RHEL 9.0.0 Alpha bootstrap

The content of this branch was automatically imported from Fedora ELN
with the following as its source:
https://src.fedoraproject.org/rpms/fapolicyd#e97bf03c73d2c8506a48834444c8e7b4c4d4f55d

.gitignore

@@ -12,3 +12,4 @@
 /fapolicyd-0.9.4.tar.gz
 /fapolicyd-1.0.tar.gz
 /fapolicyd-selinux-0.3.tar.gz
+/fapolicyd-1.0.1.tar.gz

fapolicyd-cli-args.patch

@@ -1,13 +0,0 @@
-diff -up ./src/cli/fapolicyd-cli.c.args ./src/cli/fapolicyd-cli.c
---- ./src/cli/fapolicyd-cli.c.args	2020-05-24 19:23:27.000000000 +0200
-+++ ./src/cli/fapolicyd-cli.c	2020-06-01 11:58:01.397204265 +0200
-@@ -232,6 +232,9 @@ static int do_manage_files(int argc, cha
- 		 else
- 			rc = file_update("/");
- 
-+	} else {
-+		fprintf(stderr, "Missing operation option add|delete|update\n\n");
-+		goto args_err;
- 	}
- 
- 	return rc;

fapolicyd-cli-big-buffer.patch

@@ -1,39 +0,0 @@
-From 98768e7d2b3736a7924d8e17de206fd25071e395 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Tue, 2 Jun 2020 17:11:19 -0400
-Subject: [PATCH] Make fapolicyd-cli buffer bigger for rule listing
-
----
- ChangeLog               | 2 ++
- src/cli/fapolicyd-cli.c | 5 +++--
- 2 files changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/src/cli/fapolicyd-cli.c b/src/cli/fapolicyd-cli.c
-index feb9e71..8783547 100644
---- a/src/cli/fapolicyd-cli.c
-+++ b/src/cli/fapolicyd-cli.c
-@@ -41,6 +41,7 @@
- #include "database.h"
- #include "file-backend.h"
- #include "fapolicyd-backend.h"
-+#include "string-util.h"
- 
- 
- static const char *usage =
-@@ -318,14 +319,14 @@ static int do_ftype(const char *path)
- static int do_list(void)
- {
- 	unsigned count = 1, lineno = 0;
--	char buf[160];
-+	char buf[BUFFER_MAX+1];
- 	FILE *f = fopen(RULES_FILE, "rm");
- 	if (f == NULL) {
- 		fprintf(stderr, "Cannot open rules file (%s)\n",
- 						strerror(errno));
- 		return 1;
- 	}
--	while (get_line(f, buf, sizeof(buf), &lineno)) {
-+	while (get_line(f, buf, BUFFER_MAX, &lineno)) {
- 		char *str = buf;
- 		lineno++;
- 		while (*str) {

fapolicyd-cli-empty-db.patch

@@ -1,30 +0,0 @@
-diff -U0 ./ChangeLog.cli-empty-db ./ChangeLog
-diff -up ./src/cli/fapolicyd-cli.c.cli-empty-db ./src/cli/fapolicyd-cli.c
---- ./src/cli/fapolicyd-cli.c.cli-empty-db	2020-06-05 17:12:49.010948664 +0200
-+++ ./src/cli/fapolicyd-cli.c	2020-06-05 17:12:49.016948738 +0200
-@@ -112,6 +112,7 @@ static int do_dump_db(void)
- 	MDB_env *env;
- 	MDB_txn *txn;
- 	MDB_dbi dbi;
-+	MDB_stat status;
- 	MDB_cursor *cursor;
- 	MDB_val key, val;
- 
-@@ -129,6 +130,17 @@ static int do_dump_db(void)
- 		rc = 1;
- 		goto env_close;
- 	}
-+	rc = mdb_env_stat(env, &status);
-+	if (rc) {
-+		fprintf(stderr, "mdb_env_stat failed, error %d %s\n", rc,
-+							mdb_strerror(rc));
-+		rc = 1;
-+		goto env_close;
-+	}
-+	if (status.ms_entries == 0) {
-+		printf("Trust database is empty\n");
-+		goto env_close; // Note: rc is 0 to get here
-+	}
- 	rc = mdb_txn_begin(env, NULL, MDB_RDONLY, &txn);
- 	if (rc) {
- 		fprintf(stderr, "mdb_txn_begin failed, error %d %s\n", rc,

fapolicyd-get-line.patch

@@ -1,36 +0,0 @@
-From 84916944b481d5c478202f6c4239e4aed0731406 Mon Sep 17 00:00:00 2001
-From: Steve Grubb <sgrubb@redhat.com>
-Date: Tue, 2 Jun 2020 17:27:58 -0400
-Subject: [PATCH] Return only valid lines
-
-If fapolicyd_get_line does not find a 0x0A, then we have an unterminated
-string because its too long. Only return terminated strings, otherwise
-pass NULL back.
----
- src/library/string-util.c | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
-diff --git a/src/library/string-util.c b/src/library/string-util.c
-index f991f5f..ffdc645 100644
---- a/src/library/string-util.c
-+++ b/src/library/string-util.c
-@@ -53,15 +53,16 @@ char * fapolicyd_strtrim(char * s)
- 	return s;
- }
- 
--char * fapolicyd_get_line(FILE *f, char *buf)
-+char *fapolicyd_get_line(FILE *f, char *buf)
- {
- 	if (fgets_unlocked(buf, BUFFER_MAX-1, f)) {
- 
- 		/* remove newline */
- 		char *ptr = strchr(buf, 0x0a);
--		if (ptr)
-+		if (ptr) {
- 			*ptr = 0;
--		return buf;
-+			return buf;
-+		}
- 	}
- 
- 	return NULL;

fapolicyd-magic-override.patch

@@ -1,60 +1,40 @@
 diff -up ./init/fapolicyd-magic.magic-override ./init/fapolicyd-magic
---- ./init/fapolicyd-magic.magic-override	2020-06-01 12:19:03.714672865 +0200
+--- ./init/fapolicyd-magic.magic-override	2020-11-16 20:16:10.764346043 +0100
-+++ ./init/fapolicyd-magic	2020-06-01 12:19:52.754376249 +0200
++++ ./init/fapolicyd-magic	2020-11-16 20:18:30.354528379 +0100
-@@ -13,6 +13,12 @@
+@@ -1,9 +1,17 @@
- 0	string/wt	#!\ /usr/bin/lua	Lua script text executable
+ 0	string/w	#!\ /usr/bin/bash	Bourne-Again shell script text executable
- !:mime	text/x-lua
+ !:mime	text/x-shellscript
  
-+0	string/wt	#!\ /usr/bin/texlua	LuaTex script text executable
++0  search/1/w  #!\ /usr/bin/env\ bash  Bourne-Again shell script text executable
-+!:mime	text/x-luatex
++!:strength + 15
++!:mime text/x-shellscript
 +
-+0	string/wt	#!\ /usr/bin/luatex	LuaTex script text executable
+ 0	string/w	#!\ /usr/bin/sh		Shell script text executable
-+!:mime	text/x-luatex
+ !:mime	text/x-shellscript
-+
- 0	string/wt	#!\ /usr/bin/Rscript	R script text executable
- !:mime	text/x-R
  
-@@ -53,8 +59,19 @@
++0   search/1/w  #!\ /usr/bin/env\ bash  Bourne-Again shell script text executable
++!:strength + 15
++!:mime text/x-shellscript
++
+ 0	string/wt	#!\ /bin/rc		Plan 9 shell script text executable
+ !:mime	text/x-plan9-shellscript
+ 
+@@ -47,10 +55,18 @@
  !:strength + 15
  !:mime text/x-python
  
-+0       search/1/w       #!\ /usr/bin/env\ python        Python script text executable
++0   search/1/w  #!\ /usr/bin/env\ python3   Python script text executable
 +!:strength + 15
 +!:mime text/x-python
 +
- 0	string/wt	#!\ /usr/bin/guile	Guile script text executable
+ 0	search/1/wt	#!\ /usr/bin/python2	Python script text executable
- !:mime  text/x-script.guile
+ !:strength + 15
+ !:mime text/x-python
  
- 0	string	\223NUMPY			NumPy data file
++0  search/1/w  #!\ /usr/bin/env\ python2   Python script text executable
- !:mime	application/x-numpy-data
++!:strength + 15
++!:mime text/x-python
 +
-+0       search/1/w      #!\ /usr/bin/tclsh       Tcl/Tk script text executable
+ 0	search/1/wt	#!\ /usr/bin/python	Python script text executable
-+!:mime  text/x-tcl
+ !:strength + 15
-+
+ !:mime text/x-python
-+
-+0       search/1/w      #!\ /usr/bin/stap       Systemtap script text executable
-+!:mime  text/x-systemtap
-diff -up ./init/fapolicyd.rules.known-libs.magic-override ./init/fapolicyd.rules.known-libs
---- ./init/fapolicyd.rules.known-libs.magic-override	2020-06-01 12:20:56.498290540 +0200
-+++ ./init/fapolicyd.rules.known-libs	2020-06-01 12:23:17.220324490 +0200
-@@ -3,7 +3,7 @@
- # performance while ensuring that there is not much interference by
- # the daemon.
- 
--%languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/javascript,text/x-awk,text/x-gawk,text/x-java,text/x-lisp,text/x-lua,text/x-m4,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl
-+%languages=application/x-bytecode.ocaml,application/x-bytecode.python,application/java-archive,text/javascript,text/x-awk,text/x-gawk,text/x-java,text/x-lisp,text/x-lua,text/x-m4,text/x-perl,text/x-php,text/x-python,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap
- 
- # Carve out an exception for dracut initramfs building
- allow perm=any uid=0 : dir=/var/tmp/
-diff -up ./init/fapolicyd.rules.restrictive.magic-override ./init/fapolicyd.rules.restrictive
---- ./init/fapolicyd.rules.restrictive.magic-override	2020-06-01 12:22:55.144002314 +0200
-+++ ./init/fapolicyd.rules.restrictive	2020-06-01 12:23:55.860888398 +0200
-@@ -15,7 +15,7 @@
- # allow perm=open exe=%python : all
- #
- 
--%languages=application/x-bytecode.ocaml,application/java-archive,text/javascript,text/x-java,text/x-lisp,text/x-lua,text/x-m4,text/x-perl,text/x-php,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl
-+%languages=application/x-bytecode.ocaml,application/java-archive,text/javascript,text/x-java,text/x-lisp,text/x-lua,text/x-m4,text/x-perl,text/x-php,text/x-R,text/x-ruby,text/x-script.guile,text/x-tcl,text/x-luatex,text/x-systemtap
- 
- # Carve out an exception for dracut
- allow perm=any uid=0 : dir=/var/tmp/

fapolicyd-magic-override2.patch

@@ -1,61 +0,0 @@
-From 598d167f1d3e774104fc8b75ca6525351fbc4558 Mon Sep 17 00:00:00 2001
-From: Radovan Sroka <rsroka@redhat.com>
-Date: Mon, 1 Jun 2020 14:34:17 +0200
-Subject: [PATCH] Added few python and shell magic entries
-
-Signed-off-by: Radovan Sroka <rsroka@redhat.com>
----
- init/fapolicyd-magic | 17 ++++++++++++++++-
- 1 file changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/init/fapolicyd-magic b/init/fapolicyd-magic
-index 3128545..703625e 100644
---- a/init/fapolicyd-magic
-+++ b/init/fapolicyd-magic
-@@ -1,9 +1,17 @@
- 0	string/wt	#!\ /usr/bin/bash	Bourne-Again shell script text executable
- !:mime	text/x-shellscript
- 
-+0	search/1/w	#!\ /usr/bin/env\ bash	Bourne-Again shell script text executable
-+!:strength + 15
-+!:mime text/x-shellscript
-+
- 0	string/w	#!\ /usr/bin/sh		Shell script text executable
- !:mime	text/x-shellscript
- 
-+0	search/1/w	#!\ /usr/bin/env\ sh	Shell script text executable
-+!:strength + 15
-+!:mime text/x-shellscript
-+
- 0	string/wt	#!\ /bin/rc		Plan 9 shell script text executable
- !:mime	text/x-plan9-shellscript
- 
-@@ -47,10 +55,18 @@
- !:strength + 15
- !:mime text/x-python
- 
-+0	search/1/w	#!\ /usr/bin/env\ python3	Python script text executable
-+!:strength + 15
-+!:mime text/x-python
-+
- 0	search/1/w	#!\ /usr/bin/python2	Python script text executable
- !:strength + 15
- !:mime text/x-python
- 
-+0	search/1/w	#!\ /usr/bin/env\ python2	Python script text executable
-+!:strength + 15
-+!:mime text/x-python
-+
- 0	search/1/w	#!\ /usr/bin/python	Python script text executable
- !:strength + 15
- !:mime text/x-python
-@@ -72,6 +88,5 @@
- 0       search/1/w      #!\ /usr/bin/tclsh       Tcl/Tk script text executable
- !:mime  text/x-tcl
- 
--
- 0       search/1/w      #!\ /usr/bin/stap       Systemtap script text executable
- !:mime  text/x-systemtap
--- 
-2.25.4
-

fapolicyd-man-page.patch

@@ -1,33 +0,0 @@
-diff -up ./doc/fapolicyd-cli.1.man-page ./doc/fapolicyd-cli.1
---- ./doc/fapolicyd-cli.1.man-page	2020-06-01 14:20:55.720491113 +0200
-+++ ./doc/fapolicyd-cli.1	2020-06-01 14:20:59.684554153 +0200
-@@ -16,7 +16,7 @@ Deletes the trust database. Normally thi
- .B \-D, \-\-dump-db
- Dumps the trust db contents for inspection. This will print the original trust source, path, file size, and SHA256 sum of the file as known by the trust source the entry came from.
- .TP
--.B \-f, \-\-file  [add] [path]
-+.B \-f, \-\-file  add|delete|update [path]
- Manage the file trust database.
- .RS
- .TP 12
-diff -up ./doc/fapolicyd.rules.5.man-page ./doc/fapolicyd.rules.5
---- ./doc/fapolicyd.rules.5.man-page	2020-05-24 19:23:27.000000000 +0200
-+++ ./doc/fapolicyd.rules.5	2020-06-01 14:20:31.272102326 +0200
-@@ -14,7 +14,7 @@ for the access control decision. The col
- .SS Decision
- The decision is either
- .IR allow ", " deny ", " allow_audit ", " deny_audit ", " allow_syslog ", "deny_syslog ", " allow_log ", or " deny_log ".
--If the rule triggers, this is the access decision that fapolicyd will tell the kernel. If the decision is one of the audit variety, then the decision will trigger a FANOTIFY audit event with all relevant information. If the decision is one of the syslog variety, then the decision will trigger writing an event into syslog. If the decision is of one the log variety, then it will create an audit event and a syslog event.
-+If the rule triggers, this is the access decision that fapolicyd will tell the kernel. If the decision is one of the audit variety, then the decision will trigger a FANOTIFY audit event with all relevant information. If the decision is one of the syslog variety, then the decision will trigger writing an event into syslog. If the decision is of one the log variety, then it will create an audit event and a syslog event. Regardless of the notification, any rule with a deny in the keyword will deny access and any with an allow in the keyword will allow access.
- 
- .SS Perm
- Perm describes what kind permission is being asked for. The permission is either
-@@ -132,7 +132,7 @@ This option matches against the sha256 h
- .RE
- 
- .SH SETS
--Set is a named group of values of the same type. Fapolicyd internally distinguishes between INT and STRING set types. You can define your own set and use it as a value for specific rule attribute. Definition is in key=value syntax and it starts with a set name. Set name has to start with % and the rest is alphanumeric. Value is a comma separated list. The set type is inherited from the first item in the list. If that can be turned into number then whole list is expected to carry numbers. One can use these sets as a value for subject and object attributes. It is also possible to use a plain list as an attribute value without previous definition. Assigned set has to match attribute type. It is not possible set groups for TRUST and PATTERN attributes.
-+Set is a named group of values of the same type. Fapolicyd internally distinguishes between INT and STRING set types. You can define your own set and use it as a value for a specific rule attribute. The definition is in key=value syntax and starts with a set name. The set name has to start with % and the rest is alphanumeric. The value is a comma separated list. The set type is inherited from the first item in the list. If that can be turned into number then whole list is expected to carry numbers. One can use these sets as a value for subject and object attributes. It is also possible to use a plain list as an attribute value without previous definition. The assigned set has to match the attribute type. It is not possible set groups for TRUST and PATTERN attributes.
- 
- 
- .SS SETS EXAMPLES

fapolicyd-trust.patch

@@ -1,58 +0,0 @@
-From c7d409cebf86b1c71192fd79ec5f5582f4f00f30 Mon Sep 17 00:00:00 2001
-From: Radovan Sroka <rsroka@redhat.com>
-Date: Tue, 2 Jun 2020 21:24:28 +0200
-Subject: [PATCH] Ignore db errors from check_trust_database() (#70)
-
-- mark every subject and object as not trusted
-  when it is not possible to do a query
-
-- previously, when error occurred then subject or
-  object was actually considered to be trusted
-
-Signed-off-by: Radovan Sroka <rsroka@redhat.com>
----
- src/library/event.c | 23 +++++++++++++++++------
- 1 file changed, 17 insertions(+), 6 deletions(-)
-
-diff --git a/src/library/event.c b/src/library/event.c
-index 564c120..2a4083b 100644
---- a/src/library/event.c
-+++ b/src/library/event.c
-@@ -339,9 +339,15 @@ subject_attr_t *get_subj_attr(event_t *e, subject_type_t t)
- 
- 			subj.val = 0;
- 			if (exe) {
--				if (exe->str && check_trust_database(exe->str,
--								     NULL, 0))
--					subj.val = 1;
-+				if (exe->str) {
-+					int res = check_trust_database(exe->str, NULL, 0);
-+
-+					// ignore -1
-+					if (res == 1)
-+						subj.val = 1;
-+					else
-+						subj.val = 0;
-+				}
- 			}
- 			}
- 			break;
-@@ -422,10 +428,15 @@ object_attr_t *get_obj_attr(event_t *e, object_type_t t)
- 		case OBJ_TRUST: {
- 			object_attr_t *path =  get_obj_attr(e, PATH);
- 
--			if (path && path->o && check_trust_database(path->o,
--							    o->info, e->fd))
--			obj.val = 1;
-+			if (path && path->o) {
-+				int res = check_trust_database(path->o, o->info, e->fd);
- 
-+				// ignore -1
-+				if (res == 1)
-+					obj.val = 1;
-+				else
-+					obj.val = 0;
-+			}
- 			}
- 			break;
- 		case FMODE:

fapolicyd.spec

@@ -4,8 +4,8 @@
 
 Summary: Application Whitelisting Daemon
 Name: fapolicyd
-Version: 1.0
+Version: 1.0.1
-Release: 4%{?dist}
+Release: 1%{?dist}
 License: GPLv3+
 URL: http://people.redhat.com/sgrubb/fapolicyd
 Source0: https://people.redhat.com/sgrubb/fapolicyd/%{name}-%{version}.tar.gz
@@ -16,20 +16,15 @@ BuildRequires: autoconf automake make gcc libtool
 BuildRequires: systemd-devel libgcrypt-devel rpm-devel file-devel file
 BuildRequires: libcap-ng-devel libseccomp-devel lmdb-devel
 BuildRequires: python3-devel
+BuildRequires: uthash-devel
 Recommends: %{name}-selinux
 Requires(pre): shadow-utils
 Requires(post): systemd-units
 Requires(preun): systemd-units
 Requires(postun): systemd-units
 
-Patch1: fapolicyd-cli-args.patch
+Patch1: fapolicyd-magic-override.patch
-Patch2: fapolicyd-magic-override.patch
+Patch2: selinux.patch
-Patch3: fapolicyd-magic-override2.patch
-Patch4: fapolicyd-man-page.patch
-Patch5: fapolicyd-trust.patch
-Patch6: fapolicyd-cli-empty-db.patch
-Patch7: fapolicyd-cli-big-buffer.patch
-Patch8: fapolicyd-get-line.patch
 
 %description
 Fapolicyd (File Access Policy Daemon) implements application whitelisting
@@ -56,14 +51,8 @@ The %{name}-selinux package contains selinux policy for the %{name} daemon.
 # selinux
 %setup -q -D -T -a 1
 
-%patch1 -p1 -b .cli-args
+%patch1 -p1 -b .magic-override
-%patch2 -p1 -b .magic-override
+%patch2 -p1 -b .selinux
-%patch3 -p1 -b .magic-override2
-%patch4 -p1 -b .man-page
-%patch5 -p1 -b .trust
-%patch6 -p1 -b .cli-empty-db
-%patch7 -p1 -b .cli-big-buffer
-%patch8 -p1 -b .get-line
 
 sed -i "s/%python2_path%/`readlink -f %{__python2} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
 sed -i "s/%python3_path%/`readlink -f %{__python3} | sed 's/\//\\\\\//g'`/g" init/%{name}.rules.*
@@ -166,6 +155,14 @@ fi
 
 
 %changelog
+* Mon Nov 16 2020 Radovan Sroka <rsroka@redhat.com> - 1.0.1-1
+- rebase to 1.0.1
+- introduced uthash dependency
+- SELinux prevents the fapolicyd process from writing to /run/dbus/system_bus_socket
+Resolves: rhbz#1874491
+- SELinux prevents the fapolicyd process from writing to /var/lib/rpm directory
+Resolves: rhbz#1876538
+
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.0-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

selinux.patch

@@ -1,20 +1,15 @@
-diff -up ./fapolicyd-selinux-0.2/fapolicyd.te.selinux ./fapolicyd-selinux-0.2/fapolicyd.te
+diff -up ./fapolicyd-selinux-0.3/fapolicyd.te.selinux ./fapolicyd-selinux-0.3/fapolicyd.te
---- ./fapolicyd-selinux-0.2/fapolicyd.te.selinux	2019-11-05 14:17:08.000000000 +0100
+--- ./fapolicyd-selinux-0.3/fapolicyd.te.selinux	2020-11-16 20:26:57.777902314 +0100
-+++ ./fapolicyd-selinux-0.2/fapolicyd.te	2020-05-25 15:02:37.196991039 +0200
++++ ./fapolicyd-selinux-0.3/fapolicyd.te	2020-11-16 20:28:17.659857140 +0100
-@@ -30,6 +30,7 @@ files_pid_file(fapolicyd_var_run_t)
+@@ -64,7 +64,10 @@ files_read_all_files(fapolicyd_t)
- # fapolicyd local policy
+ fs_getattr_xattr_fs(fapolicyd_t)
- #
- allow fapolicyd_t self:capability { audit_write chown dac_override setgid setuid sys_admin sys_nice sys_ptrace };
-+allow fapolicyd_t self:cap_userns sys_ptrace;
- allow fapolicyd_t self:fifo_file rw_fifo_file_perms;
- allow fapolicyd_t self:process { setcap setsched };
- allow fapolicyd_t self:unix_stream_socket create_stream_socket_perms;
-@@ -48,7 +49,7 @@ manage_dirs_pattern(fapolicyd_t, fapolic
- manage_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
- manage_fifo_files_pattern(fapolicyd_t, fapolicyd_var_run_t,fapolicyd_var_run_t)
- manage_lnk_files_pattern(fapolicyd_t, fapolicyd_var_run_t, fapolicyd_var_run_t)
--files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file lnk_file })
-+files_pid_filetrans(fapolicyd_t, fapolicyd_var_run_t, { dir file fifo_file lnk_file })
  
- kernel_dgram_send(fapolicyd_t)
+ logging_send_syslog_msg(fapolicyd_t)
++dbus_system_bus_client(fapolicyd_t)
  
+ optional_policy(`
+-        rpm_read_db(fapolicyd_t)        
++        rpm_read_db(fapolicyd_t)
++        allow fapolicyd_t rpm_var_lib_t:file { create };
++        allow fapolicyd_t rpm_var_lib_t:dir { add_name write };
+ ')

sources

@@ -1,2 +1,2 @@
 SHA512 (fapolicyd-selinux-0.3.tar.gz) = 29895ee587294a275b3dbc712f915466758a3aabf7a692ed410ff91ae5d7dea936c231cde6aca5adf4edb9d9160450b65317ca9d1d6e76d687066d17d18495cd
-SHA512 (fapolicyd-1.0.tar.gz) = 7fbaca0774223fefb0ed553fdd1591b6a46c8939983fe2e9c98a3fc067b4f09257a65a6039434e196c09baa62a324f85cd74afa80182c9cad84e316af4aeae19
+SHA512 (fapolicyd-1.0.1.tar.gz) = 82e748ba34795548f94c85e5ef429a48a5240dfe8ef9f7ee1dad152442317694c66a24e7bd4c4c8012fb268c478bbd20f302e94a413c2392180ecd28a74ee469