rpms/libguestfs
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add setfiles optional excludes parameter to libguestfs

Browse Source 
resolves: RHEL-232890
This commit is contained in:
Srihari Parimi 2026-08-17 06:59:29 -04:00
parent 3a189ddd7f
commit 61804b2257
12 changed files with 477 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch
View File

@ -26,7 +26,7 @@ Note 'nbd' is not disabled, and of course 'file' works.
8 files changed, 8 insertions(+), 336 deletions(-)
diff --git a/docs/guestfs-testing.pod b/docs/guestfs-testing.pod
index 45ebe2941..a02f766c9 100644
index 45ebe294..a02f766c 100644
--- a/docs/guestfs-testing.pod
+++ b/docs/guestfs-testing.pod
@@ -109,26 +109,6 @@ image. To exit, type C<exit>.
@ -57,7 +57,7 @@ index 45ebe2941..a02f766c9 100644
Run L<virt-alignment-scan(1)> on guests or disk images:
diff --git a/fish/guestfish.pod b/fish/guestfish.pod
index ac14ea5a4..8d4d488fc 100644
index ac14ea5a..8d4d488f 100644
--- a/fish/guestfish.pod
+++ b/fish/guestfish.pod
@@ -131,9 +131,9 @@ To list what is available do:
@ -142,7 +142,7 @@ index ac14ea5a4..8d4d488fc 100644
In this case, the password is C<pass@word>.
diff --git a/fish/test-add-uri.sh b/fish/test-add-uri.sh
index e4e1021db..8419ce78a 100755
index e4e1021d..8419ce78 100755
--- a/fish/test-add-uri.sh
+++ b/fish/test-add-uri.sh
@@ -40,10 +40,6 @@ function fail ()
@ -180,7 +180,7 @@ index e4e1021db..8419ce78a 100755
rm test-add-uri.out
rm test-add-uri.img
diff --git a/generator/actions_core.ml b/generator/actions_core.ml
index cfd767793..ef2d4dd06 100644
index cfd76779..ef2d4dd0 100644
--- a/generator/actions_core.ml
+++ b/generator/actions_core.ml
@@ -343,22 +343,6 @@ F<filename> is interpreted as a local file or device.
@ -249,7 +249,7 @@ index cfd767793..ef2d4dd06 100644
example if using the libvirt backend and if the libvirt backend is configured to
start the qemu appliance as a special user such as C<qemu.qemu>. If in doubt,
diff --git a/lib/drives.c b/lib/drives.c
index edb1e060f..c3fb90ae8 100644
index edb1e060..c3fb90ae 100644
--- a/lib/drives.c
+++ b/lib/drives.c
@@ -166,34 +166,6 @@ create_drive_non_file (guestfs_h *g,
@ -394,7 +394,7 @@ index edb1e060f..c3fb90ae8 100644
error (g, _("unknown protocol ‘%s’"), protocol);
drv = NULL; /*FALLTHROUGH*/
diff --git a/lib/guestfs.pod b/lib/guestfs.pod
index 0c58e0d6b..fe74f5542 100644
index 0c58e0d6..fe74f554 100644
--- a/lib/guestfs.pod
+++ b/lib/guestfs.pod
@@ -723,51 +723,6 @@ a qcow2 backing file specification, libvirt does not construct an
@ -479,7 +479,7 @@ index 0c58e0d6b..fe74f5542 100644
Libguestfs has APIs for inspecting an unknown disk image to find out
diff --git a/tests/disks/test-qemu-drive-libvirt.sh b/tests/disks/test-qemu-drive-libvirt.sh
index 485d75718..e917cd1a6 100755
index 485d7571..e917cd1a 100755
--- a/tests/disks/test-qemu-drive-libvirt.sh
+++ b/tests/disks/test-qemu-drive-libvirt.sh
@@ -65,13 +65,6 @@ check_output
@ -497,7 +497,7 @@ index 485d75718..e917cd1a6 100755
$guestfish -d nbd run ||:
diff --git a/tests/disks/test-qemu-drive.sh b/tests/disks/test-qemu-drive.sh
index f5ecccc3c..d699d37ca 100755
index f5ecccc3..d699d37c 100755
--- a/tests/disks/test-qemu-drive.sh
+++ b/tests/disks/test-qemu-drive.sh
@@ -64,35 +64,6 @@ check_output
@ -551,6 +551,3 @@ index f5ecccc3c..d699d37ca 100755
-check_output
-grep -sq -- '-drive file=ssh://rich@example.com/disk.img,' "$DEBUG_QEMU_FILE" || fail
-rm "$DEBUG_QEMU_FILE"
--
2.47.3

9
0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch
View File

@ -13,7 +13,7 @@ edits.
3 files changed, 19 insertions(+)
diff --git a/generator/c.ml b/generator/c.ml
index f1217c659..923c2be38 100644
index f1217c65..923c2be3 100644
--- a/generator/c.ml
+++ b/generator/c.ml
@@ -1834,6 +1834,22 @@ and generate_client_actions actions () =
@ -40,7 +40,7 @@ index f1217c659..923c2be38 100644
* as a progress bar hint.
*)
diff --git a/test-data/phony-guests/make-windows-img.sh b/test-data/phony-guests/make-windows-img.sh
index 0ec6b4851..9fa29f98b 100755
index 0ec6b485..9fa29f98 100755
--- a/test-data/phony-guests/make-windows-img.sh
+++ b/test-data/phony-guests/make-windows-img.sh
@@ -37,6 +37,7 @@ fi
@ -52,7 +52,7 @@ index 0ec6b4851..9fa29f98b 100755
run
diff --git a/tests/charsets/test-charset-fidelity.c b/tests/charsets/test-charset-fidelity.c
index 105291dc3..5ca4f3b6d 100644
index 105291dc..5ca4f3b6 100644
--- a/tests/charsets/test-charset-fidelity.c
+++ b/tests/charsets/test-charset-fidelity.c
@@ -96,6 +96,8 @@ main (int argc, char *argv[])
@ -64,6 +64,3 @@ index 105291dc3..5ca4f3b6d 100644
if (guestfs_add_drive_scratch (g, 1024*1024*1024, -1) == -1)
exit (EXIT_FAILURE);
--
2.47.3

5
0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch
View File

@ -9,7 +9,7 @@ Subject: [PATCH] RHEL: appliance/init: Run depmod -a to rebuild kernel module
1 file changed, 3 insertions(+)
diff --git a/appliance/init b/appliance/init
index 222c14667..0c74183eb 100755
index 222c1466..0c74183e 100755
--- a/appliance/init
+++ b/appliance/init
@@ -117,6 +117,9 @@ udevadm trigger
@ -22,6 +22,3 @@ index 222c14667..0c74183eb 100755
# Disk optimizations.
# Increase the SCSI timeout so we can read remote images.
shopt -s nullglob
--
2.47.3

5
0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch
View File

@ -10,7 +10,7 @@ to find qemu on RHEL.
1 file changed, 5 insertions(+)
diff --git a/lib/launch-direct.c b/lib/launch-direct.c
index b2021ee2c..12f969c7e 100644
index b2021ee2..12f969c7 100644
--- a/lib/launch-direct.c
+++ b/lib/launch-direct.c
@@ -446,6 +446,11 @@ free_pid_path:
@ -25,6 +25,3 @@ index b2021ee2c..12f969c7e 100644
if (host_cpu[0] == 'i' && strchr ("3456", host_cpu[1]) &&
host_cpu[2] == '8' && host_cpu[3] == '6' && host_cpu[4] == '\0')
return "qemu-system-i386";
--
2.47.3

64
0005-generator-Point-deprecated-SELinux-functions-to-gues.patch Normal file
View File

@ -0,0 +1,64 @@
From 96b202f793f110e2125955ce9b714b8498344149 Mon Sep 17 00:00:00 2001
From: Srihari Parimi <sparimi@redhat.com>
Date: Wed, 12 Aug 2026 06:54:21 -0400
Subject: [PATCH] generator: Point deprecated SELinux functions to
guestfs_setfiles
The four functions guestfs_{set_selinux,get_selinux,setcon,getcon}
have been deprecated for a very long time. Previously the deprecation
message pointed to the also now-deprecated guestfs_selinux_relabel.
Point it instead to the guestfs_setfiles function.
This just changes documentation and warning messages and has no other
effects.
(cherry picked from commit 287784095647673b2c81134dc5d5ecf4460df494)
---
generator/actions_core_deprecated.ml | 4 ++--
generator/actions_properties_deprecated.ml | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/generator/actions_core_deprecated.ml b/generator/actions_core_deprecated.ml
index d930b8b8..f3c444ee 100644
--- a/generator/actions_core_deprecated.ml
+++ b/generator/actions_core_deprecated.ml
@@ -565,7 +565,7 @@ attaches it as a device.|} };
name = "setcon"; added = (1, 0, 67);
style = RErr, [String (PlainString, "context")], [];
optional = Some "selinux";
- deprecated_by = Replaced_by "selinux_relabel";
+ deprecated_by = Replaced_by "setfiles";
shortdesc = "set SELinux security context";
longdesc = "\
This sets the SELinux security context of the daemon
@@ -577,7 +577,7 @@ See the documentation about SELINUX in L<guestfs(3)>." };
name = "getcon"; added = (1, 0, 67);
style = RString (RPlainString, "context"), [], [];
optional = Some "selinux";
- deprecated_by = Replaced_by "selinux_relabel";
+ deprecated_by = Replaced_by "setfiles";
shortdesc = "get SELinux security context";
longdesc = "\
This gets the SELinux security context of the daemon.
diff --git a/generator/actions_properties_deprecated.ml b/generator/actions_properties_deprecated.ml
index 7fa49d44..3936a665 100644
--- a/generator/actions_properties_deprecated.ml
+++ b/generator/actions_properties_deprecated.ml
@@ -64,7 +64,7 @@ return the default qemu binary name." };
style = RErr, [Bool "selinux"], [];
fish_alias = ["selinux"]; config_only = true;
blocking = false;
- deprecated_by = Replaced_by "selinux_relabel";
+ deprecated_by = Replaced_by "setfiles";
shortdesc = "set SELinux enabled or disabled at appliance boot";
longdesc = {|This sets the selinux flag that is passed to the appliance
at boot time. The default is C<selinux=0> (disabled).
@@ -79,7 +79,7 @@ see L<guestfs(3)>.|} };
name = "get_selinux"; added = (1, 0, 67);
style = RBool "selinux", [], [];
blocking = false;
- deprecated_by = Replaced_by "selinux_relabel";
+ deprecated_by = Replaced_by "setfiles";
shortdesc = "get SELinux enabled flag";
longdesc = {|This returns the current setting of the selinux flag which
is passed to the appliance at boot time. See C<guestfs_set_selinux>.

191
0006-tests-relabel-Add-a-new-test-for-setfiles.patch Normal file
View File

@ -0,0 +1,191 @@
From 178256768566184a6d7b7dba16e3b64a68439542 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 22 Jul 2026 14:25:19 +0100
Subject: [PATCH] tests/relabel: Add a new test for setfiles
Previously we tested only the deprecated guestfs_selinux_relabel
function. Add a new test for guestfs_setfiles. Since the APIs and
their usage are very similar, the test is basically the same at the
moment.
(cherry picked from commit 3567dc6fe9685a1695bfff396fbeb15601c67eaa)
---
tests/Makefile.am | 10 ++-
tests/relabel/test-relabel.py | 2 +
tests/relabel/test-setfiles.py | 133 +++++++++++++++++++++++++++++++++
3 files changed, 143 insertions(+), 2 deletions(-)
create mode 100755 tests/relabel/test-setfiles.py
diff --git a/tests/Makefile.am b/tests/Makefile.am
index 082217f9..3d60fc43 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -748,8 +748,14 @@ regressions_test_big_heap_LDADD = \
SLOW_TESTS += regressions/rhbz909624.sh
EXTRA_DIST += regressions/rhbz909624.sh
-TESTS += relabel/test-relabel.py
-EXTRA_DIST += relabel/test-relabel.py
+TESTS += \
+ relabel/test-relabel.py \
+ relabel/test-setfiles.py \
+ $(NULL)
+EXTRA_DIST += \
+ relabel/test-relabel.py \
+ relabel/test-setfiles.py \
+ $(NULL)
# Test relative paths to backing files. Mainly this is a test that we
# don't break this.
diff --git a/tests/relabel/test-relabel.py b/tests/relabel/test-relabel.py
index c2c4c5e4..83e09ea8 100755
--- a/tests/relabel/test-relabel.py
+++ b/tests/relabel/test-relabel.py
@@ -15,6 +15,8 @@
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+# Test the deprecated selinux_relabel function.
+
import os
import sys
import guestfs
diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py
new file mode 100755
index 00000000..c3609864
--- /dev/null
+++ b/tests/relabel/test-setfiles.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+# Copyright (C) 2025-2026 Red Hat Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+# Test the setfiles function.
+
+import os
+import sys
+import guestfs
+
+prog = os.path.basename(sys.argv[0])
+# Because we parse error message strings below.
+os.environ["LANG"] = "C"
+
+if os.environ.get("SKIP_TEST_SETFILES_PY"):
+ print(f"{prog}: test skipped because environment variable is set.")
+ sys.exit(77)
+
+# SELinux labelling won't work (and can be skipped) if SELinux isn't
+# installed on the host.
+if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_policy", os.X_OK):
+ print(f"{prog}: test skipped because SELinux is not available.")
+ sys.exit(77)
+
+# Create a filesystem.
+g = guestfs.GuestFS(python_return_dict=True)
+g.add_drive_scratch(256 * 1024 * 1024)
+g.launch()
+
+# If Linux extended attrs aren't available then we cannot test this.
+if not g.feature_available(["linuxxattrs"]):
+ print(f"{prog}: test skipped because 'linuxxattrs' feature not available.")
+ g.close()
+ sys.exit(77)
+
+# If SELinux relabelling is not available then we cannot test this.
+if not g.feature_available(["selinuxrelabel"]):
+ print(f"{prog}: test skipped because 'selinuxrelabel' feature not available.")
+ g.close()
+ sys.exit(77)
+
+g.part_disk("/dev/sda", "mbr")
+g.mkfs("ext4", "/dev/sda1")
+g.mount_options("user_xattr", "/dev/sda1", "/")
+
+# Create some files and directories that we want to have relabelled.
+g.mkdir("/bin")
+g.touch("/bin/ls")
+g.mkdir("/etc")
+g.mkdir("/tmp")
+g.touch("/tmp/test")
+g.mkdir("/var")
+g.mkdir("/var/log")
+g.touch("/var/log/messages")
+
+# Create a spec file.
+# This doesn't test the optional file_type field. XXX
+# See also file_contexts(5).
+g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0
+/bin/.* system_u:object_r:bin_t:s0
+/etc/.* system_u:object_r:etc_t:s0
+/etc/file_contexts <<none>>
+/tmp/.* <<none>>
+/var/.* system_u:object_r:var_t:s0
+/var/log/.* system_u:object_r:var_log_t:s0
+""")
+
+# Do the relabel.
+g.setfiles("/etc/file_contexts", "/", force=True)
+
+# Check the labels were set correctly.
+errors = 0
+
+def check_label(file, expected_label):
+ global errors
+ actual_label = g.lgetxattr(file, "security.selinux")
+ # The label returned from lgetxattr has \0 appended.
+ if (expected_label + "\0").encode() != actual_label:
+ print(
+ f"{prog}: expected label on file {file}: "
+ f"expected={expected_label} actual={actual_label.decode(errors='ignore')}",
+ file=sys.stderr,
+ )
+ errors += 1
+
+def check_label_none(file):
+ global errors
+ try:
+ r = g.lgetxattr(file, "security.selinux")
+ if r:
+ print(
+ f"{prog}: expecting no label on file {file}, "
+ f"but got {r.decode(errors='ignore')}",
+ file=sys.stderr,
+ )
+ errors += 1
+ except RuntimeError as e:
+ if "No data available" not in str(e):
+ print(
+ f"{prog}: expecting an error reading label from file {file}, "
+ f"but got {e}",
+ file=sys.stderr,
+ )
+ errors += 1
+
+check_label("/bin", "system_u:object_r:default_t:s0")
+check_label("/bin/ls", "system_u:object_r:bin_t:s0")
+check_label("/etc", "system_u:object_r:default_t:s0")
+check_label_none("/etc/file_contexts")
+check_label("/tmp", "system_u:object_r:default_t:s0")
+check_label_none("/tmp/test")
+check_label("/var", "system_u:object_r:default_t:s0")
+check_label("/var/log", "system_u:object_r:var_t:s0")
+check_label("/var/log/messages", "system_u:object_r:var_log_t:s0")
+
+# Finish up.
+g.shutdown()
+g.close()
+
+sys.exit(0 if errors == 0 else 1)

25
0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch Normal file
View File

@ -0,0 +1,25 @@
From 5b5dac9876fd2c80b6ebc186ee379d0a549b592d Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 22 Jul 2026 14:31:35 +0100
Subject: [PATCH] tests/relabel/test-setfiles.py: Add verbose logging
This is useful for debugging the test if it fails.
(cherry picked from commit 995f80c7fa4eaa843ae3c7f4fc6083512eef92dc)
---
tests/relabel/test-setfiles.py | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py
index c3609864..6b080d42 100755
--- a/tests/relabel/test-setfiles.py
+++ b/tests/relabel/test-setfiles.py
@@ -37,6 +37,8 @@ if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_po
# Create a filesystem.
g = guestfs.GuestFS(python_return_dict=True)
+g.set_verbose(True)
+g.set_trace(True)
g.add_drive_scratch(256 * 1024 * 1024)
g.launch()

43
0008-daemon-Implement-OStringList-for-OCaml-functions.patch Normal file
View File

@ -0,0 +1,43 @@
From 44834336540a32ec422117a74c4c989165cb6457 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 22 Jul 2026 14:13:35 +0100
Subject: [PATCH] daemon: Implement OStringList for OCaml functions
Implement optional string list parameters for OCaml functions. This
was unimplemented for daemon functions.
Fixes: commit fd4db60cff ("generator: Implement StringList for OCaml functions", 2025)
Fixes: commit d5b6f1df5f ("daemon: Allow parts of the daemon and APIs to be written in OCaml.", 2017)
(cherry picked from commit 9d673ed25a59880aaabef29546871263ab5f4bac)
---
daemon/daemon-c.c | 2 +-
generator/daemon.ml | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/daemon/daemon-c.c b/daemon/daemon-c.c
index 2af3eb57..a029147c 100644
--- a/daemon/daemon-c.c
+++ b/daemon/daemon-c.c
@@ -116,7 +116,7 @@ guestfs_int_daemon_copy_mountable (const mountable_t *mountable)
CAMLreturn (r);
}
-/* Implement StringList(...) parameter. */
+/* Implement StringList and OStringList parameters. */
value
guestfs_int_daemon_copy_string_list (char * const *strs)
{
diff --git a/generator/daemon.ml b/generator/daemon.ml
index 4e2b9718..d26acbc1 100644
--- a/generator/daemon.ml
+++ b/generator/daemon.ml
@@ -807,7 +807,8 @@ let generate_daemon_caml_stubs () =
pr "caml_copy_int64 (%s)" n
| OString _ ->
pr "caml_copy_string (%s)" n
- | OStringList _ -> assert false
+ | OStringList _ ->
+ pr "guestfs_int_daemon_copy_string_list (%s)" n
);
pr ";\n";
pr " args[%d] = caml_alloc (1, 0);\n" !i;

59
0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch Normal file
View File

@ -0,0 +1,59 @@
From e77b1b3e26acc42a80b0842f7cb59576e1ff46b2 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 22 Jul 2026 14:20:54 +0100
Subject: [PATCH] daemon: Add new optional excludes parameter to
guestfs_setfiles
This allows you to append strings to the built in list of exclude
directories. These are simply passed to setfiles via the -e option.
(cherry picked from commit 5364e6abbcd1ee42f23b26306225269329e7c663)
---
daemon/selinux.ml | 4 ++--
generator/actions_core.ml | 7 +++++--
2 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/daemon/selinux.ml b/daemon/selinux.ml
index 9802e891..30a54326 100644
--- a/daemon/selinux.ml
+++ b/daemon/selinux.ml
@@ -44,12 +44,12 @@ let setfiles_has_option =
Hashtbl.add h flag r;
r
-let setfiles ?(force = false) specfile paths =
+let setfiles ?(force = false) ?(excludes = []) specfile paths =
if paths = [] then ()
else (
(* Prefix /sysroot on all paths. *)
let ignored_paths =
- [ "/dev"; "/proc"; "/selinux"; "/sys" ] |>
+ [ "/dev"; "/proc"; "/selinux"; "/sys" ] @ excludes |>
List.map sysroot_path in
let specfile = sysroot_path specfile in
let paths = List.map sysroot_path paths in
diff --git a/generator/actions_core.ml b/generator/actions_core.ml
index ef2d4dd0..4261eedd 100644
--- a/generator/actions_core.ml
+++ b/generator/actions_core.ml
@@ -9543,7 +9543,7 @@ Use C<guestfs_list_dm_devices> to list all device mapper devices.|} };
{ defaults with
name = "setfiles"; added = (1, 57, 1);
- style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"];
+ style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"; OStringList "excludes"];
impl = OCaml "Selinux.setfiles";
optional = Some "selinuxrelabel";
test_excuse = "tests are in the tests/relabel directory";
@@ -9564,7 +9564,10 @@ If the list is empty, setfiles is not called.
The optional C<force> boolean controls whether the context
is reset for customizable files, and also whether the
-user, role and range parts of the file context is changed.|} };
+user, role and range parts of the file context is changed.
+
+The optional C<excludes> list allows you to exclude parts of the
+directory tree by appending the C<setfiles> I<-e> option.|} };
{ defaults with
name = "xfs_info2"; added = (1, 59, 2);

52
0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch Normal file
View File

@ -0,0 +1,52 @@
From c49ad50ceab28815158eb28e96249f38c24c2931 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Wed, 22 Jul 2026 14:28:49 +0100
Subject: [PATCH] tests/relabel/test-setfiles.py: Add a test of setfiles
excludes list
Add a test that we don't relabel directories listed in the excludes
list.
(cherry picked from commit 44d271a80308bb3898f48662aace25937481688b)
---
tests/relabel/test-setfiles.py | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py
index 6b080d42..0b0eb496 100755
--- a/tests/relabel/test-setfiles.py
+++ b/tests/relabel/test-setfiles.py
@@ -62,6 +62,8 @@ g.mount_options("user_xattr", "/dev/sda1", "/")
g.mkdir("/bin")
g.touch("/bin/ls")
g.mkdir("/etc")
+g.mkdir("/lib")
+g.touch("/lib/libc.so")
g.mkdir("/tmp")
g.touch("/tmp/test")
g.mkdir("/var")
@@ -75,13 +77,14 @@ g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0
/bin/.* system_u:object_r:bin_t:s0
/etc/.* system_u:object_r:etc_t:s0
/etc/file_contexts <<none>>
+/lib/.* system_u:object_r:lib_t:s0
/tmp/.* <<none>>
/var/.* system_u:object_r:var_t:s0
/var/log/.* system_u:object_r:var_log_t:s0
""")
# Do the relabel.
-g.setfiles("/etc/file_contexts", "/", force=True)
+g.setfiles("/etc/file_contexts", "/", force=True, excludes=["/lib", "/lib64"])
# Check the labels were set correctly.
errors = 0
@@ -122,6 +125,8 @@ check_label("/bin", "system_u:object_r:default_t:s0")
check_label("/bin/ls", "system_u:object_r:bin_t:s0")
check_label("/etc", "system_u:object_r:default_t:s0")
check_label_none("/etc/file_contexts")
+check_label_none("/lib") # because /lib in excludes
+check_label_none("/lib/libc.so") # because /lib in excludes
check_label("/tmp", "system_u:object_r:default_t:s0")
check_label_none("/tmp/test")
check_label("/var", "system_u:object_r:default_t:s0")

27
copy-patches.sh
View File

@ -7,24 +7,30 @@ set -e
# it like this:
# ./copy-patches.sh
project=libguestfs
rhel_version=10.3
# Check we're in the right directory.
if [ ! -f libguestfs.spec ]; then
echo "$0: run this from the directory containing 'libguestfs.spec'"
if [ ! -f $project.spec ]; then
echo "$0: run this from the directory containing '$project.spec'"
exit 1
fi
git_checkout=$HOME/d/libguestfs-rhel-$rhel_version
case `id -un` in
rjones) git_checkout=$HOME/d/$project-rhel-$rhel_version ;;
lacos) git_checkout=$HOME/src/v2v/$project ;;
sparimi) git_checkout=$HOME/rhel10.3/upstream/$project ;;
*) git_checkout=$HOME/d/$project-rhel-$rhel_version ;;
esac
if [ ! -d $git_checkout ]; then
echo "$0: $git_checkout does not exist"
echo "This script is only for use by the maintainer when preparing a"
echo "libguestfs release on RHEL."
echo "$project release on RHEL."
exit 1
fi
# Get the base version of libguestfs.
version=`grep '^Version:' libguestfs.spec | awk '{print $2}'`
# Get the base version of $project.
version=`grep '^Version:' $project.spec | awk '{print $2}'`
tag="v$version"
# Remove any existing patches.
@ -32,7 +38,12 @@ git rm -f [0-9]*.patch ||:
rm -f [0-9]*.patch
# Get the patches.
(cd $git_checkout; rm -f [0-9]*.patch; git format-patch -N --submodule=diff $tag)
(
cd $git_checkout
rm -f [0-9]*.patch
git -c core.abbrev=8 format-patch -O/dev/null --subject-prefix=PATCH -N \
--submodule=diff --no-signature --patience $tag
)
mv $git_checkout/[0-9]*.patch .
# Remove any not to be applied.
@ -43,7 +54,7 @@ git add [0-9]*.patch
# Print out the patch lines.
echo
echo "--- Copy the following text into libguestfs.spec file"
echo "--- Copy the following text into $project.spec file"
echo
echo "# Patches."

12
libguestfs.spec
View File

@ -35,7 +35,7 @@ Summary: Access and modify virtual machine disk images
Name: libguestfs
Epoch: 1
Version: 1.60.1
Release: 1%{?dist}
Release: 2%{?dist}
License: LGPL-2.1-or-later
# Build only for architectures that have a kernel
@ -80,6 +80,12 @@ Patch0001: 0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch
Patch0002: 0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch
Patch0003: 0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch
Patch0004: 0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch
Patch0005: 0005-generator-Point-deprecated-SELinux-functions-to-gues.patch
Patch0006: 0006-tests-relabel-Add-a-new-test-for-setfiles.patch
Patch0007: 0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch
Patch0008: 0008-daemon-Implement-OStringList-for-OCaml-functions.patch
Patch0009: 0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch
Patch0010: 0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch
BuildRequires: autoconf, automake, libtool, gettext-devel
@ -1031,6 +1037,10 @@ rm ocaml/html/.gitignore
%changelog
* Mon Aug 17 2026 Srihari Parimi <sparimi@redhat.com> - 1:1.60.1-2
- Add setfiles optional excludes parameter to libguestfs
resolves: RHEL-232890
* Tue Jul 14 2026 Richard W.M. Jones <rjones@redhat.com> - 1:1.60.1-1
- Rebase to libguestfs 1.60.1
Synchronize spec file with Fedora