import UBI container-selinux-2.237.0-2.el9_6
This commit is contained in:
parent
6299765edf
commit
ebaee915fc
31
SOURCES/390-backport.patch
Normal file
31
SOURCES/390-backport.patch
Normal file
@ -0,0 +1,31 @@
|
||||
diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/container.if
|
||||
--- container-selinux-2.237.0/container.if.390 2025-09-19 06:43:15.414745959 +0200
|
||||
+++ container-selinux-2.237.0/container.if 2025-09-19 06:43:44.497131004 +0200
|
||||
@@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',`
|
||||
corecmd_search_bin($1)
|
||||
domtrans_pattern($1, container_runtime_exec_t, container_runtime_t)
|
||||
allow container_runtime_t $1:fifo_file setattr;
|
||||
+ allow $1 container_runtime_t:bpf prog_run;
|
||||
')
|
||||
|
||||
########################################
|
||||
diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/container.te
|
||||
--- container-selinux-2.237.0/container.te.390 2025-09-19 06:43:22.847356759 +0200
|
||||
+++ container-selinux-2.237.0/container.te 2025-09-19 06:43:44.497549682 +0200
|
||||
@@ -723,7 +723,7 @@ optional_policy(`
|
||||
allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint;
|
||||
fs_fusefs_entrypoint(unconfined_domain_type)
|
||||
|
||||
- domtrans_pattern(unconfined_domain_type, container_runtime_exec_t , container_runtime_t)
|
||||
+ container_runtime_domtrans(unconfined_domain_type)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
@@ -1314,6 +1314,7 @@ container_manage_share_files(init_t)
|
||||
container_manage_share_dirs(init_t)
|
||||
container_filetrans_named_content(init_t)
|
||||
container_runtime_read_tmpfs_files(init_t)
|
||||
+allow init_t container_runtime_t:bpf prog_run;
|
||||
|
||||
gen_require(`
|
||||
attribute device_node;
|
||||
13
SOURCES/397-backport.patch
Normal file
13
SOURCES/397-backport.patch
Normal file
@ -0,0 +1,13 @@
|
||||
diff -up container-selinux-2.237.0/container.te.397 container-selinux-2.237.0/container.te
|
||||
--- container-selinux-2.237.0/container.te.397 2025-09-19 06:40:30.384659594 +0200
|
||||
+++ container-selinux-2.237.0/container.te 2025-09-19 06:41:40.003332145 +0200
|
||||
@@ -1326,6 +1326,9 @@ allow container_domain init_t:unix_strea
|
||||
|
||||
allow container_t proc_t:filesystem remount;
|
||||
|
||||
+# Allow containers to access shared runtime directories for OCI runtime optimizations
|
||||
+allow container_t container_var_run_t:dir list_dir_perms;
|
||||
+
|
||||
# Container kvm - Policy for running kata containers
|
||||
container_domain_template(container_kvm, container)
|
||||
typeattribute container_kvm_t container_net_domain, container_user_domain;
|
||||
24
SOURCES/405.patch
Normal file
24
SOURCES/405.patch
Normal file
@ -0,0 +1,24 @@
|
||||
From ae3532b16fea57c04de9c1d74a1f1af12066a35a Mon Sep 17 00:00:00 2001
|
||||
From: Giuseppe Scrivano <gscrivan@redhat.com>
|
||||
Date: Wed, 10 Sep 2025 15:14:36 +0200
|
||||
Subject: [PATCH] container: label /run/user/*/crun as container_var_run_t
|
||||
|
||||
Closes: https://github.com/containers/container-selinux/issues/404
|
||||
|
||||
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
|
||||
---
|
||||
container.te | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/container.te b/container.te
|
||||
index 63ae6bf..fb464f9 100644
|
||||
--- a/container.te
|
||||
+++ b/container.te
|
||||
@@ -322,6 +322,7 @@ manage_sock_files_pattern(container_runtime_domain, container_var_run_t, contain
|
||||
manage_lnk_files_pattern(container_runtime_domain, container_var_run_t, container_var_run_t)
|
||||
files_pid_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
|
||||
files_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
|
||||
+userdom_user_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file })
|
||||
allow container_runtime_domain container_var_run_t:dir_file_class_set relabelfrom;
|
||||
|
||||
allow container_runtime_domain container_devpts_t:chr_file { relabelfrom rw_chr_file_perms setattr_chr_file_perms };
|
||||
@ -36,11 +36,14 @@ Epoch: 4
|
||||
# to the correct value by Packit for copr and koji builds.
|
||||
# IGNORE this comment if you're looking at it in dist-git.
|
||||
Version: 2.237.0
|
||||
Release: 1%{?dist}
|
||||
Release: 2%{?dist}
|
||||
License: GPL-2.0-only
|
||||
URL: https://github.com/containers/%{name}
|
||||
Summary: SELinux policies for container runtimes
|
||||
Source0: %{url}/archive/v%{version}.tar.gz
|
||||
Patch0: https://github.com/containers/container-selinux/pull/405.patch
|
||||
Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch
|
||||
Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch
|
||||
BuildArch: noarch
|
||||
BuildRequires: make
|
||||
BuildRequires: git-core
|
||||
@ -138,6 +141,10 @@ if %{_sbindir}/selinuxenabled ; then
|
||||
fi
|
||||
|
||||
%changelog
|
||||
* Fri Sep 19 2025 Jindrich Novy <jnovy@redhat.com> - 4:2.237.0-2
|
||||
- Update container-selinux package to resolve OCP 4.20 issues
|
||||
- Resolves: RHEL-115663
|
||||
|
||||
* Wed May 28 2025 Lokesh Mandvekar <lsm5@redhat.com> - 4:2.237.0-1
|
||||
- bump to v2.237.0
|
||||
- Related: RHEL-85434
|
||||
|
||||
Loading…
Reference in New Issue
Block a user