Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

- Split multi-command fix_cmds into lists
- catchall: Discourage creating custom policy modules

Note: Swtiched from "Requires" to "Conflicts" with setroubleshoot-server
to remove the circular dependency.

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -119,3 +119,8 @@ setroubleshoot-plugins-2.1.55.tar.gz
 /setroubleshoot-plugins-3.3.7.tar.gz
 /setroubleshoot-plugins-3.3.8.tar.gz
 /setroubleshoot-plugins-3.3.9.tar.gz
+/setroubleshoot-plugins-3.3.10.tar.gz
+/setroubleshoot-plugins-3.3.11.tar.gz
+/setroubleshoot-plugins-3.3.12.tar.gz
+/setroubleshoot-plugins-3.3.14.tar.gz
+/setroubleshoot-plugins-3.3.15.tar.gz

0001-Split-multi-command-fix_cmds-into-lists.patch

@@ -0,0 +1,73 @@
+From df90bf242b35a9e01f721dd7ad436f1bd5d21616 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Mon, 9 Mar 2026 22:03:31 +0100
+Subject: [PATCH] Split multi-command fix_cmds into lists
+
+This requires
+https://gitlab.com/setroubleshoot/setroubleshoot/-/merge_requests/54/diffs?commit_id=d5d13afa86c2bd03952c04a187657ed981c9be7e
+to work properly!
+---
+ src/allow_execmod.py         | 3 ++-
+ src/automount_exec_config.py | 3 ++-
+ src/cvs_data.py              | 3 ++-
+ src/file.py                  | 2 +-
+ 4 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/src/allow_execmod.py b/src/allow_execmod.py
+index 6e1f6bf..0a3995f 100644
+--- a/src/allow_execmod.py
++++ b/src/allow_execmod.py
+@@ -81,7 +81,8 @@ If you want this to survive a relabel, execute
+ # semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';restorecon -v '$FIX_TARGET_PATH'
+ """
+ 
+-    fix_cmd = """/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""
++    fix_cmd = ["""/usr/sbin/semanage fcontext -a -t textrel_shlib_t '$FIX_TARGET_PATH'""",
++               """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""]
+ 
+     def init_args(self, args):
+         if len(args) > 0:
+diff --git a/src/automount_exec_config.py b/src/automount_exec_config.py
+index a64eaf2..81ada8e 100644
+--- a/src/automount_exec_config.py
++++ b/src/automount_exec_config.py
+@@ -40,7 +40,8 @@ class plugin(Plugin):
+     If you want to change the file context of $TARGET_PATH so that the automounter can execute it you can execute "chcon -t bin_t $TARGET_PATH".  If you want this to survive a relabel, you need to permanently change the file context: execute  "semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'".
+     ''')
+ 
+-    fix_cmd = """/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""
++    fix_cmd = ["""/usr/sbin/semanage fcontext -a -t bin_t '$FIX_TARGET_PATH'""",
++               """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""]
+ 
+     if_text = 'If you want to allow automounter to execute $TARGET_PATH'
+ 
+diff --git a/src/cvs_data.py b/src/cvs_data.py
+index 7451622..1e75ead 100644
+--- a/src/cvs_data.py
++++ b/src/cvs_data.py
+@@ -46,7 +46,8 @@ class plugin(Plugin):
+     do_text = """# semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'
+ # restorecon -v '$FIX_TARGET_PATH'"""
+ 
+-    fix_cmd = """/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH';/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""
++    fix_cmd = ["""/usr/sbin/semanage fcontext -a -t cvs_data_t '$FIX_TARGET_PATH'""",
++               """/usr/sbin/restorecon -v '$FIX_TARGET_PATH'"""]
+ 
+     def __init__(self):
+         Plugin.__init__(self, __name__)
+diff --git a/src/file.py b/src/file.py
+index ac24bf9..25f3a43 100644
+--- a/src/file.py
++++ b/src/file.py
+@@ -66,7 +66,7 @@ home directory from a previous installation that did not use SELinux, 'restoreco
+         if args == (1,0):
+             return '/sbin/restorecon -R -v $TARGET_PATH'
+         else:
+-            return 'touch /.autorelabel; reboot'
++            return ['touch /.autorelabel', 'reboot']
+ 
+     def init_args(self, args):
+         if args == (1,0):
+-- 
+2.53.0
+

0002-catchall-Discourage-creating-custom-policy-modules.patch

@@ -0,0 +1,36 @@
+From 8ad7f4c5528fbbc52a3d391c702102c6fe262d83 Mon Sep 17 00:00:00 2001
+From: Vit Mojzis <vmojzis@redhat.com>
+Date: Tue, 9 Jun 2026 17:27:36 +0200
+Subject: [PATCH] catchall: Discourage creating custom policy modules
+
+Update the plugin text to discourage creating custom policy modules by
+explaining the lack of support and potential security implications.
+---
+ src/catchall.py | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/src/catchall.py b/src/catchall.py
+index 052d6d8..7e4a8fa 100644
+--- a/src/catchall.py
++++ b/src/catchall.py
+@@ -54,9 +54,14 @@ class plugin(Plugin):
+             return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on $TARGET_CLASS labeled $TARGET_TYPE by default.')
+         return _('If you believe that $SOURCE_BASE_PATH should be allowed $ACCESS access on the $TARGET_BASE_PATH $TARGET_CLASS by default.')
+ 
+-    then_text = _('You should report this as a bug.\nYou can generate a local policy module to allow this access.')
+-    do_text = _("""Allow this access for now by executing:
+-# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME
++    then_text = _('''
++    You should report this as a bug.\n
++    If you are certain this access is legitimate and not an intrusion attempt, you
++    can generate a local policy module to allow it.
++    Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities.
++    ''')
++
++    do_text = _("""# ausearch -c '$SOURCE' --raw | audit2allow -M my-$MODULE_NAME
+ # semodule -X 300 -i my-$MODULE_NAME.pp""")
+ 
+     def __init__(self):
+-- 
+2.53.0
+

plans/tests.fmf

@@ -0,0 +1,8 @@
+summary: basic setroubleshoot-plugins test plan
+discover:
+    how: fmf
+    url: https://gitlab.com/setroubleshoot/tests.git
+    filter: "component:setroubleshoot-plugins & tier: 1"
+execute:
+    how: tmt
+

setroubleshoot-plugins.spec

@@ -1,23 +1,29 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
+# Disable automatic compilation of Python files in extra directories
+%global _python_bytecompile_extra 0
+
 Summary: Analysis plugins for use with setroubleshoot
 Name: setroubleshoot-plugins
-Version: 3.3.9
-Release: 4%{?dist}
-License: GPLv2+
-Group: Applications/System
-URL: https://github.com/fedora-selinux/setroubleshoot
-Source0: https://releases.pagure.org/setroubleshoot/%{name}-%{version}.tar.gz
-Patch1: 0001-plugins-Update-translations.patch
-Patch2: 0002-plugins-Update-translations.patch
+Version: 3.3.15
+Release: 8%{?dist}
+License: GPL-2.0-or-later
+URL: https://gitlab.com/setroubleshoot/plugins
+Source0: https://gitlab.com/-/project/24478430/uploads/1d856bff1c9fb16a8c6fc877d7fe91ca/setroubleshoot-plugins-3.3.15.tar.gz
+# git format-patch -N setroubleshoot-plugins-<version>
+# for j in 00*patch; do printf "Patch: %s\n" $j; done
+Patch: 0001-Split-multi-command-fix_cmds-into-lists.patch
+Patch: 0002-catchall-Discourage-creating-custom-policy-modules.patch
 BuildArch: noarch
 
 # gcc is needed only for ./configure
 # Remove it when the build process is fixed
 BuildRequires: gcc
+BuildRequires: make
 BuildRequires: perl-XML-Parser
 BuildRequires: intltool gettext python3-devel
-Requires: setroubleshoot-server >= 3.3.13
+# Support for multiple commands in fix_cmd
+Conflicts: setroubleshoot-server < 3.3.37
 
 %description
 This package provides a set of analysis plugins for use with
@@ -26,7 +32,7 @@ data and system data to provide user friendly reports describing how
 to interpret SELinux AVC denials.
 
 %prep
-%autosetup -p 2
+%autosetup -p 1
 
 %build
 %configure PYTHON=%{__python3}
@@ -34,18 +40,120 @@ make PYTHON=%{__python3}
 
 %install 
 rm -rf %{buildroot}
-make DESTDIR=%{buildroot} PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir} install
+%make_install PYTHON=%{__python3} pkgdocdir=%{_pkgdocdir}
 %find_lang %{name}
-
-%clean 
-rm -rf %{buildroot}
+# Manually invoke the python byte compile macro for each path that needs byte
+# compilation.
+%py_byte_compile %{__python3} %{buildroot}%{_datadir}/setroubleshoot/plugins
 
 %files -f %{name}.lang 
-%defattr(-,root,root,-)
 %doc %{_pkgdocdir}
 %{_datadir}/setroubleshoot/plugins
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.15-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Thu May 07 2026 Vit Mojzis <vmojzis@redhat.com> - 3.3.15-7
+- Split multi-command fix_cmds into lists
+- catchall: Discourage creating custom policy modules
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.15-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 3.3.15-5
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 3.3.15-4
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.15-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.15-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jan 06 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.3.15-1
+- restorecon.py: exclude more paths
+- Improve disable_ipv6 plugin then_text
+- Update generated configuration files
+- Update translations
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Jul 26 2023 Petr Lautrbach <lautrbach@redhat.com> - 3.3.14-8
+- Update generated configuration files (rhbz#2226425)
+- Improve disable_ipv6 plugin then_text
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Fri Sep  3 2021 Petr Lautrbach <plautrba@redhat.com> - 3.3.14-3
+- restorecon.py: exclude more paths (#1960136)
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.14-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon Mar 29 2021 Vit Mojzis <vmojzis@redhat.com> - 3.3.14-1
+- Update translations
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.12-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.12-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Tue Jul 14 2020 Tom Stellard <tstellar@redhat.com> - 3.3.12-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Tue Apr 21 2020 Vit Mojzis <vmojzis@redhat.com> - 3.3.12-1
+- Use get_package_nvr* functions instead of get_rpm_nvr*
+- Update deprecated type references
+- Update translations
+
+* Thu Jan 30 2020 Vit Mojzis <vmojzis@redhat.com> - 3.3.11-1
+- Add plugin which analyzes execmem denials
+- Add missing "If " strings
+- Update qemu_blk_image and qemu_file_image
+- Update "xen_image" plugin
+- Update "file" plugin
+- Update "missing" scripts to automake-1.15
+
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.10-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.10-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sat Dec  8 2018 Petr Lautrbach <plautrba@redhat.com> - 3.3.10-1
+- Handle no "allowed_target_types" properly
+- bind_ports: Do not use when there are no allowed_target_types
+- Fix summary and "if" text for AVCs with unknown target path
+- plugins: Update translations
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.9-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Tue Jun 19 2018 Miro Hrončok <mhroncok@redhat.com> - 3.3.9-5
+- Rebuilt for Python 3.7
+
 * Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.9-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
 

sources

@@ -1 +1 @@
-SHA512 (setroubleshoot-plugins-3.3.9.tar.gz) = 8f5084f49ebb70268e14de7bed1c6706f847f3c3f0b9044ddfdd22b8fd189b2881c80bd20530167342b3bcb0963976520505351471d425228457131bf9707912
+SHA512 (setroubleshoot-plugins-3.3.15.tar.gz) = 9741ecd48a7e0cde376ac0f818d94dad32c74acd2afc01ec6f5e3cf74ff9075d4f3406f1a3905cbbdd3833c8c2ef4213deaaf00d0012dbea582eb2b825618d5f