemd/system-generators
 
@@ -10,13 +10,15 @@
 
 Summary: SELinux policy core utilities
 Name:    policycoreutils
-Version: 3.7
-Release: 5%{?dist}
+Version: 3.9
+Release: 7%{?dist}
 License: GPL-2.0-or-later
 # https://github.com/SELinuxProject/selinux/wiki/Releases
-Source0: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz
-Source1: https://github.com/SELinuxProject/selinux/releases/download/3.7/selinux-3.7.tar.gz.asc
+Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz
+Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc
 Source2: https://github.com/bachradsusi.gpg
+Source3: changelog
+Source4: macros
 URL:     https://github.com/SELinuxProject/selinux
 Source13: system-config-selinux.png
 Source14: sepolicy-icons.tgz
@@ -35,7 +37,7 @@ Source22: selinux-gui.zip
 # wlc --key <apikey> --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./
 Source23: selinux-sandbox.zip
 # https://github.com/fedora-selinux/selinux
-# $ git format-patch -N 3.7 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
+# $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
 # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
 # Patch list start
 Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
@@ -43,10 +45,14 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch
 Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
 Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch
 Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch
-Patch0006: 0006-sepolgen-ifgen-allow-M4-escaped-filenames.patch
-Patch0007: 0007-fixfiles-use-grep-F-when-search-in-mounts.patch
+Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch
+Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch
+Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch
 # Patch list end
 
+# gen_changelog
+%{load:%{SOURCE4}}
+
 Obsoletes: policycoreutils < 2.0.61-2
 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138
 # initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel
@@ -68,12 +74,14 @@ Provides: /usr/sbin/semodule
 BuildRequires: gcc make
 BuildRequires: pam-devel libsepol-static >= %{libsepolver} libsemanage-devel >= %{libsemanagever} libselinux-devel >= %{libselinuxver}  libcap-devel audit-libs-devel >=  %{libauditver} gettext
 BuildRequires: desktop-file-utils dbus-devel glib2-devel
-BuildRequires: python3-devel python3-setuptools python3-wheel python3-pip
+BuildRequires: python3-devel python3-setuptools python3-pip
+BuildRequires: (python3-wheel if python3-setuptools < 71)
 BuildRequires: systemd
 BuildRequires: git-core
 BuildRequires: gnupg2
-Requires: util-linux grep gawk diffutils rpm sed
+Requires: util-linux grep gawk diffutils sed
 Requires: libsepol >= %{libsepolver} coreutils libselinux-utils >=  %{libselinuxver}
+Recommends: rpm
 
 %description
 Security-enhanced Linux is a feature of the Linux® kernel and a number
@@ -134,7 +142,7 @@ mkdir -p %{buildroot}%{_mandir}/man8
 
 %make_install -C policycoreutils LSPP_PRIV=y SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" SEMODULE_PATH="/usr/sbin" LIBSEPOLA="%{_libdir}/libsepol.a"
 
-%make_install -C python PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a"
+%make_install -C python PYTHON=%{__python3} PIP_NO_BUILD_ISOLATION=0 SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a"
 
 %make_install -C gui PYTHON=%{__python3} SBINDIR="%{_sbindir}" LIBDIR="%{_libdir}" LIBSEPOLA="%{_libdir}/libsepol.a"
 
@@ -174,6 +182,9 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/
 %find_lang selinux-gui
 %find_lang selinux-sandbox
 
+# Install changelog to %{_docdir}/%{name}
+install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name}
+
 %package python-utils
 Summary:    SELinux policy core python utilities
 Requires:   python3-policycoreutils = %{version}-%{release}
@@ -326,7 +337,7 @@ or level of a logged in user.
 
 %files newrole
 %attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole
-%{_mandir}/man1/newrole.1.gz
+%{_mandir}/man1/newrole.1*
 %config(noreplace) %{_sysconfdir}/pam.d/newrole
 
 %package gui
@@ -373,6 +384,7 @@ system-config-selinux is a utility for managing the SELinux environment
 %{_sbindir}/genhomedircon
 %{_sbindir}/setsebool
 %{_sbindir}/semodule
+%{_sbindir}/unsetfiles
 %if "%{_sbindir}" != "%{_bindir}"
 # symlink to %%{_bindir}/sestatus
 %{_sbindir}/sestatus
@@ -390,8 +402,8 @@ system-config-selinux is a utility for managing the SELinux environment
 %{_unitdir}/selinux-autorelabel.target
 %{generatorsdir}/selinux-autorelabel-generator.sh
 %config(noreplace) %{_sysconfdir}/sestatus.conf
-%{_mandir}/man5/selinux_config.5.gz
-%{_mandir}/man5/sestatus.conf.5.gz
+%{_mandir}/man5/selinux_config.5*
+%{_mandir}/man5/sestatus.conf.5*
 %{_mandir}/man8/fixfiles.8*
 %{_mandir}/man8/load_policy.8*
 %{_mandir}/man8/restorecon.8*
@@ -401,6 +413,7 @@ system-config-selinux is a utility for managing the SELinux environment
 %{_mandir}/man8/setfiles.8*
 %{_mandir}/man8/setsebool.8*
 %{_mandir}/man1/secon.1*
+%{_mandir}/man1/unsetfiles.1*
 %{_mandir}/man8/genhomedircon.8*
 %{_mandir}/man8/semodule_expand.8*
 %{_mandir}/man8/semodule_link.8*
@@ -410,7 +423,7 @@ system-config-selinux is a utility for managing the SELinux environment
 %{_datadir}/bash-completion/completions/setsebool
 %{!?_licensedir:%global license %%doc}
 %license policycoreutils/LICENSE
-%doc %{_usr}/share/doc/%{name}
+%doc %{_docdir}/%{name}
 
 %package restorecond
 Summary: SELinux restorecond utilities
@@ -448,4 +461,4 @@ The policycoreutils-restorecond package contains the restorecond service.
 %systemd_postun_with_restart restorecond.service
 
 %changelog
-%autochangelog
+%add_changelog %SOURCE3

selinux-autorelabel

@@ -30,8 +30,9 @@ efi_set_boot_next() {
 }
 
 relabel_selinux() {
-    # if /sbin/init is not labeled correctly this process is running in the
-    # wrong context, so a reboot will be required after relabel
+    # Switch SELinux to permissive mode, fix labeling issues (or execute shell
+    # and have the user fix them) and reboot the machine so that the correct
+    # labels are applied to all services.
     AUTORELABEL=
     . /etc/selinux/config
     echo "0" > /sys/fs/selinux/enforce

sources

@@ -2,5 +2,5 @@ SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428
 SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd
 SHA512 (selinux-sandbox.zip) = ecbc0c8280eb6c013b039a2e63ee5a361cd84807613962a012ac0a98092357e9809bea23c3c71bd8ae4745b1dd12a4fce43db5e1cab31614f386a2a8db88b733
 SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7
-SHA512 (selinux-3.7.tar.gz) = f16c3731e27a09306147ffd5b929f55357642da663326edf5837885b36e8fe763ba6a1d18e8ae4001f6091545d06bb11f2d9ed78d69711c0211fbb406bc52345
-SHA512 (selinux-3.7.tar.gz.asc) = d433765388e40b80429eb74784bf107457ef0dd8bdbc2c35c2ad3e687da11d4526a513e344bc6404383cbc61d9ac8e6a8aa5ce8a535db06ce4e2f11aa5b38056
+SHA512 (selinux-3.9.tar.gz) = ccfe9c8907ef50e35cda1e8282a4e02e8d2e1749dabde856343f236724214c89d0bcd4e799f383961b990c5fb9a6b0191880a478a8930af447951c8b36689720
+SHA512 (selinux-3.9.tar.gz.asc) = 598498e3919c72e1b7e6db85250ac7b1ff26e33598fb94c29ee74569dddee407fca73961d9fbb245ecf5ff5a7ee0eaa83031f79b7f0b2d89661119d45bbf5954