Fix SELinux sysctl denial

resolves: RHEL-215379

cepces-0.3.8-fix-version.patch

@@ -1,23 +0,0 @@
-Index: cepces-0.3.8/cepces/__init__.py
-===================================================================
---- cepces-0.3.8.orig/cepces/__init__.py	2023-02-15 21:58:32.000000000 +0100
-+++ cepces-0.3.8/cepces/__init__.py	2024-01-25 16:46:56.218989833 +0100
-@@ -23,7 +23,7 @@ import logging
- __title__ = 'cepces'
- __description__ = 'CEP/CES library.'
- __url__ = 'https://github.com/openSUSE/cepces/'
--__version__ = '0.3.7'
-+__version__ = '0.3.8'
- __author__ = 'Daniel Uvehag'
- __author_email__ = 'daniel.uvehag@gmail.com'
- __license__ = 'GPLv3'
-Index: cepces-0.3.8/selinux/cepces.te
-===================================================================
---- cepces-0.3.8.orig/selinux/cepces.te	2023-02-15 21:58:32.000000000 +0100
-+++ cepces-0.3.8/selinux/cepces.te	2024-01-25 16:47:06.118006940 +0100
-@@ -1,4 +1,4 @@
--policy_module(cepces, 0.3.7)
-+policy_module(cepces, 0.3.8)
- 
- require {
-     type certmonger_t;

cepces-fix-selinux-sysctl-denial.patch

@@ -0,0 +1,31 @@
+From 9379c57eeacdcf80e82f5ef4fd88d8def71887d9 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Fri, 26 Jun 2026 12:25:28 +0200
+Subject: [PATCH] fix(selinux): allow certmonger_t to search sysctl_net_t
+ directories
+
+Python's socket/network initialization reads /proc/sys/net, which is
+labeled sysctl_net_t. Without the search permission certmonger denies
+the openat syscall with EACCES under enforcing SELinux.
+---
+ selinux/cepces.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/selinux/cepces.te b/selinux/cepces.te
+index 63da747..a894888 100644
+--- a/selinux/cepces.te
++++ b/selinux/cepces.te
+@@ -4,6 +4,7 @@ require {
+     type certmonger_t;
+     type kernel_t;
+     type ldconfig_exec_t;
++    type sysctl_net_t;
+ }
+ 
+ type cepces_log_t;
+@@ -13,4 +14,5 @@ allow certmonger_t cepces_log_t:dir { add_name search write };
+ allow certmonger_t cepces_log_t:file { create open };
+ 
+ allow certmonger_t kernel_t:system module_request;
++allow certmonger_t sysctl_net_t:dir search;
+ allow certmonger_t ldconfig_exec_t:file { read execute open execute_no_trans };

cepces.spec

@@ -16,6 +16,7 @@ URL:            https://github.com/openSUSE/%{name}
 Source0:        https://github.com/openSUSE/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 
 Patch0:         cepces-setuptools.patch
+Patch1:         cepces-fix-selinux-sysctl-denial.patch
 
 BuildArch:      noarch