diff --git a/.gitignore b/.gitignore index 4b4559b..c1fb5dc 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,7 @@ /fapolicyd-1.4.1.tar.gz.asc /fapolicyd-1.4.2.tar.gz /fapolicyd-1.4.2.tar.gz.asc +/fapolicyd-1.4.3.tar.gz +/fapolicyd-1.4.3.tar.gz.asc +/fapolicyd-selinux-1.1.tar.gz +/fapolicyd-selinux-1.1.tar.gz.asc diff --git a/0100-Improve-install-process.patch b/0100-Improve-install-process.patch deleted file mode 100644 index d049cf1..0000000 --- a/0100-Improve-install-process.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 39acf75fff8fa706e75ef512a81e7b1850bfa0c4 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Thu, 6 Nov 2025 16:36:28 +0100 -Subject: [PATCH] Improve install process -Content-type: text/plain - -- install fapolicyd-hardening.cil together with fapolicyd.pp.bz2 -- follow the guidelines and install interface file to - ${SHAREDIR}/selinux/devel/include/distributed see - https://fedoraproject.org/wiki/SELinux/IndependentPolicy#Using_custom_interfaces ---- - Makefile | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/fapolicyd-selinux-1.0/Makefile b/fapolicyd-selinux-1.0/Makefile -index b3dcfefca061..9fe67f3a2a7c 100644 ---- a/fapolicyd-selinux-1.0/Makefile -+++ b/fapolicyd-selinux-1.0/Makefile -@@ -39,6 +39,7 @@ install-policy: all - - install: man - install -D -m 644 ${TARGETS}.pp.bz2 ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}.pp.bz2 -- install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/services/${TARGETS}.if -+ install -D -m 644 ${TARGETS}-hardening.cil ${DESTDIR}${SHAREDIR}/selinux/packages/${TARGETS}-hardening.cil -+ install -D -m 644 ${TARGETS}.if ${DESTDIR}${SHAREDIR}/selinux/devel/include/distributed/${TARGETS}.if - install -D -m 644 ${TARGETS}_selinux.8 ${DESTDIR}${SHAREDIR}/man/man8/ - --- -2.51.1 - diff --git a/0101-fapolicyd-hardening-do-not-block-sigkill.patch b/0101-fapolicyd-hardening-do-not-block-sigkill.patch deleted file mode 100644 index e11fe10..0000000 --- a/0101-fapolicyd-hardening-do-not-block-sigkill.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 4c2726089b690fb1313057c15584c927c064acda Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Fri, 7 Nov 2025 15:15:09 +0100 -Subject: [PATCH] fapolicyd-hardening: do not block sigkill -Content-type: text/plain - -SIGKILL does not cause the system hang. - -SIGKILL can't be blocked or ignored by fapolicyd. Also SIGKILL is used -by systemd to forcibly terminate service when they don't stop after -timeout. - -Signed-off-by: Petr Lautrbach ---- - fapolicyd-hardening.cil | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil -index ba4261f0f42e..89dd4ffff5f5 100644 ---- a/fapolicyd-selinux-1.0/fapolicyd-hardening.cil -+++ b/fapolicyd-selinux-1.0/fapolicyd-hardening.cil -@@ -1,4 +1,4 @@ - (optional fapolicyd_hardening_optional - (typeattributeset cil_gen_require fapolicyd_t) -- (deny domain fapolicyd_t ( process ( ptrace sigkill sigstop ) ) ) -+ (deny domain fapolicyd_t ( process ( ptrace sigstop ) ) ) - ) --- -2.51.1 - diff --git a/fapolicyd.spec b/fapolicyd.spec index 16ff62e..d4020ad 100644 --- a/fapolicyd.spec +++ b/fapolicyd.spec @@ -1,10 +1,10 @@ %global selinuxtype targeted %global moduletype distributed -%define semodule_version 1.0 +%define semodule_version 1.1 Summary: Application Whitelisting Daemon Name: fapolicyd -Version: 1.4.2 +Version: 1.4.3 Release: 1%{?dist} License: GPL-3.0-or-later URL: https://github.com/linux-application-whitelisting/fapolicyd @@ -18,13 +18,11 @@ Source11: https://github.com/linux-application-whitelisting/%{name}-selinux/rele Source20: https://github.com/troydhanson/uthash/archive/refs/tags/v2.3.0.tar.gz#/uthash-2.3.0.tar.gz # https://github.com/linux-application-whitelisting/fapolicyd -# $ git format-patch -N v1.4.1 +# $ git format-patch -N v1.4.3 # https://github.com/linux-application-whitelisting/fapolicyd-selinux -# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.0/ --dst-prefix=b/fapolicyd-selinux-1.0/ v1.0 +# $ git format-patch -N --start-number 100 --src-prefix=a/fapolicyd-selinux-1.1/ --dst-prefix=b/fapolicyd-selinux-1.1/ v1.1 # $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done # Patch list start -Patch0100: 0100-Improve-install-process.patch -Patch0101: 0101-fapolicyd-hardening-do-not-block-sigkill.patch # Patch list end BuildRequires: gcc @@ -233,6 +231,11 @@ fi %selinux_relabel_post -s %{selinuxtype} %changelog +* Tue Jan 13 2026 Petr Lautrbach - 1.4.3-1 +- fapolicyd-1.4.3 + https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3 + https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1 + * Wed Nov 26 2025 Petr Lautrbach - 1.4.2-1 - fapolicyd-1.4.2 https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.2 diff --git a/sources b/sources index dbb8757..cd4b772 100644 --- a/sources +++ b/sources @@ -1,5 +1,5 @@ -SHA512 (fapolicyd-1.4.2.tar.gz) = 74e96821c99121d44db5c8f80e664ede2b8204ba2ac7fe881c5d9f53f97c5cb52d14c0002957facaa79d5165ed7d9f1259f086a5c14ea1e2432e9e2992fccf0e -SHA512 (fapolicyd-1.4.2.tar.gz.asc) = 2d603142554e6016626a262306e640b72f88dd9da48af2577b15dd016d40326898d2faafe3028b31d0b648125a9a32b0ed123a423545ed647a5c62908ae078e3 -SHA512 (fapolicyd-selinux-1.0.tar.gz) = 3c044b7570e2d5b990fcf85695e00526f3fd3c141d3d9b36209ee740f94031cb0a409a6887697f5b7a70f21a7c8fea2caab42eee605ba4b74d8b4a2fa1d8fa4a -SHA512 (fapolicyd-selinux-1.0.tar.gz.asc) = caf55ef941587b10e62a9ed99b92dcf1dad32a444b80a5688899dbb49c4ee7ea0ff5d661c50e7403e38b1ab592cc893d907174f7ee071a10f7afcaeb6aa50858 +SHA512 (fapolicyd-1.4.3.tar.gz) = 486e1ac5ef0909fc3759eef8086143cd145e61c1e9430a6d0ade686a625534c93a5fcf7208b7ae8ab692ecffeed915ae17c441230635fccaa1fe6c1604a75142 +SHA512 (fapolicyd-1.4.3.tar.gz.asc) = 74d1743b58431a9d54f36b7b494405a23fca24bf95d75f595b430f6145d4ea405728035fef0e4daac260fb9159870c8606564dd0e5d1d707832945c032fd2c0c +SHA512 (fapolicyd-selinux-1.1.tar.gz) = 64a7068f8f0a730363e546921ac2eec66a8195d027bacd53f9bf837f55c82d3a667563eb553c6111bc7dfbd90693029577ccefc99dca3d7fe9b7ae5bb61d19bd +SHA512 (fapolicyd-selinux-1.1.tar.gz.asc) = e881e57d07b00143fce97349060b206f9f1706a914206c0cc4fc700318f4497ff362de1faea463f769594a6f6e5e30cfd18667e25146be7f138ff4cb13dbc7b8 SHA512 (uthash-2.3.0.tar.gz) = 3b01f1074790fb242900411cb16eb82c1a9afcf58e3196a0f4611d9d7ef94690ad38c0a500e7783d3efa20328aa8d6ab14f246be63b3b3d385502ba2b6b2a294