From 2b199658c58017293231cfcbe70d0df7991049a5 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Mon, 27 May 2024 09:06:57 +0200 Subject: [PATCH 1/5] Update to 2.63 Small build change related to snap-seccomp, so that the progarm continues to build on rawhide (-D_GNU_SOURCE) and another change related to a stale removal of -Bstatic. Signed-off-by: Zygmunt Krynicki --- .gitignore | 3 +++ snapd.spec | 63 +++++++++++++++++++++++++++++++++++++++++++++++------- sources | 5 +++-- 3 files changed, 61 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 24dca27..045c011 100644 --- a/.gitignore +++ b/.gitignore @@ -104,3 +104,6 @@ /snapd_2.61.2.only-vendor.tar.xz /snapd_2.62.no-vendor.tar.xz /snapd_2.62.only-vendor.tar.xz +/snapd_2.63.no-vendor.tar.xz +/snapd_2.63.only-vendor.tar.xz +/snapd_2.63.vendor.tar.xz diff --git a/snapd.spec b/snapd.spec index 81658ad..274ae7b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -83,7 +83,7 @@ %{!?_tmpfilesdir: %global _tmpfilesdir %{_prefix}/lib/tmpfiles.d} Name: snapd -Version: 2.62 +Version: 2.63 Release: 0%{?dist} Summary: A transactional software package manager License: GPLv3 @@ -132,7 +132,7 @@ Provides: %{name}-login-service%{?_isa} = 1.33 %endif %if ! 0%{?with_bundled} -BuildRequires: golang(github.com/boltdb/bolt) +BuildRequires: golang(go.etcd.io/bbolt) BuildRequires: golang(github.com/coreos/go-systemd/activation) BuildRequires: golang(github.com/godbus/dbus) BuildRequires: golang(github.com/godbus/dbus/introspect) @@ -225,7 +225,7 @@ BuildArch: noarch %endif %if ! 0%{?with_bundled} -Requires: golang(github.com/boltdb/bolt) +Requires: golang(go.etcd.io/bbolt) Requires: golang(github.com/coreos/go-systemd/activation) Requires: golang(github.com/godbus/dbus) Requires: golang(github.com/godbus/dbus/introspect) @@ -254,7 +254,7 @@ Requires: golang(gopkg.in/yaml.v3) # These Provides are unversioned because the sources in # the bundled tarball are unversioned (they go by git commit) # *sigh*... I hate golang... -Provides: bundled(golang(github.com/snapcore/bolt)) +Provides: bundled(golang(go.etcd.io/bbolt)) Provides: bundled(golang(github.com/coreos/go-systemd/activation)) Provides: bundled(golang(github.com/godbus/dbus)) Provides: bundled(golang(github.com/godbus/dbus/introspect)) @@ -534,10 +534,8 @@ BUILDTAGS="${BUILDTAGS} nomanagers" %gobuild_static -o bin/snapctl $GOFLAGS %{import_path}/cmd/snapctl ) -%if 0%{?rhel} -# There's no static link library for libseccomp in RHEL/CentOS... -sed -e "s/-Bstatic -lseccomp/-Bstatic/g" -i cmd/snap-seccomp/*.go -%endif +# We need -D_GNU_SOURCE to include xfs/linux.h for fallocate. +sed -e 's,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64,//#cgo CFLAGS: -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE,' -i cmd/snap-seccomp/main.go %gobuild -o bin/snap-seccomp $GOFLAGS %{import_path}/cmd/snap-seccomp ( @@ -809,6 +807,7 @@ popd %dir %{_sharedstatedir}/snapd %dir %{_sharedstatedir}/snapd/assertions %dir %{_sharedstatedir}/snapd/cookie +%dir %{_sharedstatedir}/snapd/cgroup %dir %{_sharedstatedir}/snapd/dbus-1 %dir %{_sharedstatedir}/snapd/dbus-1/services %dir %{_sharedstatedir}/snapd/dbus-1/system-services @@ -945,6 +944,54 @@ fi %changelog +* Wed Apr 24 2024 Ernest Lotter +- New upstream release 2.63 + - Support for snap services to show the current status of user + services (experimental) + - Refresh app awareness: record snap-run-inhibit notice when + starting app from snap that is busy with refresh (experimental) + - Refresh app awareness: use warnings as fallback for desktop + notifications (experimental) + - Aspect based configuration: make request fields in the aspect- + bundle's rules optional (experimental) + - Aspect based configuration: make map keys conform to the same + format as path sub-keys (experimental) + - Aspect based configuration: make unset and set behaviour similar + to configuration options (experimental) + - Aspect based configuration: limit nesting level for setting value + (experimental) + - Components: use symlinks to point active snap component revisions + - Components: add model assertion support for components + - Components: fix to ensure local component installation always gets + a new revision number + - Add basic support for a CIFS remote filesystem-based home + directory + - Add support for AppArmor profile kill mode to avoid snap-confine + error + - Allow more than one interface to grant access to the same API + endpoint or notice type + - Allow all snapd service's control group processes to send systemd + notifications to prevent warnings flooding the log + - Enable not preseeded single boot install + - Update secboot to handle new sbatlevel + - Fix to not use cgroup for non-strict confined snaps (devmode, + classic) + - Fix two race conditions relating to freedesktop notifications + - Fix missing tunables in snap-update-ns AppArmor template + - Fix rejection of snapd snap udev command line by older host snap- + device-helper + - Rework seccomp allow/deny list + - Clean up files removed by gadgets + - Remove non-viable boot chains to avoid secboot failure + - posix_mq interface: add support for missing time64 mqueue syscalls + mq_timedreceive_time64 and mq_timedsend_time64 + - password-manager-service interface: allow kwalletd version 6 + - kubernetes-support interface: allow SOCK_SEQPACKET sockets + - system-observe interface: allow listing systemd units and their + properties + - opengl interface: enable use of nvidia container toolkit CDI + config generation + * Thu Mar 21 2024 Ernest Lotter - New upstream release 2.62 - Aspects based configuration schema support (experimental) diff --git a/sources b/sources index 869f45e..3bb8564 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (snapd_2.62.no-vendor.tar.xz) = 3fb9fa65e25e7deec7e92def9b60f756cfce35c00b90e5cc370bd641034414313f07c973fcbdef4c58e7a9abc20197316fd51a4a2bf5087088a0593b59104590 -SHA512 (snapd_2.62.only-vendor.tar.xz) = d07a3ba83cad8d25fc03ecb7efc69e8e3f105e41c076bc5b450acf4e98409f11f738b65f542965fac5ccaa56eb9f7b1b36aa06f8b68cd3549b9d2a01b10faa09 +SHA512 (snapd_2.63.no-vendor.tar.xz) = 5973b7922f2caf1d4b0bc0db4fe5564134b04d6ca3b52204e9963b584bd80a91789c46902840169f9a8b1b1184820c86902401f585915ca06a010d81a2d9a453 +SHA512 (snapd_2.63.only-vendor.tar.xz) = 3ff9b8610c01997935b720e883644597f7d397a9a7b7e23eadbe95a67f62564e9d4d836c5667e39f95ed073115b106d58e5f4107f229c72014433414168baaa7 +SHA512 (snapd_2.63.vendor.tar.xz) = 956ee142ab6cb5de522307f7844819c861b2831e22dab56f7bfca16ff7f947093f8a8727d49370cc000ed71f3af9c57cff9c4be93ebf199e8c631a152a68ec5b From 1d9d4c5f6642d4d96473aadf11e22db9dc242851 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Tue, 3 Dec 2024 12:16:56 +0100 Subject: [PATCH 2/5] Depend on xdelta only on EPEL-9 --- snapd.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index b314752..2ca098b 100644 --- a/snapd.spec +++ b/snapd.spec @@ -113,7 +113,8 @@ Requires: ((squashfuse and fuse) or kmod(squashfs.ko)) %endif # Require xdelta for delta updates of snap packages. -%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} > 8 ) +# XXX: xdelta is only in EPEL 9. +%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} == 9) Requires: xdelta %endif From 0495d041f9c004fe01c55e3939eee772c9ab6afe Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Tue, 3 Dec 2024 12:20:29 +0100 Subject: [PATCH 3/5] Bump release, add changelog Signed-off-by: Zygmunt Krynicki --- snapd.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/snapd.spec b/snapd.spec index 2ca098b..60f6684 100644 --- a/snapd.spec +++ b/snapd.spec @@ -84,7 +84,7 @@ Name: snapd Version: 2.66.1 -Release: 0%{?dist} +Release: 1%{?dist} Summary: A transactional software package manager License: GPL-3.0-only URL: https://%{provider_prefix} @@ -936,6 +936,9 @@ if [ $1 -eq 0 ]; then fi %changelog +* Tue Dec 3 2024 Zygmunt Krynicki +- Constrain dependency on xdelta to EPEL-9 + * Wed Nov 20 2024 Zygmunt Krynicki - Drop only patch, applied upstream. From 413593ae272a65680095652cc53bc0b980cefc6d Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Fri, 29 Nov 2024 19:53:36 +0100 Subject: [PATCH 4/5] Re-cherry pick fix for SELinux timedatex problem Signed-off-by: Zygmunt Krynicki --- 0001-data-selinux-remove-timedatex.patch | 46 ++++++++++++++++++++++++ snapd.spec | 5 +++ 2 files changed, 51 insertions(+) create mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch new file mode 100644 index 0000000..a82c392 --- /dev/null +++ b/0001-data-selinux-remove-timedatex.patch @@ -0,0 +1,46 @@ +From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 +From: Maciej Borzecki +Date: Thu, 24 Oct 2024 16:03:03 +0200 +Subject: [PATCH] data/selinux: remove timedatex + +The upstream selinux-policy has dropped timedatex in +https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 +Even when referencing type that no longer exists, our SELinux module +builds fine, but then cannot be loaded at runtime: + +maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 +Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 +Failed to resolve AST +semodule: Failed! + +And the offending line is: + +maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 +(typeattributeset cil_gen_require timedatex_t) + +Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 + +Signed-off-by: Maciej Borzecki +--- + data/selinux/snappy.te | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te +index 0862985aab..7dd9711fcc 100644 +--- a/data/selinux/snappy.te ++++ b/data/selinux/snappy.te +@@ -345,11 +345,6 @@ optional_policy(` + allow snappy_t systemd_timedated_t:dbus send_msg; + allow systemd_timedated_t snappy_t:dbus send_msg; + ') +-# or on some systems same dbus API may be provided by timedatex +-# RHEL7: there is no timedatex.if +-ifndef(`distro_rhel7',` +- timedatex_dbus_chat(snappy_t) +-') + + # kernel-module-load interface may inspect or write files under /etc/modprobe.d + optional_policy(` +-- +2.47.0 + diff --git a/snapd.spec b/snapd.spec index 60f6684..5df2513 100644 --- a/snapd.spec +++ b/snapd.spec @@ -90,6 +90,7 @@ License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz +Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -939,6 +940,10 @@ fi * Tue Dec 3 2024 Zygmunt Krynicki - Constrain dependency on xdelta to EPEL-9 +* Fri Nov 29 2024 Zygmunt Krynicki +- Re-cherry pick fix for SELinux timedatex problem from upstream + as it was not released in 2.66.1, sorry. + * Wed Nov 20 2024 Zygmunt Krynicki - Drop only patch, applied upstream. From 07a931bf199fa13a3248e9a21b91528671347252 Mon Sep 17 00:00:00 2001 From: Zygmunt Krynicki Date: Wed, 22 Jan 2025 13:56:24 +0100 Subject: [PATCH 5/5] Fix bad merge Signed-off-by: Zygmunt Krynicki --- 0001-data-selinux-remove-timedatex.patch | 46 ------------------------ snapd.spec | 4 +-- 2 files changed, 1 insertion(+), 49 deletions(-) delete mode 100644 0001-data-selinux-remove-timedatex.patch diff --git a/0001-data-selinux-remove-timedatex.patch b/0001-data-selinux-remove-timedatex.patch deleted file mode 100644 index a82c392..0000000 --- a/0001-data-selinux-remove-timedatex.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 794cbbe80e2487be9ce967e08d2898640cd519cb Mon Sep 17 00:00:00 2001 -From: Maciej Borzecki -Date: Thu, 24 Oct 2024 16:03:03 +0200 -Subject: [PATCH] data/selinux: remove timedatex - -The upstream selinux-policy has dropped timedatex in -https://github.com/fedora-selinux/selinux-policy/commit/2246d17b3c63df73e3359161a9c4e9c07d1cd523 -Even when referencing type that no longer exists, our SELinux module -builds fine, but then cannot be loaded at runtime: - -maciek@localhost:~/snapd/data/selinux$ sudo semodule -i snappy.pp.bz2 -Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/snappy/cil:223 -Failed to resolve AST -semodule: Failed! - -And the offending line is: - -maciek@localhost:~/snapd/data/selinux$ /usr/libexec/selinux/hll/pp snappy.pp | tail -n +223 | head -1 -(typeattributeset cil_gen_require timedatex_t) - -Fixes: https://bugs.launchpad.net/snapd/+bug/2085535 - -Signed-off-by: Maciej Borzecki ---- - data/selinux/snappy.te | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te -index 0862985aab..7dd9711fcc 100644 ---- a/data/selinux/snappy.te -+++ b/data/selinux/snappy.te -@@ -345,11 +345,6 @@ optional_policy(` - allow snappy_t systemd_timedated_t:dbus send_msg; - allow systemd_timedated_t snappy_t:dbus send_msg; - ') --# or on some systems same dbus API may be provided by timedatex --# RHEL7: there is no timedatex.if --ifndef(`distro_rhel7',` -- timedatex_dbus_chat(snappy_t) --') - - # kernel-module-load interface may inspect or write files under /etc/modprobe.d - optional_policy(` --- -2.47.0 - diff --git a/snapd.spec b/snapd.spec index 34460a4..db265d0 100644 --- a/snapd.spec +++ b/snapd.spec @@ -90,7 +90,6 @@ License: GPL-3.0-only URL: https://%{provider_prefix} Source0: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz Source1: https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz -Patch0: 0001-data-selinux-remove-timedatex.patch ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x} @@ -114,8 +113,7 @@ Requires: ((squashfuse and fuse) or kmod(squashfs.ko)) %endif # Require xdelta for delta updates of snap packages. -# XXX: xdelta is only in EPEL 9. -%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} == 9) +%if 0%{?fedora} || ( 0%{?rhel} && 0%{?rhel} > 8 ) Requires: xdelta %endif