From be9409e7900f8ffbce3d721be8f6b0d36595efdd Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 11 Nov 2025 16:11:20 +0000 Subject: [PATCH] import UBI container-selinux-2.240.0-3.el9_7 --- .container-selinux.metadata | 2 +- .gitignore | 2 +- SOURCES/390-backport.patch | 16 +++++------ SOURCES/397-backport.patch | 8 +++--- SOURCES/405.patch | 24 ---------------- SPECS/container-selinux.spec | 56 ++++++++++++++++++++++++------------ 6 files changed, 52 insertions(+), 56 deletions(-) delete mode 100644 SOURCES/405.patch diff --git a/.container-selinux.metadata b/.container-selinux.metadata index d4fa3e0..9eda71e 100644 --- a/.container-selinux.metadata +++ b/.container-selinux.metadata @@ -1 +1 @@ -75de51da8ad54abacd3e5b4da2d6df5510560f04 SOURCES/v2.237.0.tar.gz +bb8157f7ea50a7da2f9f404f22f10f11a8b1b4b0 SOURCES/v2.240.0.tar.gz diff --git a/.gitignore b/.gitignore index 567580c..998a580 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/v2.237.0.tar.gz +SOURCES/v2.240.0.tar.gz diff --git a/SOURCES/390-backport.patch b/SOURCES/390-backport.patch index 32a60a7..48e608a 100644 --- a/SOURCES/390-backport.patch +++ b/SOURCES/390-backport.patch @@ -1,6 +1,6 @@ -diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/container.if ---- container-selinux-2.237.0/container.if.390 2025-09-19 06:43:15.414745959 +0200 -+++ container-selinux-2.237.0/container.if 2025-09-19 06:43:44.497131004 +0200 +diff -up container-selinux-2.240.0/container.if.390 container-selinux-2.240.0/container.if +--- container-selinux-2.240.0/container.if.390 2025-09-19 07:03:21.827502160 +0200 ++++ container-selinux-2.240.0/container.if 2025-09-19 07:03:35.383197574 +0200 @@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',` corecmd_search_bin($1) domtrans_pattern($1, container_runtime_exec_t, container_runtime_t) @@ -9,10 +9,10 @@ diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/co ') ######################################## -diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/container.te ---- container-selinux-2.237.0/container.te.390 2025-09-19 06:43:22.847356759 +0200 -+++ container-selinux-2.237.0/container.te 2025-09-19 06:43:44.497549682 +0200 -@@ -723,7 +723,7 @@ optional_policy(` +diff -up container-selinux-2.240.0/container.te.390 container-selinux-2.240.0/container.te +--- container-selinux-2.240.0/container.te.390 2025-09-19 07:03:25.942964294 +0200 ++++ container-selinux-2.240.0/container.te 2025-09-19 07:04:49.113508085 +0200 +@@ -744,7 +744,7 @@ optional_policy(` allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint; fs_fusefs_entrypoint(unconfined_domain_type) @@ -21,7 +21,7 @@ diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/co ') optional_policy(` -@@ -1314,6 +1314,7 @@ container_manage_share_files(init_t) +@@ -1335,6 +1335,7 @@ container_manage_share_files(init_t) container_manage_share_dirs(init_t) container_filetrans_named_content(init_t) container_runtime_read_tmpfs_files(init_t) diff --git a/SOURCES/397-backport.patch b/SOURCES/397-backport.patch index 00d772e..35ab30f 100644 --- a/SOURCES/397-backport.patch +++ b/SOURCES/397-backport.patch @@ -1,7 +1,7 @@ -diff -up container-selinux-2.237.0/container.te.397 container-selinux-2.237.0/container.te ---- container-selinux-2.237.0/container.te.397 2025-09-19 06:40:30.384659594 +0200 -+++ container-selinux-2.237.0/container.te 2025-09-19 06:41:40.003332145 +0200 -@@ -1326,6 +1326,9 @@ allow container_domain init_t:unix_strea +diff -up container-selinux-2.240.0/container.te.397 container-selinux-2.240.0/container.te +--- container-selinux-2.240.0/container.te.397 2025-09-19 07:01:45.736869927 +0200 ++++ container-selinux-2.240.0/container.te 2025-09-19 07:02:11.869541486 +0200 +@@ -1347,6 +1347,9 @@ allow container_domain init_t:unix_strea allow container_t proc_t:filesystem remount; diff --git a/SOURCES/405.patch b/SOURCES/405.patch deleted file mode 100644 index e01d7fb..0000000 --- a/SOURCES/405.patch +++ /dev/null @@ -1,24 +0,0 @@ -From ae3532b16fea57c04de9c1d74a1f1af12066a35a Mon Sep 17 00:00:00 2001 -From: Giuseppe Scrivano -Date: Wed, 10 Sep 2025 15:14:36 +0200 -Subject: [PATCH] container: label /run/user/*/crun as container_var_run_t - -Closes: https://github.com/containers/container-selinux/issues/404 - -Signed-off-by: Giuseppe Scrivano ---- - container.te | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/container.te b/container.te -index 63ae6bf..fb464f9 100644 ---- a/container.te -+++ b/container.te -@@ -322,6 +322,7 @@ manage_sock_files_pattern(container_runtime_domain, container_var_run_t, contain - manage_lnk_files_pattern(container_runtime_domain, container_var_run_t, container_var_run_t) - files_pid_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) - files_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) -+userdom_user_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) - allow container_runtime_domain container_var_run_t:dir_file_class_set relabelfrom; - - allow container_runtime_domain container_devpts_t:chr_file { relabelfrom rw_chr_file_perms setattr_chr_file_perms }; diff --git a/SPECS/container-selinux.spec b/SPECS/container-selinux.spec index 83cc170..11ae22a 100644 --- a/SPECS/container-selinux.spec +++ b/SPECS/container-selinux.spec @@ -35,13 +35,12 @@ Epoch: 4 # Keep Version in upstream specfile at 0. It will be automatically set # to the correct value by Packit for copr and koji builds. # IGNORE this comment if you're looking at it in dist-git. -Version: 2.237.0 -Release: 2%{?dist} +Version: 2.240.0 +Release: 3%{?dist} License: GPL-2.0-only URL: https://github.com/containers/%{name} Summary: SELinux policies for container runtimes Source0: %{url}/archive/v%{version}.tar.gz -Patch0: https://github.com/containers/container-selinux/pull/405.patch Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch BuildArch: noarch @@ -114,19 +113,19 @@ fi %posttrans %selinux_relabel_post -#define license tag if not already defined -%{!?_licensedir:%global license %doc} - # Empty placeholder check to silence rpmlint %check +#define license tag if not already defined +%{!?_licensedir:%global license %doc} + %files %doc README.md %{_datadir}/selinux/* %dir %{_datadir}/containers/selinux %{_datadir}/containers/selinux/contexts -%dir %{_datadir}/udica/templates/ %dir %{_datadir}/udica +%dir %{_datadir}/udica/templates/ %{_datadir}/udica/templates/* # Ref: https://bugzilla.redhat.com/show_bug.cgi?id=2209120 %{_mandir}/man8/container_selinux.8.gz @@ -141,21 +140,42 @@ if %{_sbindir}/selinuxenabled ; then fi %changelog -* Fri Sep 19 2025 Jindrich Novy - 4:2.237.0-2 +* Fri Oct 24 2025 Lokesh Mandvekar - 4:2.240.0-3 +- Delete 405.patch. This was reverted upstream. If it's needed for OCP, this +can be revisited. +- Resolves: RHEL-123749 + +* Fri Sep 19 2025 Jindrich Novy - 4:2.240.0-2 - Update container-selinux package to resolve OCP 4.20 issues -- Resolves: RHEL-115663 +- Resolves: RHEL-115180 -* Wed May 28 2025 Lokesh Mandvekar - 4:2.237.0-1 -- bump to v2.237.0 -- Related: RHEL-85434 +* Mon Aug 11 2025 Jindrich Novy - 4:2.240.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.240.0 +- Related: RHEL-80816 -* Mon Apr 07 2025 Jindrich Novy - 4:2.235.0-2 -- rebuild -- Related: RHEL-85434 +* Mon Jul 14 2025 Jindrich Novy - 4:2.239.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.239.0 +- Related: RHEL-80816 -* Mon Mar 31 2025 Jindrich Novy - 4:2.235.0-1 +* Mon Jun 02 2025 Jindrich Novy - 4:2.238.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.238.0 +- Related: RHEL-80816 + +* Wed Apr 30 2025 Jindrich Novy - 3:2.237.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.237.0 +- Related: RHEL-80816 + +* Fri Mar 14 2025 Jindrich Novy - 3:2.236.0-1 +- update to https://github.com/containers/container-selinux/releases/tag/v2.236.0 +- Resolves: RHEL-80473 + +* Tue Mar 04 2025 Lokesh Mandvekar - 3:2.235.0-2 +- sync TMT tests and plan from upstream +- Resolves: RHEL-80816 + +* Mon Feb 24 2025 Jindrich Novy - 3:2.235.0-1 - update to https://github.com/containers/container-selinux/releases/tag/v2.235.0 -- Resolves: RHEL-85434 +- Resolves: RHEL-80473 * Wed Nov 27 2024 Jindrich Novy - 3:2.234.2-1 - update to https://github.com/containers/container-selinux/releases/tag/v2.234.2 @@ -544,7 +564,7 @@ to spc_t even when setup with nosuid. - Label overlay directories under /var/lib/containers/ correctly * Mon May 21 2018 Dan Walsh - 2.61-1 -- Allow spc_t to load kernel modules from inside of container +- Allow spc_t to load kernel modules from inside of container * Mon May 21 2018 Dan Walsh - 2.60-1 - Allow containers to list cgroup directories