import UBI container-selinux-2.246.0-1.el10
This commit is contained in:
AlmaLinux RelEng Bot
parent
c5ae39360d
commit
6a25dc5634
2
.gitignore
vendored
2
.gitignore
vendored
@ -1 +1 @@
|
||||
v2.240.0.tar.gz
|
||||
v2.246.0.tar.gz
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
diff -up container-selinux-2.240.0/container.if.390 container-selinux-2.240.0/container.if
|
||||
--- container-selinux-2.240.0/container.if.390 2025-09-19 07:03:21.827502160 +0200
|
||||
+++ container-selinux-2.240.0/container.if 2025-09-19 07:03:35.383197574 +0200
|
||||
@@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',`
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, container_runtime_exec_t, container_runtime_t)
|
||||
allow container_runtime_t $1:fifo_file setattr;
|
||||
+ allow $1 container_runtime_t:bpf prog_run;
|
||||
')
|
||||
|
||||
########################################
|
||||
diff -up container-selinux-2.240.0/container.te.390 container-selinux-2.240.0/container.te
|
||||
--- container-selinux-2.240.0/container.te.390 2025-09-19 07:03:25.942964294 +0200
|
||||
+++ container-selinux-2.240.0/container.te 2025-09-19 07:04:49.113508085 +0200
|
||||
@@ -744,7 +744,7 @@ optional_policy(`
|
||||
allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint;
|
||||
fs_fusefs_entrypoint(unconfined_domain_type)
|
||||
|
||||
- domtrans_pattern(unconfined_domain_type, container_runtime_exec_t , container_runtime_t)
|
||||
+ container_runtime_domtrans(unconfined_domain_type)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -1335,6 +1335,7 @@ container_manage_share_files(init_t)
|
||||
container_manage_share_dirs(init_t)
|
||||
container_filetrans_named_content(init_t)
|
||||
container_runtime_read_tmpfs_files(init_t)
|
||||
+allow init_t container_runtime_t:bpf prog_run;
|
||||
|
||||
gen_require(`
|
||||
attribute device_node;
|
||||
@ -1,13 +0,0 @@
|
||||
diff -up container-selinux-2.240.0/container.te.397 container-selinux-2.240.0/container.te
|
||||
--- container-selinux-2.240.0/container.te.397 2025-09-19 07:01:45.736869927 +0200
|
||||
+++ container-selinux-2.240.0/container.te 2025-09-19 07:02:11.869541486 +0200
|
||||
@@ -1347,6 +1347,9 @@ allow container_domain init_t:unix_strea
|
||||
|
||||
allow container_t proc_t:filesystem remount;
|
||||
|
||||
+# Allow containers to access shared runtime directories for OCI runtime optimizations
|
||||
+allow container_t container_var_run_t:dir list_dir_perms;
|
||||
+
|
||||
# Container kvm - Policy for running kata containers
|
||||
container_domain_template(container_kvm, container)
|
||||
typeattribute container_kvm_t container_net_domain, container_user_domain;
|
||||
23
412.patch
23
412.patch
@ -1,23 +0,0 @@
|
||||
From d27647a022f01aa5f847383878cf67c616a5d98e Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hunt <pehunt@redhat.com>
|
||||
Date: Fri, 7 Nov 2025 10:27:32 -0500
|
||||
Subject: [PATCH] container_engine_t: add necessary permissions to ssh in
|
||||
userns container
|
||||
|
||||
Signed-off-by: Peter Hunt <pehunt@redhat.com>
|
||||
---
|
||||
container.te | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/container.te b/container.te
|
||||
index 63ae6bf..3af1b2b 100644
|
||||
--- a/container.te
|
||||
+++ b/container.te
|
||||
@@ -1487,6 +1487,7 @@ allow container_engine_t kernel_t:system module_request;
|
||||
allow container_engine_t null_device_t:chr_file { mounton setattr_chr_file_perms };
|
||||
allow container_engine_t random_device_t:chr_file mounton;
|
||||
allow container_engine_t self:netlink_tcpdiag_socket nlmsg_read;
|
||||
+allow container_engine_t self:netlink_audit_socket nlmsg_relay;
|
||||
allow container_engine_t urandom_device_t:chr_file mounton;
|
||||
allow container_engine_t zero_device_t:chr_file mounton;
|
||||
allow container_engine_t container_file_t:sock_file mounton;
|
||||
@ -1,4 +1,4 @@
|
||||
%global debug_package %{nil}
|
||||
%global debug_package %{nil}
|
||||
|
||||
# container-selinux stuff (prefix with ds_ for version/release etc.)
|
||||
# Some bits borrowed from the openstack-selinux package
|
||||
@ -35,15 +35,12 @@ Epoch: 4
|
||||
# Keep Version in upstream specfile at 0. It will be automatically set
|
||||
# to the correct value by Packit for copr and koji builds.
|
||||
# IGNORE this comment if you're looking at it in dist-git.
|
||||
Version: 2.240.0
|
||||
Release: 10%{?dist}
|
||||
Version: 2.246.0
|
||||
Release: 1%{?dist}
|
||||
License: GPL-2.0-only
|
||||
URL: https://github.com/containers/%{name}
|
||||
Summary: SELinux policies for container runtimes
|
||||
Source0: %{url}/archive/v%{version}.tar.gz
|
||||
Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch
|
||||
Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch
|
||||
Patch3: https://patch-diff.githubusercontent.com/raw/containers/container-selinux/pull/412.patch
|
||||
BuildArch: noarch
|
||||
BuildRequires: make
|
||||
BuildRequires: git-core
|
||||
@ -114,12 +111,12 @@ fi
|
||||
%posttrans
|
||||
%selinux_relabel_post
|
||||
|
||||
# Empty placeholder check to silence rpmlint
|
||||
%check
|
||||
|
||||
#define license tag if not already defined
|
||||
%{!?_licensedir:%global license %doc}
|
||||
|
||||
# Placeholder check to silence rpmlint
|
||||
%check
|
||||
|
||||
%files
|
||||
%doc README.md
|
||||
%{_datadir}/selinux/*
|
||||
@ -141,9 +138,25 @@ if %{_sbindir}/selinuxenabled ; then
|
||||
fi
|
||||
|
||||
%changelog
|
||||
* Wed Feb 25 2026 Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-10
|
||||
- sync with 9.7.z
|
||||
- Resolves: RHEL-151428
|
||||
* Thu Feb 19 2026 Jindrich Novy <jnovy@redhat.com> - 4:2.246.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.246.0
|
||||
- Resolves: RHEL-143694
|
||||
|
||||
* Tue Feb 03 2026 Jindrich Novy <jnovy@redhat.com> - 4:2.245.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.245.0
|
||||
- Related: RHEL-122178
|
||||
|
||||
* Thu Dec 11 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.244.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.244.0
|
||||
- Resolves: RHEL-111947
|
||||
|
||||
* Fri Sep 12 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.242.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.242.0
|
||||
- Related: RHEL-111917
|
||||
|
||||
* Fri Aug 29 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.241.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.241.0
|
||||
- Resolves: RHEL-111947
|
||||
|
||||
* Mon Aug 11 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-1
|
||||
- update to https://github.com/containers/container-selinux/releases/tag/v2.240.0
|
||||
|
||||
2
sources
2
sources
@ -1 +1 @@
|
||||
SHA512 (v2.240.0.tar.gz) = d5077aa547c2d85613eb168348fe01d92c198b72f3d3523c90d587f12ff8d221c9ee63da1ed1d7201f592853e1aa77406d10b751a0cd7ba9203ea0a22fea3f9b
|
||||
SHA512 (v2.246.0.tar.gz) = 7f3542a116aa92281e712b5e3426725d5a995fff837579db73d863a219c49ad98d0e285ac639d4533dc0935f491e27d8da73df306eefd4e8cad4c03fbf0075c4
|
||||
|
||||
Loading…
Reference in New Issue
Block a user