Merge branch 'rawhide' into epel8

Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>

0001-Revert-data-selinux-remove-timedatex-14670.patch

@@ -0,0 +1,32 @@
+From 18faae8698370c3f192319c88214fe01dd06b83f Mon Sep 17 00:00:00 2001
+Message-ID: <18faae8698370c3f192319c88214fe01dd06b83f.1747651437.git.maciej.borzecki@canonical.com>
+From: Maciej Borzecki <maciej.borzecki@canonical.com>
+Date: Mon, 19 May 2025 12:02:54 +0200
+Subject: [PATCH] Revert "data/selinux: remove timedatex (#14670)"
+
+This reverts commit cc90a8be2eaa9718dba018ff42cce2c6cd0ad963.
+
+Signed-off-by: Maciej Borzecki <maciej.borzecki@canonical.com>
+---
+ data/selinux/snappy.te | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te
+index f66e7d5b37dd721c7cac0e17fc58a29b4029a656..802bddd520a5d3341acf8299fcfda8a29cc3a9eb 100644
+--- a/data/selinux/snappy.te
++++ b/data/selinux/snappy.te
+@@ -345,6 +345,11 @@ optional_policy(`
+ 	allow snappy_t systemd_timedated_t:dbus send_msg;
+ 	allow systemd_timedated_t snappy_t:dbus send_msg;
+ ')
++# or on some systems same dbus API may be provided by timedatex
++# RHEL7: there is no timedatex.if
++ifndef(`distro_rhel7',`
++  timedatex_dbus_chat(snappy_t)
++')
+ 
+ # kernel-module-load interface may inspect or write files under /etc/modprobe.d
+ optional_policy(`
+-- 
+2.49.0
+

fs_watch_group_dirs.patch

@@ -0,0 +1,15 @@
+diff --git a/data/selinux/snappy.te b/data/selinux/snappy.te
+index 61284f4bf7..d91f5d69ed 100644
+--- a/data/selinux/snappy.te
++++ b/data/selinux/snappy.te
+@@ -464,7 +464,9 @@ gen_require(`
+ allow snappy_t devicekit_power_exec_t:file { getattr };
+ 
+ # Snapd monitors cgroup hierarchy for refresh app awareness.
+-fs_watch_cgroup_dirs(snappy_t)
++ifndef(`distro_rhel8',`
++  fs_watch_cgroup_dirs(snappy_t)
++')
+ 
+ # connect to unix socket of snap session agent usually executing as unconfined_t.
+ # TODO: define separate policy for user session agent

snapd.spec

@@ -95,6 +95,9 @@ License:        GPL-3.0-only
 URL:            https://%{provider_prefix}
 Source0:        https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.no-vendor.tar.xz
 Source1:        https://%{provider_prefix}/releases/download/%{version}/%{name}_%{version}.only-vendor.tar.xz
+# EPEL8: fix for https://bugs.launchpad.net/snapd/+bug/2097170
+Patch0:         0001-Revert-data-selinux-remove-timedatex-14670.patch
+Patch1:         fs_watch_group_dirs.patch
 
 ExclusiveArch:  %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm} aarch64 ppc64le s390x}
 
@@ -603,6 +606,9 @@ EOF
 %if 0%{?rhel} == 7
     M4PARAM='-D distro_rhel7'
 %endif
+%if 0%{?rhel} == 8
+    M4PARAM='-D distro_rhel8'
+%endif
 %if 0%{?rhel} == 7 || 0%{?rhel} == 8 || 0%{?rhel} == 9
     # RHEL7, RHEL8 and RHEL9 are missing the BPF interfaces from their reference policy
     M4PARAM="$M4PARAM -D no_bpf"
@@ -1313,6 +1319,10 @@ fi
  - Interfaces: add symlinks backend
  - Interfaces: system key mismatch handling
 
+* Mon May 19 2025 Maciek Borzecki <maciek.borzecki@gmail.com> - 2.68.3-1
+- Revert upstream patch dropping timedatex from SELinux policy of snapd
+ - Fixes: https://bugs.launchpad.net/snapd/+bug/2097170
+
 * Tue Apr 08 2025 Ernest Lotter <ernest.lotter@canonical.com>
 - New upstream release 2.69
  - FDE: re-factor listing of the disks based on run mode model and