From 6a25dc563496a6633d44d79104f3d79b0714176b Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 19 May 2026 19:11:11 -0400 Subject: [PATCH] import UBI container-selinux-2.246.0-1.el10 --- .gitignore | 2 +- 390-backport.patch | 31 ------------------------------- 397-backport.patch | 13 ------------- 412.patch | 23 ----------------------- container-selinux.spec | 37 +++++++++++++++++++++++++------------ sources | 2 +- 6 files changed, 27 insertions(+), 81 deletions(-) delete mode 100644 390-backport.patch delete mode 100644 397-backport.patch delete mode 100644 412.patch diff --git a/.gitignore b/.gitignore index d5997f2..90a315f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -v2.240.0.tar.gz +v2.246.0.tar.gz diff --git a/390-backport.patch b/390-backport.patch deleted file mode 100644 index 48e608a..0000000 --- a/390-backport.patch +++ /dev/null @@ -1,31 +0,0 @@ -diff -up container-selinux-2.240.0/container.if.390 container-selinux-2.240.0/container.if ---- container-selinux-2.240.0/container.if.390 2025-09-19 07:03:21.827502160 +0200 -+++ container-selinux-2.240.0/container.if 2025-09-19 07:03:35.383197574 +0200 -@@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',` - corecmd_search_bin($1) - domtrans_pattern($1, container_runtime_exec_t, container_runtime_t) - allow container_runtime_t $1:fifo_file setattr; -+ allow $1 container_runtime_t:bpf prog_run; - ') - - ######################################## -diff -up container-selinux-2.240.0/container.te.390 container-selinux-2.240.0/container.te ---- container-selinux-2.240.0/container.te.390 2025-09-19 07:03:25.942964294 +0200 -+++ container-selinux-2.240.0/container.te 2025-09-19 07:04:49.113508085 +0200 -@@ -744,7 +744,7 @@ optional_policy(` - allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint; - fs_fusefs_entrypoint(unconfined_domain_type) - -- domtrans_pattern(unconfined_domain_type, container_runtime_exec_t , container_runtime_t) -+ container_runtime_domtrans(unconfined_domain_type) - ') - - optional_policy(` -@@ -1335,6 +1335,7 @@ container_manage_share_files(init_t) - container_manage_share_dirs(init_t) - container_filetrans_named_content(init_t) - container_runtime_read_tmpfs_files(init_t) -+allow init_t container_runtime_t:bpf prog_run; - - gen_require(` - attribute device_node; diff --git a/397-backport.patch b/397-backport.patch deleted file mode 100644 index 35ab30f..0000000 --- a/397-backport.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff -up container-selinux-2.240.0/container.te.397 container-selinux-2.240.0/container.te ---- container-selinux-2.240.0/container.te.397 2025-09-19 07:01:45.736869927 +0200 -+++ container-selinux-2.240.0/container.te 2025-09-19 07:02:11.869541486 +0200 -@@ -1347,6 +1347,9 @@ allow container_domain init_t:unix_strea - - allow container_t proc_t:filesystem remount; - -+# Allow containers to access shared runtime directories for OCI runtime optimizations -+allow container_t container_var_run_t:dir list_dir_perms; -+ - # Container kvm - Policy for running kata containers - container_domain_template(container_kvm, container) - typeattribute container_kvm_t container_net_domain, container_user_domain; diff --git a/412.patch b/412.patch deleted file mode 100644 index 3a6e4f7..0000000 --- a/412.patch +++ /dev/null @@ -1,23 +0,0 @@ -From d27647a022f01aa5f847383878cf67c616a5d98e Mon Sep 17 00:00:00 2001 -From: Peter Hunt -Date: Fri, 7 Nov 2025 10:27:32 -0500 -Subject: [PATCH] container_engine_t: add necessary permissions to ssh in - userns container - -Signed-off-by: Peter Hunt ---- - container.te | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/container.te b/container.te -index 63ae6bf..3af1b2b 100644 ---- a/container.te -+++ b/container.te -@@ -1487,6 +1487,7 @@ allow container_engine_t kernel_t:system module_request; - allow container_engine_t null_device_t:chr_file { mounton setattr_chr_file_perms }; - allow container_engine_t random_device_t:chr_file mounton; - allow container_engine_t self:netlink_tcpdiag_socket nlmsg_read; -+allow container_engine_t self:netlink_audit_socket nlmsg_relay; - allow container_engine_t urandom_device_t:chr_file mounton; - allow container_engine_t zero_device_t:chr_file mounton; - allow container_engine_t container_file_t:sock_file mounton; diff --git a/container-selinux.spec b/container-selinux.spec index c630a87..58d4cb1 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -1,4 +1,4 @@ -%global debug_package %{nil} +%global debug_package %{nil} # container-selinux stuff (prefix with ds_ for version/release etc.) # Some bits borrowed from the openstack-selinux package @@ -35,15 +35,12 @@ Epoch: 4 # Keep Version in upstream specfile at 0. It will be automatically set # to the correct value by Packit for copr and koji builds. # IGNORE this comment if you're looking at it in dist-git. -Version: 2.240.0 -Release: 10%{?dist} +Version: 2.246.0 +Release: 1%{?dist} License: GPL-2.0-only URL: https://github.com/containers/%{name} Summary: SELinux policies for container runtimes Source0: %{url}/archive/v%{version}.tar.gz -Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch -Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch -Patch3: https://patch-diff.githubusercontent.com/raw/containers/container-selinux/pull/412.patch BuildArch: noarch BuildRequires: make BuildRequires: git-core @@ -114,12 +111,12 @@ fi %posttrans %selinux_relabel_post -# Empty placeholder check to silence rpmlint -%check - #define license tag if not already defined %{!?_licensedir:%global license %doc} +# Placeholder check to silence rpmlint +%check + %files %doc README.md %{_datadir}/selinux/* @@ -141,9 +138,25 @@ if %{_sbindir}/selinuxenabled ; then fi %changelog -* Wed Feb 25 2026 Jindrich Novy - 4:2.240.0-10 -- sync with 9.7.z -- Resolves: RHEL-151428 +* Thu Feb 19 2026 Jindrich Novy - 4:2.246.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.246.0 +- Resolves: RHEL-143694 + +* Tue Feb 03 2026 Jindrich Novy - 4:2.245.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.245.0 +- Related: RHEL-122178 + +* Thu Dec 11 2025 Jindrich Novy - 4:2.244.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.244.0 +- Resolves: RHEL-111947 + +* Fri Sep 12 2025 Jindrich Novy - 4:2.242.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.242.0 +- Related: RHEL-111917 + +* Fri Aug 29 2025 Jindrich Novy - 4:2.241.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.241.0 +- Resolves: RHEL-111947 * Mon Aug 11 2025 Jindrich Novy - 4:2.240.0-1 - update to https://github.com/containers/container-selinux/releases/tag/v2.240.0 diff --git a/sources b/sources index 64f44ff..6be295f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v2.240.0.tar.gz) = d5077aa547c2d85613eb168348fe01d92c198b72f3d3523c90d587f12ff8d221c9ee63da1ed1d7201f592853e1aa77406d10b751a0cd7ba9203ea0a22fea3f9b +SHA512 (v2.246.0.tar.gz) = 7f3542a116aa92281e712b5e3426725d5a995fff837579db73d863a219c49ad98d0e285ac639d4533dc0935f491e27d8da73df306eefd4e8cad4c03fbf0075c4