Compare commits
No commits in common. "rawhide" and "f43" have entirely different histories.
7 changed files with 14 additions and 301 deletions
|
|
@ -1,65 +0,0 @@
|
|||
From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Lautrbach <lautrbach@redhat.com>
|
||||
Date: Mon, 5 May 2025 18:28:40 +0200
|
||||
Subject: [PATCH] sepolicy: Fix detection of writeable locations
|
||||
|
||||
- update substitutions from /etc/dnf/var
|
||||
|
||||
It seems that by default dnf api does not read /etc/dnf/var/* files to
|
||||
update substitutions and so it can't resolve correct mirror list when a
|
||||
variable is part of the link.
|
||||
|
||||
- alway run query.run()
|
||||
|
||||
Fixes:
|
||||
Traceback (most recent call last):
|
||||
File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load
|
||||
ret = self._repo.load()
|
||||
^^^^^^^^^^^^^^^^^
|
||||
File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load
|
||||
return _repo.Repo_load(self)
|
||||
^^^^^^^^^^^^^^^^^^^^^
|
||||
libdnf._error.Error: Failed to download metadata for repo 'baseos':
|
||||
Cannot prepare internal mirrorlist: Status code: 404 for
|
||||
https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198)
|
||||
|
||||
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
|
||||
---
|
||||
python/sepolicy/sepolicy/generate.py | 8 ++++----
|
||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
||||
index f726ad51..a0314a70 100644
|
||||
--- a/python/sepolicy/sepolicy/generate.py
|
||||
+++ b/python/sepolicy/sepolicy/generate.py
|
||||
@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||
import dnf
|
||||
|
||||
with dnf.Base() as base:
|
||||
+ base.conf.substitutions.update_from_etc('/')
|
||||
base.read_all_repos()
|
||||
base.fill_sack(load_system_repo=True)
|
||||
|
||||
query = base.sack.query()
|
||||
|
||||
- pq = query.available()
|
||||
- pq = pq.filter(file=self.program)
|
||||
+ pq = query.filter(file=self.program)
|
||||
|
||||
- for pkg in pq:
|
||||
+ for pkg in pq.run():
|
||||
self.rpms.append(pkg.name)
|
||||
for fname in pkg.files:
|
||||
for b in self.DEFAULT_DIRS:
|
||||
@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s;
|
||||
self.add_dir(fname)
|
||||
sq = query.available()
|
||||
sq = sq.filter(provides=pkg.source_name)
|
||||
- for bpkg in sq:
|
||||
+ for bpkg in sq.run():
|
||||
for fname in bpkg.files:
|
||||
for b in self.DEFAULT_DIRS:
|
||||
if b == "/etc":
|
||||
--
|
||||
2.49.0
|
||||
|
||||
|
|
@ -1,91 +0,0 @@
|
|||
From ae251cfb85090126d5c1de62b94775fae3b43527 Mon Sep 17 00:00:00 2001
|
||||
From: "Richard W.M. Jones" <rjones@redhat.com>
|
||||
Date: Wed, 10 Sep 2025 11:42:09 +0100
|
||||
Subject: [PATCH] setfiles: Add -A option to disable
|
||||
SELINUX_RESTORECON_ADD_ASSOC
|
||||
|
||||
SELINUX_RESTORECON_ADD_ASSOC tracks conflicts between inodes with
|
||||
multiple hard links or bind mounts that have differing contexts.
|
||||
However doing this involves building a large internal hashtable that
|
||||
stores the full path of every file examined by setfiles. For
|
||||
filesystems that have very large numbers of files or long pathnames,
|
||||
this uses a lot of memory, which makes SELinux relabelling in
|
||||
constrained memory environments infeasible.
|
||||
|
||||
This adds a new setfiles -A option that disables this tracking.
|
||||
|
||||
For example, using setfiles to relabel a filesystem with 15 million
|
||||
files took 3.7GB of RAM. Using this option, the same filesystem can
|
||||
be relabelled in 121MB (albeit with no warnings or errors possible for
|
||||
conflicting labels, but for our use case we don't care about that.)
|
||||
|
||||
Fixes: https://issues.redhat.com/browse/RHEL-111505
|
||||
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
|
||||
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
|
||||
---
|
||||
policycoreutils/setfiles/setfiles.8 | 5 +++++
|
||||
policycoreutils/setfiles/setfiles.c | 11 +++++++----
|
||||
2 files changed, 12 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
|
||||
index 187f4513..458f3f9f 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.8
|
||||
+++ b/policycoreutils/setfiles/setfiles.8
|
||||
@@ -23,6 +23,7 @@ setfiles \- set SELinux file security contexts.
|
||||
.RB [ \-I | \-D ]
|
||||
.RB [ \-T
|
||||
.IR nthreads ]
|
||||
+.RB [ \-A ]
|
||||
.I spec_file
|
||||
.IR pathname \ ...
|
||||
|
||||
@@ -187,6 +188,10 @@ use up to
|
||||
threads. Specify 0 to create as many threads as there are available
|
||||
CPU cores; 1 to use only a single thread (default); or any positive
|
||||
number to use the given number of threads (if possible).
|
||||
+.TP
|
||||
+.B \-A
|
||||
+do not track inodes with multiple hard links or bind mounts that would
|
||||
+match different contexts (saves memory)
|
||||
|
||||
.SH "ARGUMENTS"
|
||||
.TP
|
||||
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
|
||||
index ad09f840..31034316 100644
|
||||
--- a/policycoreutils/setfiles/setfiles.c
|
||||
+++ b/policycoreutils/setfiles/setfiles.c
|
||||
@@ -40,9 +40,9 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
|
||||
name, name);
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
|
||||
- "usage: %s [-diIDlmnpqvCEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
|
||||
- "usage: %s -s [-diIDlmnpqvFUWT] spec_file\n",
|
||||
+ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file pathname...\n"
|
||||
+ "usage: %s [-diIDlmnpqvACEFUWT] [-e excludedir] [-r alt_root_path] [-c policyfile] spec_file -f filename\n"
|
||||
+ "usage: %s -s [-diIDlmnpqvAFUWT] spec_file\n",
|
||||
name, name, name);
|
||||
}
|
||||
exit(-1);
|
||||
@@ -147,7 +147,7 @@ int main(int argc, char **argv)
|
||||
const char *base;
|
||||
int errors = 0;
|
||||
const char *ropts = "e:f:hiIDlmno:pqrsvFURW0xT:";
|
||||
- const char *sopts = "c:de:f:hiIDlmno:pqr:svCEFUR:W0T:";
|
||||
+ const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:";
|
||||
const char *opts;
|
||||
union selinux_callback cb;
|
||||
long unsigned skipped_errors;
|
||||
@@ -375,6 +375,9 @@ int main(int argc, char **argv)
|
||||
if (*optarg == '\0' || *endptr != '\0')
|
||||
usage(argv[0]);
|
||||
break;
|
||||
+ case 'A':
|
||||
+ r_opts.add_assoc = 0;
|
||||
+ break;
|
||||
case 'h':
|
||||
case '?':
|
||||
usage(argv[0]);
|
||||
--
|
||||
2.49.0
|
||||
|
||||
|
|
@ -1,98 +0,0 @@
|
|||
From c1bd6ee62f2cedfb3709710fc46f2899b301c139 Mon Sep 17 00:00:00 2001
|
||||
From: Vit Mojzis <vmojzis@redhat.com>
|
||||
Date: Mon, 1 Sep 2025 18:17:10 +0200
|
||||
Subject: [PATCH] semanage: Reset active value when deleting boolean
|
||||
customizations
|
||||
|
||||
Currently, removal of boolean local customizations leaves their current
|
||||
(active) value untouched.
|
||||
|
||||
After the removal is complete, semanage_bool_query will return the
|
||||
default value. But it needs to be called in a separate transaction.
|
||||
This makes the fix a bit awkward, but I have not found a way to query
|
||||
the default value before the first transation is committed.
|
||||
|
||||
Fixes:
|
||||
# getsebool smbd_anon_write
|
||||
smbd_anon_write --> off
|
||||
# semanage boolean -m1 smbd_anon_write
|
||||
# semanage boolean -D
|
||||
# getsebool smbd_anon_write
|
||||
smbd_anon_write --> on
|
||||
# manage boolean -l isemanage boolean --list | grep smbd_anon_write
|
||||
smbd_anon_write (on , off) Allow smbd to anon write
|
||||
|
||||
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
|
||||
---
|
||||
python/semanage/seobject.py | 43 +++++++++++++++++++++++++++++++++++++
|
||||
1 file changed, 43 insertions(+)
|
||||
|
||||
diff --git a/python/semanage/seobject.py b/python/semanage/seobject.py
|
||||
index 10963e81..6d6188fd 100644
|
||||
--- a/python/semanage/seobject.py
|
||||
+++ b/python/semanage/seobject.py
|
||||
@@ -2886,7 +2886,15 @@ class booleanRecords(semanageRecords):
|
||||
self.__delete(name)
|
||||
self.commit()
|
||||
|
||||
+ # New transaction to reset the boolean to its default value.
|
||||
+ # Calling __reset_value in the same transaction as the removal of
|
||||
+ # local customizations does nothing
|
||||
+ self.begin()
|
||||
+ self.__reset_value(name)
|
||||
+ self.commit()
|
||||
+
|
||||
def deleteall(self):
|
||||
+ deleted = []
|
||||
(rc, self.blist) = semanage_bool_list_local(self.sh)
|
||||
if rc < 0:
|
||||
raise ValueError(_("Could not list booleans"))
|
||||
@@ -2895,10 +2903,45 @@ class booleanRecords(semanageRecords):
|
||||
|
||||
for boolean in self.blist:
|
||||
name = semanage_bool_get_name(boolean)
|
||||
+ deleted.append(name)
|
||||
self.__delete(name)
|
||||
|
||||
self.commit()
|
||||
|
||||
+ # New transaction to reset all affected booleans to their default values.
|
||||
+ # Calling __reset_value in the same transaction as the removal of
|
||||
+ # local customizations does nothing
|
||||
+ self.begin()
|
||||
+
|
||||
+ for boolean in deleted:
|
||||
+ self.__reset_value(boolean)
|
||||
+
|
||||
+ self.commit()
|
||||
+
|
||||
+ # Set active value to default
|
||||
+ # Note: this needs to be called in a new transaction after removing local customizations
|
||||
+ # in order for semanage_bool_query to fetch the default value
|
||||
+ # (as opposed to the current one -- set by the local customizations)
|
||||
+ def __reset_value(self, name):
|
||||
+ name = selinux.selinux_boolean_sub(name)
|
||||
+
|
||||
+ (rc, k) = semanage_bool_key_create(self.sh, name)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not create a key for %s") % name)
|
||||
+
|
||||
+ (rc, b) = semanage_bool_query(self.sh, k)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not query boolean %s") % name)
|
||||
+
|
||||
+ semanage_bool_set_value(b, semanage_bool_get_value(b))
|
||||
+
|
||||
+ rc = semanage_bool_set_active(self.sh, k, b)
|
||||
+ if rc < 0:
|
||||
+ raise ValueError(_("Could not set active value of boolean %s") % name)
|
||||
+
|
||||
+ semanage_bool_key_free(k)
|
||||
+ semanage_bool_free(b)
|
||||
+
|
||||
def get_all(self, locallist=0):
|
||||
ddict = {}
|
||||
if locallist:
|
||||
--
|
||||
2.49.0
|
||||
|
||||
14
changelog
14
changelog
|
|
@ -1,17 +1,3 @@
|
|||
* Thu Dec 11 2025 Vit Mojzis <vmojzis@redhat.com> - 3.9-7
|
||||
- semanage: Reset active value when deleting boolean customizations (RHEL-111421)
|
||||
- setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)
|
||||
- sepolicy: Fix detection of writeable locations
|
||||
|
||||
* Thu Dec 11 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.9-6
|
||||
- Bring back patches unintentionally dropped before
|
||||
|
||||
* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 3.9-5
|
||||
- Rebuilt for Python 3.14.0rc3 bytecode
|
||||
|
||||
* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 3.9-4
|
||||
- Rebuilt for Python 3.14.0rc2 bytecode
|
||||
|
||||
* Tue Jul 29 2025 Miro Hrončok <miro@hroncok.cz> - 3.9-3
|
||||
- Drop unused BuildRequires on python3-wheel
|
||||
|
||||
|
|
|
|||
8
macros
8
macros
|
|
@ -1,8 +0,0 @@
|
|||
%add_changelog(changelog:) %{lua:
|
||||
local f = io.open(arg[1], 'r')
|
||||
if f then
|
||||
local content = f:read('*all')
|
||||
f:close()
|
||||
print(content)
|
||||
end
|
||||
}
|
||||
|
|
@ -11,14 +11,12 @@
|
|||
Summary: SELinux policy core utilities
|
||||
Name: policycoreutils
|
||||
Version: 3.9
|
||||
Release: 7%{?dist}
|
||||
Release: 5%{?dist}
|
||||
License: GPL-2.0-or-later
|
||||
# https://github.com/SELinuxProject/selinux/wiki/Releases
|
||||
Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz
|
||||
Source1: https://github.com/SELinuxProject/selinux/releases/download/%{version}/selinux-%{version}.tar.gz.asc
|
||||
Source2: https://github.com/bachradsusi.gpg
|
||||
Source3: changelog
|
||||
Source4: macros
|
||||
URL: https://github.com/SELinuxProject/selinux
|
||||
Source13: system-config-selinux.png
|
||||
Source14: sepolicy-icons.tgz
|
||||
|
|
@ -40,19 +38,8 @@ Source23: selinux-sandbox.zip
|
|||
# $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
|
||||
# $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
|
||||
# Patch list start
|
||||
Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
|
||||
Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch
|
||||
Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
|
||||
Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch
|
||||
Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch
|
||||
Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch
|
||||
Patch0007: 0007-setfiles-Add-A-option-to-disable-SELINUX_RESTORECON_.patch
|
||||
Patch0008: 0008-semanage-Reset-active-value-when-deleting-boolean-cu.patch
|
||||
# Patch list end
|
||||
|
||||
# gen_changelog
|
||||
%{load:%{SOURCE4}}
|
||||
|
||||
Obsoletes: policycoreutils < 2.0.61-2
|
||||
Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138
|
||||
# initscripts < 9.66 shipped fedora-autorelabel services which are renamed to selinux-relabel
|
||||
|
|
@ -182,9 +169,6 @@ install -m 755 -p %{SOURCE15} %{buildroot}/%{_libexecdir}/selinux/
|
|||
%find_lang selinux-gui
|
||||
%find_lang selinux-sandbox
|
||||
|
||||
# Install changelog to %{_docdir}/%{name}
|
||||
install -m 644 -p %{SOURCE3} %{buildroot}/%{_docdir}/%{name}
|
||||
|
||||
%package python-utils
|
||||
Summary: SELinux policy core python utilities
|
||||
Requires: python3-policycoreutils = %{version}-%{release}
|
||||
|
|
@ -337,7 +321,7 @@ or level of a logged in user.
|
|||
|
||||
%files newrole
|
||||
%attr(0755,root,root) %caps(cap_dac_read_search,cap_setpcap,cap_audit_write,cap_sys_admin,cap_fowner,cap_chown,cap_dac_override=pe) %{_bindir}/newrole
|
||||
%{_mandir}/man1/newrole.1*
|
||||
%{_mandir}/man1/newrole.1.gz
|
||||
%config(noreplace) %{_sysconfdir}/pam.d/newrole
|
||||
|
||||
%package gui
|
||||
|
|
@ -402,8 +386,8 @@ system-config-selinux is a utility for managing the SELinux environment
|
|||
%{_unitdir}/selinux-autorelabel.target
|
||||
%{generatorsdir}/selinux-autorelabel-generator.sh
|
||||
%config(noreplace) %{_sysconfdir}/sestatus.conf
|
||||
%{_mandir}/man5/selinux_config.5*
|
||||
%{_mandir}/man5/sestatus.conf.5*
|
||||
%{_mandir}/man5/selinux_config.5.gz
|
||||
%{_mandir}/man5/sestatus.conf.5.gz
|
||||
%{_mandir}/man8/fixfiles.8*
|
||||
%{_mandir}/man8/load_policy.8*
|
||||
%{_mandir}/man8/restorecon.8*
|
||||
|
|
@ -423,7 +407,7 @@ system-config-selinux is a utility for managing the SELinux environment
|
|||
%{_datadir}/bash-completion/completions/setsebool
|
||||
%{!?_licensedir:%global license %%doc}
|
||||
%license policycoreutils/LICENSE
|
||||
%doc %{_docdir}/%{name}
|
||||
%doc %{_usr}/share/doc/%{name}
|
||||
|
||||
%package restorecond
|
||||
Summary: SELinux restorecond utilities
|
||||
|
|
@ -461,4 +445,10 @@ The policycoreutils-restorecond package contains the restorecond service.
|
|||
%systemd_postun_with_restart restorecond.service
|
||||
|
||||
%changelog
|
||||
%add_changelog %SOURCE3
|
||||
* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 3.9-5
|
||||
- Rebuilt for Python 3.14.0rc3 bytecode
|
||||
|
||||
* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 3.9-4
|
||||
- Rebuilt for Python 3.14.0rc2 bytecode
|
||||
|
||||
%autochangelog
|
||||
|
|
|
|||
|
|
@ -30,9 +30,8 @@ efi_set_boot_next() {
|
|||
}
|
||||
|
||||
relabel_selinux() {
|
||||
# Switch SELinux to permissive mode, fix labeling issues (or execute shell
|
||||
# and have the user fix them) and reboot the machine so that the correct
|
||||
# labels are applied to all services.
|
||||
# if /sbin/init is not labeled correctly this process is running in the
|
||||
# wrong context, so a reboot will be required after relabel
|
||||
AUTORELABEL=
|
||||
. /etc/selinux/config
|
||||
echo "0" > /sys/fs/selinux/enforce
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue