diff --git a/.gitignore b/.gitignore index 871b18a..e4523b6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,12 @@ /waydroid-1.3.4.tar.gz /waydroid-1.4.0.tar.gz /waydroid-1.4.1.tar.gz +/waydroid-1.4.2.tar.gz +/waydroid-1.4.3.tar.gz +/waydroid-1.5.0.tar.gz +/waydroid-1.5.1.tar.gz +/waydroid-1.5.4.tar.gz +/waydroid-1.6.0.tar.gz +/waydroid-1.6.1.tar.gz +/waydroid-1.6.2.tar.gz +/waydroid-1.6.3.tar.gz diff --git a/no-apparmor.patch b/no-apparmor.patch new file mode 100644 index 0000000..130c910 --- /dev/null +++ b/no-apparmor.patch @@ -0,0 +1,37 @@ +diff --git a/data/configs/config_1 b/data/configs/config_1 +index 365cac30..45112766 100644 +--- a/data/configs/config_1 ++++ b/data/configs/config_1 +@@ -2,7 +2,6 @@ lxc.utsname = waydroid + + lxc.init_cmd = /init + +-lxc.aa_profile = unconfined + lxc.seccomp = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp + + lxc.network.type = veth +diff --git a/data/configs/config_3 b/data/configs/config_3 +index 3c822264..7e5e44f8 100644 +--- a/data/configs/config_3 ++++ b/data/configs/config_3 +@@ -1,6 +1,5 @@ + lxc.uts.name = waydroid + +-lxc.apparmor.profile = unconfined + lxc.seccomp.profile = /var/lib/waydroid/lxc/waydroid/waydroid.seccomp + + lxc.no_new_privs = 1 +diff --git a/tools/helpers/lxc.py b/tools/helpers/lxc.py +index 6be7b7dd..9c8c9e55 100644 +--- a/tools/helpers/lxc.py ++++ b/tools/helpers/lxc.py +@@ -161,9 +161,6 @@ def set_lxc_config(args): + tools.helpers.run.user(args, command) + command = ["cp", "-fpr", seccomp_profile, lxc_path + "/waydroid.seccomp"] + tools.helpers.run.user(args, command) +- if get_apparmor_status(args): +- command = ["sed", "-i", "-E", "/lxc.aa_profile|lxc.apparmor.profile/ s/unconfined/{}/g".format(LXC_APPARMOR_PROFILE), lxc_path + "/config"] +- tools.helpers.run.user(args, command) + + nodes = generate_nodes_lxc_config(args) + config_nodes_tmp_path = args.work + "/config_nodes" diff --git a/sources b/sources index c0abe7e..f45413b 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (waydroid-1.4.1.tar.gz) = c5050c03543623a14a0f1a7a0b320e2786d95c208945767cddff7c3b46486cc19406eba798fce2224a383b3fe587e2e1b1f91ebb75c1da08cb50d33e724b6fef +SHA512 (waydroid-1.6.3.tar.gz) = e395b0eed9bfda3cb7b0ab8de5e8d69c57188c86b810c76fccd6a9dea2179acf219b41338382a923d0f4cfbb276064d7336c0771ba54c6ef14e8496250a3acfa diff --git a/waydroid.spec b/waydroid.spec index af784ae..e8973eb 100644 --- a/waydroid.spec +++ b/waydroid.spec @@ -1,12 +1,12 @@ %global forgeurl https://github.com/waydroid/waydroid %global selinuxtype targeted -Version: 1.4.1 +Version: 1.6.3 %global tag %{version} %forgemeta Name: waydroid -Release: 1%{?dist} +Release: 2%{?dist} Summary: Container-based approach to boot a full Android system on GNU/Linux License: GPL-3.0-only URL: %{forgeurl} @@ -21,6 +21,9 @@ Patch0: setup-firewalld.patch # Mount the android rootfs with a default selinux context Patch1: mount-secontext.patch +# Fedora LXC is compiled without AppArmor support and fails to parse lxc.apparmor.profile config +Patch2: no-apparmor.patch + BuildArch: noarch BuildRequires: make @@ -32,7 +35,8 @@ BuildRequires: systemd-rpm-macros BuildRequires: desktop-file-utils BuildRequires: libappstream-glib -Requires: python3-gbinder >= 1.1.0 +Requires: python3dist(gbinder-python) >= 1.3 +Requires: python3dist(dbus-python) Requires: python3-gobject Requires: lxc Requires: gtk3 @@ -40,8 +44,6 @@ Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{sel Requires: nftables Requires: iproute Requires: dnsmasq -Recommends: python3-pyclip -Recommends: wl-clipboard %description Waydroid uses Linux namespaces to run a full Android system in a container @@ -68,6 +70,7 @@ cp %{S:6} SELinux/ # Remove link for ROM files sed -i -e '/"system_channel":/ s/: ".*"/: ""/' tools/config/__init__.py sed -i -e '/"vendor_channel":/ s/: ".*"/: ""/' tools/config/__init__.py +sed -i -e '/options: OTA channel URL/ s/default is Official OTA server/mandatory/' tools/helpers/arguments.py # Compile sepolicy cd SELinux %{__make} NAME=%{selinuxtype} -f /usr/share/selinux/devel/Makefile @@ -136,12 +139,116 @@ fi %{_datadir}/dbus-1/system-services/id.waydro.Container.service %{_datadir}/dbus-1/system.d/id.waydro.Container.conf %{_datadir}/polkit-1/actions/id.waydro.Container.policy +%{_datadir}/desktop-directories/waydroid.directory +%{_sysconfdir}/xdg/menus/applications-merged/waydroid.menu %files selinux %doc SELinux/%{name}.te %{_datadir}/selinux/%{selinuxtype}/%{name}.pp %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1.6.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Thu May 28 2026 Alessandro Astone - 1.6.3-1 +- new version + +* Sun Feb 22 2026 Alessandro Astone - 1.6.2-1 +- Attempt to further fix initialization with Python 3.14 +- Fix desktop file update logic for headless apps +- Add Vulkan support for xe kernel driver +- Allow passing arguments to "waydroid logcat" + +* Sat Jan 17 2026 Fedora Release Engineering - 1.6.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Mon Dec 29 2025 Alessandro Astone - 1.6.1-1 +- Fix graphical initialization with Python 3.14 and newer (rhbz#2425593) +- Allow using block device as pre-installed image files + +* Mon Dec 08 2025 Alessandro Astone - 1.6.0-3 +- Fix versioned dependency on gbinder-python (rhbz#2420131) + +* Mon Dec 08 2025 Alessandro Astone - 1.6.0-2 +- Requires gbinder-python >= 1.3.0 +- Stop recommending pyclip + +* Thu Dec 04 2025 Alessandro Astone - 1.6.0-1 +- Toggle ADB secure mode by default + + ADB will no longer auto-connect on session start + + You may use the new waydroid adb connect command to connect ADB + + To connect ADB, you will need to provide authorization on the Android side +- Rotate and trim waydroid.log file at 5MB +- Hide system apps from the desktop applications menu + + To make a system app visible in your apps menu, switch NoDisplay=false in its desktop file +- Do not hide the main Waydroid launcher after enabling multi-windows mode +- Add desktop action to stop Waydroid session + + Right-click the Waydroid entry in your desktop application launcher, then Stop Waydroid +- Add desktop action to re-initialize Waydroid + + Right-click the Waydroid entry in your desktop application launcher, then Initialize Waydroid + + This allows switching between VANILLA and GAPPS +- Make sure to stop waydroid session on user log-out +- Add new waydroid command with no arguments, alias for waydroid show-full-ui +- Add new waydroid bugreport command to gather logs for a bug report +- Forward Android notifications to the desktop + + Requires updating the Android system image to a compatible version + +* Thu Nov 13 2025 Alessandro Astone - 1.5.4-6 +- sepolicy: Further silence audit for /usr/bin/systemctl (rhbz#2412288) + +* Sat Oct 04 2025 Alessandro Astone - 1.5.4-5 +- Fix running the graphical initializer on Python3.14 (rhbz#2394967) + +* Fri Sep 19 2025 Python Maint - 1.5.4-4 +- Rebuilt for Python 3.14.0rc3 bytecode + +* Fri Aug 15 2025 Python Maint - 1.5.4-3 +- Rebuilt for Python 3.14.0rc2 bytecode + +* Fri Jul 25 2025 Fedora Release Engineering - 1.5.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Sat Jul 05 2025 Alessandro Astone - 1.5.4-1 +- new version + +* Tue Apr 01 2025 Alessandro Astone - 1.5.1-2 +- Add SELinux policy for /dev/dma_heap + +* Wed Mar 26 2025 Alessandro Astone - 1.5.1-1 +- new version + +* Wed Mar 12 2025 Alessandro Astone - 1.5.0-1 +- new version + +* Sun Jan 19 2025 Fedora Release Engineering - 1.4.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Sep 04 2024 Alessandro Astone - 1.4.3-2 +- Backport patch to fix initializing with preinstalled images + +* Sat Aug 10 2024 Alessandro Astone - 1.4.3-1 +- new version (rhbz#2303618) +- fix python 3.12 error (rhbz#2258411) +- make it clearer that OTA channels must be provided to `waydroid init` + +* Sat Jul 20 2024 Fedora Release Engineering - 1.4.2-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Thu Mar 14 2024 Alessandro Astone - 1.4.2-3 +- Completely disable apparmor + +* Sat Jan 27 2024 Fedora Release Engineering - 1.4.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Oct 31 2023 Alessandro Astone - 1.4.2-1 +- Update to 1.4.2 + +* Tue Sep 26 2023 Alessandro Astone - 1.4.1-3 +- Amend SELinux to coexist with snap + +* Sat Jul 22 2023 Fedora Release Engineering - 1.4.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Apr 25 2023 Alessandro Astone - 1.4.1-1 - Update to 1.4.1 diff --git a/waydroid.te b/waydroid.te index 9d3a446..fe2308f 100644 --- a/waydroid.te +++ b/waydroid.te @@ -4,6 +4,7 @@ policy_module(waydroid, 1.0) require { type unconfined_t; type unconfined_service_t; + type dma_device_t; type binder_device_t; type binderfs_t; type abrt_t; @@ -73,7 +74,7 @@ sysnet_dns_name_resolve(waydroid_t) corenet_sendrecv_http_client_packets(waydroid_t) corenet_tcp_connect_http_port(waydroid_t) # No need to run systemctl. It is only used to determine apparmor status -dontaudit waydroid_t systemd_systemctl_exec_t:file getattr; +dontaudit waydroid_t systemd_systemctl_exec_t:file { getattr execute }; # waydroid-net.sh type waydroid_net_exec_t; @@ -117,6 +118,8 @@ dev_getattr_dri_dev(waydroid_t) dev_setattr_dri_dev(waydroid_t) dev_getattr_framebuffer_dev(waydroid_t) dev_setattr_framebuffer_dev(waydroid_t) +getattr_chr_files_pattern(waydroid_t, device_t, dma_device_t) +setattr_chr_files_pattern(waydroid_t, device_t, dma_device_t) allow waydroid_t self:capability fsetid; # Video @@ -139,15 +142,37 @@ allow container_runtime_t self:process2 { nnp_transition }; exec_files_pattern(container_runtime_t, waydroid_rootfs_t, waydroid_rootfs_t) domain_entry_file(container_runtime_t, waydroid_rootfs_t) -# DBus +# tmp +type waydroid_tmp_t; +files_tmp_file(waydroid_tmp_t) +manage_dirs_pattern(waydroid_t, waydroid_tmp_t, waydroid_tmp_t) +manage_files_pattern(waydroid_t, waydroid_tmp_t, waydroid_tmp_t) +manage_sock_files_pattern(waydroid_t, waydroid_tmp_t, waydroid_tmp_t) +files_tmp_filetrans(waydroid_t, waydroid_tmp_t, { dir file sock_file }) +can_exec(waydroid_t, waydroid_tmp_t) + +# tmpfs type waydroid_tmpfs_t; -files_tmp_file(waydroid_tmpfs_t) +files_tmpfs_file(waydroid_tmpfs_t) +manage_dirs_pattern(waydroid_t, waydroid_tmpfs_t, waydroid_tmpfs_t) manage_files_pattern(waydroid_t, waydroid_tmpfs_t, waydroid_tmpfs_t) -can_exec(waydroid_t, waydroid_tmpfs_t) -fs_tmpfs_filetrans(waydroid_t, waydroid_tmpfs_t, file) +fs_tmpfs_filetrans(waydroid_t, waydroid_tmpfs_t, { dir file }) + +# Python multiprocessing spawn +allow waydroid_t waydroid_t:unix_stream_socket connectto; + +# DBus dbus_system_bus_client(waydroid_t) dbus_connect_system_bus(waydroid_t) policykit_dbus_chat(waydroid_t) unconfined_dbus_chat(waydroid_t) unconfined_signal(waydroid_t) allow waydroid_t self:capability kill; + +# Snap +optional_policy(` + require { + type snappy_var_lib_t; + } + dontaudit waydroid_t snappy_var_lib_t:dir search_dir_perms; +')