rpms/container-selinux
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI container-selinux-2.240.0-3.el9_7

Browse Source
This commit is contained in:
eabdullin 2025-11-11 16:11:20 +00:00
parent ebaee915fc
commit be9409e790
6 changed files with 52 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.container-selinux.metadata
View File

@ -1 +1 @@
75de51da8ad54abacd3e5b4da2d6df5510560f04 SOURCES/v2.237.0.tar.gz
bb8157f7ea50a7da2f9f404f22f10f11a8b1b4b0 SOURCES/v2.240.0.tar.gz

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/v2.237.0.tar.gz
SOURCES/v2.240.0.tar.gz

16
SOURCES/390-backport.patch
View File

@ -1,6 +1,6 @@
diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/container.if
--- container-selinux-2.237.0/container.if.390 2025-09-19 06:43:15.414745959 +0200
+++ container-selinux-2.237.0/container.if 2025-09-19 06:43:44.497131004 +0200
diff -up container-selinux-2.240.0/container.if.390 container-selinux-2.240.0/container.if
--- container-selinux-2.240.0/container.if.390 2025-09-19 07:03:21.827502160 +0200
+++ container-selinux-2.240.0/container.if 2025-09-19 07:03:35.383197574 +0200
@@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',`
corecmd_search_bin($1)
domtrans_pattern($1, container_runtime_exec_t, container_runtime_t)
@ -9,10 +9,10 @@ diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/co
')
########################################
diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/container.te
--- container-selinux-2.237.0/container.te.390 2025-09-19 06:43:22.847356759 +0200
+++ container-selinux-2.237.0/container.te 2025-09-19 06:43:44.497549682 +0200
@@ -723,7 +723,7 @@ optional_policy(`
diff -up container-selinux-2.240.0/container.te.390 container-selinux-2.240.0/container.te
--- container-selinux-2.240.0/container.te.390 2025-09-19 07:03:25.942964294 +0200
+++ container-selinux-2.240.0/container.te 2025-09-19 07:04:49.113508085 +0200
@@ -744,7 +744,7 @@ optional_policy(`
allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint;
fs_fusefs_entrypoint(unconfined_domain_type)
@ -21,7 +21,7 @@ diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/co
')
optional_policy(`
@@ -1314,6 +1314,7 @@ container_manage_share_files(init_t)
@@ -1335,6 +1335,7 @@ container_manage_share_files(init_t)
container_manage_share_dirs(init_t)
container_filetrans_named_content(init_t)
container_runtime_read_tmpfs_files(init_t)

8
SOURCES/397-backport.patch
View File

@ -1,7 +1,7 @@
diff -up container-selinux-2.237.0/container.te.397 container-selinux-2.237.0/container.te
--- container-selinux-2.237.0/container.te.397 2025-09-19 06:40:30.384659594 +0200
+++ container-selinux-2.237.0/container.te 2025-09-19 06:41:40.003332145 +0200
@@ -1326,6 +1326,9 @@ allow container_domain init_t:unix_strea
diff -up container-selinux-2.240.0/container.te.397 container-selinux-2.240.0/container.te
--- container-selinux-2.240.0/container.te.397 2025-09-19 07:01:45.736869927 +0200
+++ container-selinux-2.240.0/container.te 2025-09-19 07:02:11.869541486 +0200
@@ -1347,6 +1347,9 @@ allow container_domain init_t:unix_strea
allow container_t proc_t:filesystem remount;

24
SOURCES/405.patch
View File

@ -1,24 +0,0 @@
From ae3532b16fea57c04de9c1d74a1f1af12066a35a Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Wed, 10 Sep 2025 15:14:36 +0200
Subject: [PATCH] container: label /run/user/*/crun as container_var_run_t
Closes: https://github.com/containers/container-selinux/issues/404
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
container.te | 1 +
1 file changed, 1 insertion(+)
diff --git a/container.te b/container.te
index 63ae6bf..fb464f9 100644
--- a/container.te
+++ b/container.te
@@ -322,6 +322,7 @@ manage_sock_files_pattern(container_runtime_domain, container_var_run_t, contain
manage_lnk_files_pattern(container_runtime_domain, container_var_run_t, container_var_run_t)
files_pid_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
files_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
+userdom_user_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
allow container_runtime_domain container_var_run_t:dir_file_class_set relabelfrom;
allow container_runtime_domain container_devpts_t:chr_file { relabelfrom rw_chr_file_perms setattr_chr_file_perms };

56
SPECS/container-selinux.spec
View File

@ -35,13 +35,12 @@ Epoch: 4
# Keep Version in upstream specfile at 0. It will be automatically set
# to the correct value by Packit for copr and koji builds.
# IGNORE this comment if you're looking at it in dist-git.
Version: 2.237.0
Release: 2%{?dist}
Version: 2.240.0
Release: 3%{?dist}
License: GPL-2.0-only
URL: https://github.com/containers/%{name}
Summary: SELinux policies for container runtimes
Source0: %{url}/archive/v%{version}.tar.gz
Patch0: https://github.com/containers/container-selinux/pull/405.patch
Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch
Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch
BuildArch: noarch
@ -114,19 +113,19 @@ fi
%posttrans
%selinux_relabel_post
#define license tag if not already defined
%{!?_licensedir:%global license %doc}
# Empty placeholder check to silence rpmlint
%check
#define license tag if not already defined
%{!?_licensedir:%global license %doc}
%files
%doc README.md
%{_datadir}/selinux/*
%dir %{_datadir}/containers/selinux
%{_datadir}/containers/selinux/contexts
%dir %{_datadir}/udica/templates/
%dir %{_datadir}/udica
%dir %{_datadir}/udica/templates/
%{_datadir}/udica/templates/*
# Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2209120
%{_mandir}/man8/container_selinux.8.gz
@ -141,21 +140,42 @@ if %{_sbindir}/selinuxenabled ; then
fi
%changelog
* Fri Sep 19 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.237.0-2
* Fri Oct 24 2025 Lokesh Mandvekar <lsm5@redhat.com> - 4:2.240.0-3
- Delete 405.patch. This was reverted upstream. If it's needed for OCP, this
can be revisited.
- Resolves: RHEL-123749
* Fri Sep 19 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-2
- Update container-selinux package to resolve OCP 4.20 issues
- Resolves: RHEL-115663
- Resolves: RHEL-115180
* Wed May 28 2025 Lokesh Mandvekar <lsm5@redhat.com> - 4:2.237.0-1
- bump to v2.237.0
- Related: RHEL-85434
* Mon Aug 11 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.240.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.240.0
- Related: RHEL-80816
* Mon Apr 07 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.235.0-2
- rebuild
- Related: RHEL-85434
* Mon Jul 14 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.239.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.239.0
- Related: RHEL-80816
* Mon Mar 31 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.235.0-1
* Mon Jun 02 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.238.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.238.0
- Related: RHEL-80816
* Wed Apr 30 2025 Jindrich Novy <jnovy@redhat.com> - 3:2.237.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.237.0
- Related: RHEL-80816
* Fri Mar 14 2025 Jindrich Novy <jnovy@redhat.com> - 3:2.236.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.236.0
- Resolves: RHEL-80473
* Tue Mar 04 2025 Lokesh Mandvekar <lsm5@redhat.com> - 3:2.235.0-2
- sync TMT tests and plan from upstream
- Resolves: RHEL-80816
* Mon Feb 24 2025 Jindrich Novy <jnovy@redhat.com> - 3:2.235.0-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.235.0
- Resolves: RHEL-85434
- Resolves: RHEL-80473
* Wed Nov 27 2024 Jindrich Novy <jnovy@redhat.com> - 3:2.234.2-1
- update to https://github.com/containers/container-selinux/releases/tag/v2.234.2
@ -544,7 +564,7 @@ to spc_t even when setup with nosuid.
- Label overlay directories under /var/lib/containers/ correctly
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.61-1
- Allow spc_t to load kernel modules from inside of container
- Allow spc_t to load kernel modules from inside of container
* Mon May 21 2018 Dan Walsh <dwalsh@fedoraproject.org> - 2.60-1
- Allow containers to list cgroup directories