From ebaee915fc410bb90774c64f69262176221c6adc Mon Sep 17 00:00:00 2001 From: eabdullin Date: Mon, 22 Sep 2025 02:35:39 +0000 Subject: [PATCH] import UBI container-selinux-2.237.0-2.el9_6 --- SOURCES/390-backport.patch | 31 +++++++++++++++++++++++++++++++ SOURCES/397-backport.patch | 13 +++++++++++++ SOURCES/405.patch | 24 ++++++++++++++++++++++++ SPECS/container-selinux.spec | 9 ++++++++- 4 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 SOURCES/390-backport.patch create mode 100644 SOURCES/397-backport.patch create mode 100644 SOURCES/405.patch diff --git a/SOURCES/390-backport.patch b/SOURCES/390-backport.patch new file mode 100644 index 0000000..32a60a7 --- /dev/null +++ b/SOURCES/390-backport.patch @@ -0,0 +1,31 @@ +diff -up container-selinux-2.237.0/container.if.390 container-selinux-2.237.0/container.if +--- container-selinux-2.237.0/container.if.390 2025-09-19 06:43:15.414745959 +0200 ++++ container-selinux-2.237.0/container.if 2025-09-19 06:43:44.497131004 +0200 +@@ -19,6 +19,7 @@ interface(`container_runtime_domtrans',` + corecmd_search_bin($1) + domtrans_pattern($1, container_runtime_exec_t, container_runtime_t) + allow container_runtime_t $1:fifo_file setattr; ++ allow $1 container_runtime_t:bpf prog_run; + ') + + ######################################## +diff -up container-selinux-2.237.0/container.te.390 container-selinux-2.237.0/container.te +--- container-selinux-2.237.0/container.te.390 2025-09-19 06:43:22.847356759 +0200 ++++ container-selinux-2.237.0/container.te 2025-09-19 06:43:44.497549682 +0200 +@@ -723,7 +723,7 @@ optional_policy(` + allow unconfined_domain_type { container_var_lib_t container_ro_file_t }:file entrypoint; + fs_fusefs_entrypoint(unconfined_domain_type) + +- domtrans_pattern(unconfined_domain_type, container_runtime_exec_t , container_runtime_t) ++ container_runtime_domtrans(unconfined_domain_type) + ') + + optional_policy(` +@@ -1314,6 +1314,7 @@ container_manage_share_files(init_t) + container_manage_share_dirs(init_t) + container_filetrans_named_content(init_t) + container_runtime_read_tmpfs_files(init_t) ++allow init_t container_runtime_t:bpf prog_run; + + gen_require(` + attribute device_node; diff --git a/SOURCES/397-backport.patch b/SOURCES/397-backport.patch new file mode 100644 index 0000000..00d772e --- /dev/null +++ b/SOURCES/397-backport.patch @@ -0,0 +1,13 @@ +diff -up container-selinux-2.237.0/container.te.397 container-selinux-2.237.0/container.te +--- container-selinux-2.237.0/container.te.397 2025-09-19 06:40:30.384659594 +0200 ++++ container-selinux-2.237.0/container.te 2025-09-19 06:41:40.003332145 +0200 +@@ -1326,6 +1326,9 @@ allow container_domain init_t:unix_strea + + allow container_t proc_t:filesystem remount; + ++# Allow containers to access shared runtime directories for OCI runtime optimizations ++allow container_t container_var_run_t:dir list_dir_perms; ++ + # Container kvm - Policy for running kata containers + container_domain_template(container_kvm, container) + typeattribute container_kvm_t container_net_domain, container_user_domain; diff --git a/SOURCES/405.patch b/SOURCES/405.patch new file mode 100644 index 0000000..e01d7fb --- /dev/null +++ b/SOURCES/405.patch @@ -0,0 +1,24 @@ +From ae3532b16fea57c04de9c1d74a1f1af12066a35a Mon Sep 17 00:00:00 2001 +From: Giuseppe Scrivano +Date: Wed, 10 Sep 2025 15:14:36 +0200 +Subject: [PATCH] container: label /run/user/*/crun as container_var_run_t + +Closes: https://github.com/containers/container-selinux/issues/404 + +Signed-off-by: Giuseppe Scrivano +--- + container.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/container.te b/container.te +index 63ae6bf..fb464f9 100644 +--- a/container.te ++++ b/container.te +@@ -322,6 +322,7 @@ manage_sock_files_pattern(container_runtime_domain, container_var_run_t, contain + manage_lnk_files_pattern(container_runtime_domain, container_var_run_t, container_var_run_t) + files_pid_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) + files_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) ++userdom_user_tmp_filetrans(container_runtime_domain, container_var_run_t, { dir file lnk_file sock_file }) + allow container_runtime_domain container_var_run_t:dir_file_class_set relabelfrom; + + allow container_runtime_domain container_devpts_t:chr_file { relabelfrom rw_chr_file_perms setattr_chr_file_perms }; diff --git a/SPECS/container-selinux.spec b/SPECS/container-selinux.spec index 96661a6..83cc170 100644 --- a/SPECS/container-selinux.spec +++ b/SPECS/container-selinux.spec @@ -36,11 +36,14 @@ Epoch: 4 # to the correct value by Packit for copr and koji builds. # IGNORE this comment if you're looking at it in dist-git. Version: 2.237.0 -Release: 1%{?dist} +Release: 2%{?dist} License: GPL-2.0-only URL: https://github.com/containers/%{name} Summary: SELinux policies for container runtimes Source0: %{url}/archive/v%{version}.tar.gz +Patch0: https://github.com/containers/container-selinux/pull/405.patch +Patch1: https://github.com/containers/container-selinux/pull/397-backport.patch +Patch2: https://github.com/containers/container-selinux/pull/390-backport.patch BuildArch: noarch BuildRequires: make BuildRequires: git-core @@ -138,6 +141,10 @@ if %{_sbindir}/selinuxenabled ; then fi %changelog +* Fri Sep 19 2025 Jindrich Novy - 4:2.237.0-2 +- Update container-selinux package to resolve OCP 4.20 issues +- Resolves: RHEL-115663 + * Wed May 28 2025 Lokesh Mandvekar - 4:2.237.0-1 - bump to v2.237.0 - Related: RHEL-85434