diff --git a/.gitignore b/.gitignore index 538d705..50536b6 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ /vsomeip-3.5.5.tar.gz /vsomeip-3.5.6.tar.gz /vsomeip-3.5.7.tar.gz +/vsomeip-3.5.11.tar.gz diff --git a/03-vsomeip3-boost-asio-deprecation.patch b/03-vsomeip3-boost-asio-deprecation.patch new file mode 100644 index 0000000..c3e43f3 --- /dev/null +++ b/03-vsomeip3-boost-asio-deprecation.patch @@ -0,0 +1,63 @@ +--- vsomeip-3.5.11/implementation/endpoints/src/local_tcp_client_endpoint_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/endpoints/src/local_tcp_client_endpoint_impl.cpp 2026-01-22 14:24:46.309463004 +0000 +@@ -25,6 +25,10 @@ + #include "../../protocol/include/protocol.hpp" + #include "../../routing/include/routing_host.hpp" + ++// boost::asio::io_context::strand::wrap is deprecated ++// and should be replaced with boost::asio::bind_executor ++#pragma GCC diagnostic warning "-Wdeprecated-declarations" ++ + namespace vsomeip_v3 { + + local_tcp_client_endpoint_impl::local_tcp_client_endpoint_impl(const std::shared_ptr& _endpoint_host, +--- vsomeip-3.5.11/implementation/endpoints/src/tcp_client_endpoint_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/endpoints/src/tcp_client_endpoint_impl.cpp 2026-01-22 14:33:44.323383593 +0000 +@@ -20,6 +20,10 @@ + #include "../../utility/include/utility.hpp" + #include "../../utility/include/bithelper.hpp" + ++// boost::asio::io_context::strand::wrap is deprecated ++// and should be replaced with boost::asio::bind_executor ++#pragma GCC diagnostic warning "-Wdeprecated-declarations" ++ + namespace vsomeip_v3 { + + tcp_client_endpoint_impl::tcp_client_endpoint_impl(const std::shared_ptr& _endpoint_host, +--- vsomeip-3.5.11/implementation/endpoints/src/local_uds_client_endpoint_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/endpoints/src/local_uds_client_endpoint_impl.cpp 2026-01-22 14:36:48.259884673 +0000 +@@ -21,6 +21,10 @@ + #include "../../protocol/include/protocol.hpp" + #include "../../routing/include/routing_host.hpp" + ++// boost::asio::io_context::strand::wrap is deprecated ++// and should be replaced with boost::asio::bind_executor ++#pragma GCC diagnostic warning "-Wdeprecated-declarations" ++ + namespace vsomeip_v3 { + + local_uds_client_endpoint_impl::local_uds_client_endpoint_impl(const std::shared_ptr& _endpoint_host, +--- vsomeip-3.5.11/implementation/endpoints/src/udp_client_endpoint_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/endpoints/src/udp_client_endpoint_impl.cpp 2026-01-22 14:39:16.849000928 +0000 +@@ -19,6 +19,10 @@ + #include "../../utility/include/utility.hpp" + #include "../../utility/include/bithelper.hpp" + ++// boost::asio::io_context::strand::wrap is deprecated ++// and should be replaced with boost::asio::bind_executor ++#pragma GCC diagnostic warning "-Wdeprecated-declarations" ++ + namespace vsomeip_v3 { + + udp_client_endpoint_impl::udp_client_endpoint_impl(const std::shared_ptr& _endpoint_host, +--- vsomeip-3.5.11/implementation/routing/src/routing_manager_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/routing/src/routing_manager_impl.cpp 2026-01-22 14:42:04.516589196 +0000 +@@ -1421,7 +1421,7 @@ + if (is_forwarded) { + trace::header its_header; + const boost::asio::ip::address_v4 its_remote_address = +- _remote_address.is_v4() ? _remote_address.to_v4() : boost::asio::ip::address_v4::from_string("6.6.6.6"); ++ _remote_address.is_v4() ? _remote_address.to_v4() : boost::asio::ip::make_address_v4("6.6.6.6"); + trace::protocol_e its_protocol = _receiver->is_local() ? trace::protocol_e::local + : _receiver->is_reliable() ? trace::protocol_e::tcp + : trace::protocol_e::udp; diff --git a/04-vsomeip3-gcc16-warning.patch b/04-vsomeip3-gcc16-warning.patch new file mode 100644 index 0000000..9645c75 --- /dev/null +++ b/04-vsomeip3-gcc16-warning.patch @@ -0,0 +1,12 @@ +--- vsomeip-3.5.11/implementation/compat/runtime/src/application_impl.cpp~ 2025-11-14 14:12:07.000000000 +0000 ++++ vsomeip-3.5.11/implementation/compat/runtime/src/application_impl.cpp 2026-01-22 15:00:33.768980411 +0000 +@@ -18,6 +18,9 @@ + #include "../../message/include/message_impl.hpp" + #include "../../message/include/payload_impl.hpp" + ++// GCC 16 false positive in shared_ptr ++#pragma GCC diagnostic warning "-Warray-bounds" ++ + namespace vsomeip { + + application_impl::application_impl(const std::string& _name) { diff --git a/routingmanagerd.service b/routingmanagerd.service index 9bd66bb..83a957e 100644 --- a/routingmanagerd.service +++ b/routingmanagerd.service @@ -1,7 +1,7 @@ [Unit] Description=vsomeip routing manager After=systemd-tmpfiles-setup.service -Requires=routingmanagerd.socket +Requires=dlt.service [Service] Type=simple diff --git a/routingmanagerd.socket b/routingmanagerd.socket index 5616ec7..cedc8ab 100644 --- a/routingmanagerd.socket +++ b/routingmanagerd.socket @@ -6,6 +6,7 @@ After=systemd-tmpfiles-setup.service ListenStream=/run/vsomeip/vsomeip-0 SocketUser=routingmanagerd SocketGroup=routingmanagerd +SELinuxContext=system_u:object_r:vsomeip_var_run_t:s0 [Install] WantedBy=sockets.target diff --git a/sources b/sources index f52176e..e2127db 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (vsomeip-3.5.7.tar.gz) = 844958d2a218f8f6437d4b45bad2ff28b1a3e7d6124a82ed2a19407084fbba8e88f209651c88efa222a2cef598325e9c11ebad5e5d684f803fc8795e9afd2953 +SHA512 (vsomeip-3.5.11.tar.gz) = 76539b9609ddfb6882947e7f9382f64342f595214077abd28fc691f0fce02d2f53da1a23b4c25b321460f80693c969abd0cdc8806172e8cc6f29935b45aeebd4 diff --git a/vsomeip.fc b/vsomeip.fc index bd41267..e0b8e8b 100644 --- a/vsomeip.fc +++ b/vsomeip.fc @@ -1,3 +1,5 @@ -/usr/bin/routingmanagerd -- gen_context(system_u:object_r:vsomeip_exec_t,s0) -/var/run/vsomeip/vsomeip-0 gen_context(system_u:object_r:router_vsomeip_var_run_t,s0) -/var/run/vsomeip(/.*)? gen_context(system_u:object_r:vsomeip_var_run_t,s0) +/usr/bin/routingmanagerd -- gen_context(system_u:object_r:vsomeip_exec_t,s0) +/usr/lib/systemd/system/routingmanagerd.service -- gen_context(system_u:object_r:vsomeip_unit_file_t,s0) +/var/lib/routingmanagerd(/.*)? gen_context(system_u:object_r:vsomeip_var_lib_t,s0) +/var/run/vsomeip(/.*)? gen_context(system_u:object_r:vsomeip_var_run_t,s0) +/var/run/vsomeip/vsomeip-0 -s gen_context(system_u:object_r:vsomeip_var_run_t,s0) diff --git a/vsomeip.if b/vsomeip.if index a6b88d8..b60be74 100644 --- a/vsomeip.if +++ b/vsomeip.if @@ -1,10 +1,233 @@ + ## policy for vsomeip +######################################## +## +## Execute vsomeip_exec_t in the vsomeip domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`vsomeip_domtrans',` + gen_require(` + type vsomeip_t, vsomeip_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, vsomeip_exec_t, vsomeip_t) +') + +###################################### +## +## Execute vsomeip in the caller domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_exec',` + gen_require(` + type vsomeip_exec_t; + ') + + corecmd_search_bin($1) + can_exec($1, vsomeip_exec_t) +') + +######################################## +## +## Search vsomeip lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_search_lib',` + gen_require(` + type vsomeip_var_lib_t; + ') + + allow $1 vsomeip_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## +## Read vsomeip lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_read_lib_files',` + gen_require(` + type vsomeip_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, vsomeip_var_lib_t, vsomeip_var_lib_t) +') + +######################################## +## +## Manage vsomeip lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_manage_lib_files',` + gen_require(` + type vsomeip_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, vsomeip_var_lib_t, vsomeip_var_lib_t) +') + +######################################## +## +## Manage vsomeip lib directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_manage_lib_dirs',` + gen_require(` + type vsomeip_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, vsomeip_var_lib_t, vsomeip_var_lib_t) +') + +######################################## +## +## Read vsomeip PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_read_pid_files',` + gen_require(` + type vsomeip_var_run_t; + ') + + files_search_pids($1) + read_files_pattern($1, vsomeip_var_run_t, vsomeip_var_run_t) +') + +######################################## +## +## Connect to vsomeip over a unix stream socket. +## +## +## +## Domain allowed access. +## +## +# +interface(`vsomeip_stream_connect',` + gen_require(` + type vsomeip_t, vsomeip_var_run_t; + ') + + files_search_pids($1) + stream_connect_pattern($1, vsomeip_var_run_t, vsomeip_var_run_t, vsomeip_t) +') +######################################## +## +## Execute vsomeip server in the vsomeip domain. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`vsomeip_systemctl',` + gen_require(` + type vsomeip_t; + type vsomeip_unit_file_t; + ') + + systemd_exec_systemctl($1) + systemd_read_fifo_file_passwd_run($1) + allow $1 vsomeip_unit_file_t:file read_file_perms; + allow $1 vsomeip_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, vsomeip_t) +') + + +######################################## +## +## All of the rules required to administrate +## an vsomeip environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`vsomeip_admin',` + gen_require(` + type vsomeip_t; + type vsomeip_var_lib_t; + type vsomeip_var_run_t; + type vsomeip_unit_file_t; + ') + + allow $1 vsomeip_t:process { signal_perms }; + ps_process_pattern($1, vsomeip_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 vsomeip_t:process ptrace; + ') + + files_search_var_lib($1) + admin_pattern($1, vsomeip_var_lib_t) + + files_search_pids($1) + admin_pattern($1, vsomeip_var_run_t) + + vsomeip_systemctl($1) + admin_pattern($1, vsomeip_unit_file_t) + allow $1 vsomeip_unit_file_t:service all_service_perms; + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') + interface(`vsomeip_use',` gen_require(` type vsomeip_t; type vsomeip_var_run_t; - type router_vsomeip_var_run_t; ') # create and use vsomeip sockets: allow $1 vsomeip_var_run_t:dir { add_name remove_name write }; @@ -13,7 +236,6 @@ interface(`vsomeip_use',` # Talk to routing manager (and back) allow $1 vsomeip_t:unix_stream_socket connectto; allow vsomeip_t $1:unix_stream_socket connectto; - allow $1 router_vsomeip_var_run_t:sock_file write; ') interface(`vsomeip_talk_to',` diff --git a/vsomeip.te b/vsomeip.te index ed67e4c..f10f226 100644 --- a/vsomeip.te +++ b/vsomeip.te @@ -1,29 +1,74 @@ policy_module(vsomeip, 1.0.0) -# Type of routingmanagerd +######################################## +# +# Declarations +# + +require { + type proc_net_t; + type unconfined_service_t; + type unreserved_port_t; + type node_t; +} + type vsomeip_t; type vsomeip_exec_t; init_daemon_domain(vsomeip_t, vsomeip_exec_t) -# Type of /run/vsomeip +type vsomeip_rw_t; +files_type(vsomeip_rw_t) + +type vsomeip_var_lib_t; +files_type(vsomeip_var_lib_t) + type vsomeip_var_run_t; -files_base_file(vsomeip_var_run_t); +files_pid_file(vsomeip_var_run_t) -# Type of /run/vsomeip/vsomeip-0 (routingmanagerd socket) -type router_vsomeip_var_run_t; -files_base_file(router_vsomeip_var_run_t); +type vsomeip_unit_file_t; +systemd_unit_file(vsomeip_unit_file_t) -# Systemd socket (socket activation) -allow init_t vsomeip_var_run_t:dir { add_name remove_name }; -allow init_t router_vsomeip_var_run_t:sock_file { create unlink write setattr }; - -# Routing manager daemon -allow vsomeip_t self:netlink_route_socket { bind create nlmsg_read shutdown }; +######################################## +# +# vsomeip local policy +# +allow vsomeip_t proc_net_t:file { open read }; +allow vsomeip_t proc_net_t:lnk_file read; +allow vsomeip_t self:fifo_file rw_fifo_file_perms; +allow vsomeip_t self:netlink_route_socket { bind create nlmsg_read shutdown read write }; +allow vsomeip_t self:process { fork setsched }; +allow vsomeip_t self:udp_socket { create setopt bind getopt read write }; allow vsomeip_t self:unix_dgram_socket { create ioctl }; +allow vsomeip_t self:unix_stream_socket create_stream_socket_perms; + allow vsomeip_t vsomeip_var_run_t:dir { add_name write remove_name }; allow vsomeip_t vsomeip_var_run_t:file { create lock open write unlink }; -allow vsomeip_t vsomeip_var_run_t:sock_file write; -allow vsomeip_t router_vsomeip_var_run_t:sock_file setattr; +allow vsomeip_t vsomeip_var_run_t:sock_file { create setattr unlink write }; +allow vsomeip_t unreserved_port_t:udp_socket name_bind; +allow vsomeip_t node_t:udp_socket node_bind; +files_write_generic_pid_sockets(vsomeip_t) + +manage_dirs_pattern(vsomeip_t, vsomeip_rw_t, vsomeip_rw_t) +manage_files_pattern(vsomeip_t, vsomeip_rw_t, vsomeip_rw_t) +manage_lnk_files_pattern(vsomeip_t, vsomeip_rw_t, vsomeip_rw_t) + +manage_sock_files_pattern(vsomeip_t, vsomeip_rw_t, vsomeip_rw_t) + +manage_dirs_pattern(vsomeip_t, vsomeip_var_lib_t, vsomeip_var_lib_t) +manage_files_pattern(vsomeip_t, vsomeip_var_lib_t, vsomeip_var_lib_t) +manage_lnk_files_pattern(vsomeip_t, vsomeip_var_lib_t, vsomeip_var_lib_t) +files_var_lib_filetrans(vsomeip_t, vsomeip_var_lib_t, { dir file lnk_file }) + +manage_dirs_pattern(vsomeip_t, vsomeip_var_run_t, vsomeip_var_run_t) +manage_files_pattern(vsomeip_t, vsomeip_var_run_t, vsomeip_var_run_t) +manage_lnk_files_pattern(vsomeip_t, vsomeip_var_run_t, vsomeip_var_run_t) +files_pid_filetrans(vsomeip_t, vsomeip_var_run_t, { dir file lnk_file }) + +domain_use_interactive_fds(vsomeip_t) + +files_read_etc_files(vsomeip_t) + +miscfiles_read_localization(vsomeip_t) # Routing manager daemon to unconfined optional_policy(` @@ -31,6 +76,8 @@ optional_policy(` type unconfined_t; ') allow vsomeip_t unconfined_t:unix_stream_socket connectto; + allow vsomeip_t unconfined_service_t:unix_stream_socket connectto; + ') # Containers can talk to each other (and routing manager) diff --git a/vsomeip3.spec b/vsomeip3.spec index 01c44b1..4b3bd5c 100644 --- a/vsomeip3.spec +++ b/vsomeip3.spec @@ -1,8 +1,8 @@ %global _lto_cflags %{nil} Name: vsomeip3 -Version: 3.5.7 -Release: 2%{?dist} +Version: 3.5.11 +Release: 9%{?dist} Summary: COVESA implementation of SOME/IP protocol # remove from i686 as not needed. ExcludeArch: %{ix86} @@ -11,17 +11,21 @@ License: MPL-2.0 URL: https://github.com/COVESA/vsomeip Source0: %{URL}/archive/%{VERSION}/vsomeip-%{VERSION}.tar.gz Source1: routingmanagerd.service -Source2: routingmanagerd.socket Source3: tmpfiles-vsomeip.conf Source4: etc-vsomeip.json Source5: vsomeip.fc Source6: vsomeip.if Source7: vsomeip.te +Source8: vsomeip3.sysusers.conf # Build/Install tools and examples Patch1: 01-vsomeip-build-extra.patch # Do various conversions of /usr/lib -> /usr/lib64 Patch2: 02-vsomeip-fix-cmake_libdir.patch +# boost::asio::io_context::strand::wrap is deprecated +Patch3: 03-vsomeip3-boost-asio-deprecation.patch +# GCC 16 -Warray-bounds false positive +Patch4: 04-vsomeip3-gcc16-warning.patch BuildRequires: boost-devel BuildRequires: cmake @@ -37,9 +41,6 @@ BuildRequires: gtest-devel BuildRequires: asciidoc %endif -# https://fedoraproject.org/wiki/SELinux/IndependentPolicy -Requires: (vsomeip3-selinux = %{?epoch:%{epoch}:}%{version}-%{release} if selinux-policy-targeted) - %description The vsomeip stack implements the http://some-ip.com/ (Scalable @@ -58,22 +59,36 @@ Requires: %{name}%{?_isa} = %{version}-%{release} %package selinux Summary: SELinux policy module for %{name} -BuildRequires: selinux-policy +BuildArch: noarch + BuildRequires: selinux-policy-devel BuildRequires: make -BuildArch: noarch -%{?selinux_requires} +BuildRequires: checkpolicy +%if "%{_selinux_policy_version}" != "" +Requires: selinux-policy >= %{_selinux_policy_version} +%endif + +Requires(post): policycoreutils +%if "%{_selinux_policy_version}" != "" +Requires(post): selinux-policy-base >= %_selinux_policy_version +Requires(post): selinux-policy-any >= %_selinux_policy_version +%endif %description selinux This package contains the SELinux policy module for %{name}. + +## routing manager %package routingmanager Summary: Routingmanager daemon %{name} Requires: %{name}%{?_isa} = %{version}-%{release} Requires: systemd +Requires: dlt-daemon +Recommends: vsomeip3-selinux %description routingmanager -%{summary}. +%{summary}. Also requires dlt-daemon running. + %package examples Summary: Examples for %{name} @@ -108,11 +123,6 @@ cp %{SOURCE5} %{SOURCE6} %{SOURCE7} vsomeip-selinux/ # with debuginfo find -name "*.[ch]pp" | xargs chmod a-x -# Create a sysusers.d config file -cat >vsomeip3.sysusers.conf < /dev/null || : +restorecon -R %{_rundir}/vsomeip/ &> /dev/null || : +restorecon -R %{_localstatedir}/%{_rundir}/vsomeip/ &> /dev/null || : +restorecon -R /var/lib/routingmanagerd/ &> /dev/null || : %postun selinux if [ $1 -eq 0 ]; then - %selinux_modules_uninstall %{_datadir}/selinux/packages/vsomeip.pp.bz2 + . %{_sysconfdir}/selinux/config + %selinux_modules_uninstall -s ${SELINUXTYPE} vsomeip + restorecon -R %{_bindir}/routingmanagerd &> /dev/null || : + restorecon -R %{_rundir}/vsomeip/ &> /dev/null || : + restorecon -R %{_localstatedir}/%{_rundir}/vsomeip/ &> /dev/null || : + restorecon -R /var/lib/routingmanagerd/ &> /dev/null || : fi +%pre routingmanager +%sysusers_create_compat vsomeip3.conf %post routingmanager -%systemd_post routingmanagerd.socket routingmanagerd.service +%systemd_post routingmanagerd.service %preun routingmanager -%systemd_preun routingmanagerd.socket routingmanagerd.service +%systemd_preun routingmanagerd.service %postun routingmanager -%systemd_postun_with_restart routingmanagerd.socket routingmanagerd.service +%systemd_postun_with_restart routingmanagerd.service %files %doc AUTHORS CHANGES README.md @@ -206,11 +227,10 @@ fi %files routingmanager %doc AUTHORS CHANGES README.md %license LICENSE +%{_sysusersdir}/vsomeip3.conf %attr(755,routingmanagerd,routingmanagerd) %dir /var/lib/routingmanagerd %{_bindir}/routingmanagerd %{_unitdir}/routingmanagerd.service -%{_unitdir}/routingmanagerd.socket -%{_sysusersdir}/vsomeip3.conf %files tools %doc AUTHORS CHANGES README.md @@ -243,6 +263,32 @@ fi %{_libdir}/pkgconfig/vsomeip3.pc %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 3.5.11-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Thu Jan 22 2026 Jonathan Wakely - 3.5.11-8 +- Patched for Boost 1.90.0 asio deprecation and GCC 16 warning (#2429732) + +* Sat Jan 17 2026 Fedora Release Engineering - 3.5.11-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Mon Dec 08 2025 Stephen Smoogen - 3.5.11-6 +- Find a couple of small changes needed to allow for selinux to be applied to non-standard policies + +* Sun Dec 07 2025 Stephen Smoogen - 3.5.11-4 +- Use bluechi selinux to fix problem with non-default targets + +* Wed Dec 3 2025 Stephen Smoogen - 3.5.11-3 +- Rewrite the selinux policy from scratch with sepolgen +- Remove the socket creation as systemd as vsomeip will not work with it. + +* Mon Dec 1 2025 Stephen Smoogen - 3.5.11-2 +- Try to fix the selinux problem seen with CS10 +- Try to fix problem with socket creation and systemd + +* Mon Dec 1 2025 Stephen Smoogen - 3.5.11-1 +- Update to newest version of vsomeip3. + * Wed Aug 27 2025 Stephen Smoogen - 3.5.7-2 - Remove i686 as it no longer builds and is not needed. diff --git a/vsomeip3.sysusers.conf b/vsomeip3.sysusers.conf new file mode 100644 index 0000000..ae68175 --- /dev/null +++ b/vsomeip3.sysusers.conf @@ -0,0 +1 @@ +u routingmanagerd - 'User for routingmanagerd' /var/lib/routingmanagerd -