From bf3657e44cf190974f6832261e57b6f8f7eebc31 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@redhat.com>
Date: Fri, 24 Jul 2026 12:51:43 +0200
Subject: [PATCH] Fix SELinux sysctl denial

resolves: RHEL-215379
---
 cepces-0.3.8-fix-version.patch         | 23 -------------------
 cepces-fix-selinux-sysctl-denial.patch | 31 ++++++++++++++++++++++++++
 cepces.spec                            |  1 +
 3 files changed, 32 insertions(+), 23 deletions(-)
 delete mode 100644 cepces-0.3.8-fix-version.patch
 create mode 100644 cepces-fix-selinux-sysctl-denial.patch

diff --git a/cepces-0.3.8-fix-version.patch b/cepces-0.3.8-fix-version.patch
deleted file mode 100644
index 38c57c2..0000000
--- a/cepces-0.3.8-fix-version.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Index: cepces-0.3.8/cepces/__init__.py
-===================================================================
---- cepces-0.3.8.orig/cepces/__init__.py	2023-02-15 21:58:32.000000000 +0100
-+++ cepces-0.3.8/cepces/__init__.py	2024-01-25 16:46:56.218989833 +0100
-@@ -23,7 +23,7 @@ import logging
- __title__ = 'cepces'
- __description__ = 'CEP/CES library.'
- __url__ = 'https://github.com/openSUSE/cepces/'
--__version__ = '0.3.7'
-+__version__ = '0.3.8'
- __author__ = 'Daniel Uvehag'
- __author_email__ = 'daniel.uvehag@gmail.com'
- __license__ = 'GPLv3'
-Index: cepces-0.3.8/selinux/cepces.te
-===================================================================
---- cepces-0.3.8.orig/selinux/cepces.te	2023-02-15 21:58:32.000000000 +0100
-+++ cepces-0.3.8/selinux/cepces.te	2024-01-25 16:47:06.118006940 +0100
-@@ -1,4 +1,4 @@
--policy_module(cepces, 0.3.7)
-+policy_module(cepces, 0.3.8)
- 
- require {
-     type certmonger_t;
diff --git a/cepces-fix-selinux-sysctl-denial.patch b/cepces-fix-selinux-sysctl-denial.patch
new file mode 100644
index 0000000..e8a366c
--- /dev/null
+++ b/cepces-fix-selinux-sysctl-denial.patch
@@ -0,0 +1,31 @@
+From 9379c57eeacdcf80e82f5ef4fd88d8def71887d9 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Fri, 26 Jun 2026 12:25:28 +0200
+Subject: [PATCH] fix(selinux): allow certmonger_t to search sysctl_net_t
+ directories
+
+Python's socket/network initialization reads /proc/sys/net, which is
+labeled sysctl_net_t. Without the search permission certmonger denies
+the openat syscall with EACCES under enforcing SELinux.
+---
+ selinux/cepces.te | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/selinux/cepces.te b/selinux/cepces.te
+index 63da747..a894888 100644
+--- a/selinux/cepces.te
++++ b/selinux/cepces.te
+@@ -4,6 +4,7 @@ require {
+     type certmonger_t;
+     type kernel_t;
+     type ldconfig_exec_t;
++    type sysctl_net_t;
+ }
+ 
+ type cepces_log_t;
+@@ -13,4 +14,5 @@ allow certmonger_t cepces_log_t:dir { add_name search write };
+ allow certmonger_t cepces_log_t:file { create open };
+ 
+ allow certmonger_t kernel_t:system module_request;
++allow certmonger_t sysctl_net_t:dir search;
+ allow certmonger_t ldconfig_exec_t:file { read execute open execute_no_trans };
diff --git a/cepces.spec b/cepces.spec
index 1ae8bdd..e4f41e6 100644
--- a/cepces.spec
+++ b/cepces.spec
@@ -16,6 +16,7 @@ URL:            https://github.com/openSUSE/%{name}
 Source0:        https://github.com/openSUSE/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
 
 Patch0:         cepces-setuptools.patch
+Patch1:         cepces-fix-selinux-sysctl-denial.patch
 
 BuildArch:      noarch