diff --git a/0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch b/0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch index efed341..081c5cc 100644 --- a/0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch +++ b/0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch @@ -26,7 +26,7 @@ Note 'nbd' is not disabled, and of course 'file' works. 8 files changed, 8 insertions(+), 336 deletions(-) diff --git a/docs/guestfs-testing.pod b/docs/guestfs-testing.pod -index 45ebe2941..a02f766c9 100644 +index 45ebe294..a02f766c 100644 --- a/docs/guestfs-testing.pod +++ b/docs/guestfs-testing.pod @@ -109,26 +109,6 @@ image. To exit, type C. @@ -57,7 +57,7 @@ index 45ebe2941..a02f766c9 100644 Run L on guests or disk images: diff --git a/fish/guestfish.pod b/fish/guestfish.pod -index ac14ea5a4..8d4d488fc 100644 +index ac14ea5a..8d4d488f 100644 --- a/fish/guestfish.pod +++ b/fish/guestfish.pod @@ -131,9 +131,9 @@ To list what is available do: @@ -142,7 +142,7 @@ index ac14ea5a4..8d4d488fc 100644 In this case, the password is C. diff --git a/fish/test-add-uri.sh b/fish/test-add-uri.sh -index e4e1021db..8419ce78a 100755 +index e4e1021d..8419ce78 100755 --- a/fish/test-add-uri.sh +++ b/fish/test-add-uri.sh @@ -40,10 +40,6 @@ function fail () @@ -180,7 +180,7 @@ index e4e1021db..8419ce78a 100755 rm test-add-uri.out rm test-add-uri.img diff --git a/generator/actions_core.ml b/generator/actions_core.ml -index cfd767793..ef2d4dd06 100644 +index cfd76779..ef2d4dd0 100644 --- a/generator/actions_core.ml +++ b/generator/actions_core.ml @@ -343,22 +343,6 @@ F is interpreted as a local file or device. @@ -249,7 +249,7 @@ index cfd767793..ef2d4dd06 100644 example if using the libvirt backend and if the libvirt backend is configured to start the qemu appliance as a special user such as C. If in doubt, diff --git a/lib/drives.c b/lib/drives.c -index edb1e060f..c3fb90ae8 100644 +index edb1e060..c3fb90ae 100644 --- a/lib/drives.c +++ b/lib/drives.c @@ -166,34 +166,6 @@ create_drive_non_file (guestfs_h *g, @@ -394,7 +394,7 @@ index edb1e060f..c3fb90ae8 100644 error (g, _("unknown protocol ‘%s’"), protocol); drv = NULL; /*FALLTHROUGH*/ diff --git a/lib/guestfs.pod b/lib/guestfs.pod -index 0c58e0d6b..fe74f5542 100644 +index 0c58e0d6..fe74f554 100644 --- a/lib/guestfs.pod +++ b/lib/guestfs.pod @@ -723,51 +723,6 @@ a qcow2 backing file specification, libvirt does not construct an @@ -479,7 +479,7 @@ index 0c58e0d6b..fe74f5542 100644 Libguestfs has APIs for inspecting an unknown disk image to find out diff --git a/tests/disks/test-qemu-drive-libvirt.sh b/tests/disks/test-qemu-drive-libvirt.sh -index 485d75718..e917cd1a6 100755 +index 485d7571..e917cd1a 100755 --- a/tests/disks/test-qemu-drive-libvirt.sh +++ b/tests/disks/test-qemu-drive-libvirt.sh @@ -65,13 +65,6 @@ check_output @@ -497,7 +497,7 @@ index 485d75718..e917cd1a6 100755 $guestfish -d nbd run ||: diff --git a/tests/disks/test-qemu-drive.sh b/tests/disks/test-qemu-drive.sh -index f5ecccc3c..d699d37ca 100755 +index f5ecccc3..d699d37c 100755 --- a/tests/disks/test-qemu-drive.sh +++ b/tests/disks/test-qemu-drive.sh @@ -64,35 +64,6 @@ check_output @@ -551,6 +551,3 @@ index f5ecccc3c..d699d37ca 100755 -check_output -grep -sq -- '-drive file=ssh://rich@example.com/disk.img,' "$DEBUG_QEMU_FILE" || fail -rm "$DEBUG_QEMU_FILE" --- -2.47.3 - diff --git a/0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch b/0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch index 146a671..8bab09e 100644 --- a/0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch +++ b/0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch @@ -13,7 +13,7 @@ edits. 3 files changed, 19 insertions(+) diff --git a/generator/c.ml b/generator/c.ml -index f1217c659..923c2be38 100644 +index f1217c65..923c2be3 100644 --- a/generator/c.ml +++ b/generator/c.ml @@ -1834,6 +1834,22 @@ and generate_client_actions actions () = @@ -40,7 +40,7 @@ index f1217c659..923c2be38 100644 * as a progress bar hint. *) diff --git a/test-data/phony-guests/make-windows-img.sh b/test-data/phony-guests/make-windows-img.sh -index 0ec6b4851..9fa29f98b 100755 +index 0ec6b485..9fa29f98 100755 --- a/test-data/phony-guests/make-windows-img.sh +++ b/test-data/phony-guests/make-windows-img.sh @@ -37,6 +37,7 @@ fi @@ -52,7 +52,7 @@ index 0ec6b4851..9fa29f98b 100755 run diff --git a/tests/charsets/test-charset-fidelity.c b/tests/charsets/test-charset-fidelity.c -index 105291dc3..5ca4f3b6d 100644 +index 105291dc..5ca4f3b6 100644 --- a/tests/charsets/test-charset-fidelity.c +++ b/tests/charsets/test-charset-fidelity.c @@ -96,6 +96,8 @@ main (int argc, char *argv[]) @@ -64,6 +64,3 @@ index 105291dc3..5ca4f3b6d 100644 if (guestfs_add_drive_scratch (g, 1024*1024*1024, -1) == -1) exit (EXIT_FAILURE); --- -2.47.3 - diff --git a/0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch b/0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch index 7ba439c..1131594 100644 --- a/0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch +++ b/0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch @@ -9,7 +9,7 @@ Subject: [PATCH] RHEL: appliance/init: Run depmod -a to rebuild kernel module 1 file changed, 3 insertions(+) diff --git a/appliance/init b/appliance/init -index 222c14667..0c74183eb 100755 +index 222c1466..0c74183e 100755 --- a/appliance/init +++ b/appliance/init @@ -117,6 +117,9 @@ udevadm trigger @@ -22,6 +22,3 @@ index 222c14667..0c74183eb 100755 # Disk optimizations. # Increase the SCSI timeout so we can read remote images. shopt -s nullglob --- -2.47.3 - diff --git a/0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch b/0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch index 760d528..dac2eb2 100644 --- a/0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch +++ b/0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch @@ -10,7 +10,7 @@ to find qemu on RHEL. 1 file changed, 5 insertions(+) diff --git a/lib/launch-direct.c b/lib/launch-direct.c -index b2021ee2c..12f969c7e 100644 +index b2021ee2..12f969c7 100644 --- a/lib/launch-direct.c +++ b/lib/launch-direct.c @@ -446,6 +446,11 @@ free_pid_path: @@ -25,6 +25,3 @@ index b2021ee2c..12f969c7e 100644 if (host_cpu[0] == 'i' && strchr ("3456", host_cpu[1]) && host_cpu[2] == '8' && host_cpu[3] == '6' && host_cpu[4] == '\0') return "qemu-system-i386"; --- -2.47.3 - diff --git a/0005-generator-Point-deprecated-SELinux-functions-to-gues.patch b/0005-generator-Point-deprecated-SELinux-functions-to-gues.patch new file mode 100644 index 0000000..1196834 --- /dev/null +++ b/0005-generator-Point-deprecated-SELinux-functions-to-gues.patch @@ -0,0 +1,64 @@ +From 96b202f793f110e2125955ce9b714b8498344149 Mon Sep 17 00:00:00 2001 +From: Srihari Parimi +Date: Wed, 12 Aug 2026 06:54:21 -0400 +Subject: [PATCH] generator: Point deprecated SELinux functions to + guestfs_setfiles + +The four functions guestfs_{set_selinux,get_selinux,setcon,getcon} +have been deprecated for a very long time. Previously the deprecation +message pointed to the also now-deprecated guestfs_selinux_relabel. +Point it instead to the guestfs_setfiles function. + +This just changes documentation and warning messages and has no other +effects. + +(cherry picked from commit 287784095647673b2c81134dc5d5ecf4460df494) +--- + generator/actions_core_deprecated.ml | 4 ++-- + generator/actions_properties_deprecated.ml | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/generator/actions_core_deprecated.ml b/generator/actions_core_deprecated.ml +index d930b8b8..f3c444ee 100644 +--- a/generator/actions_core_deprecated.ml ++++ b/generator/actions_core_deprecated.ml +@@ -565,7 +565,7 @@ attaches it as a device.|} }; + name = "setcon"; added = (1, 0, 67); + style = RErr, [String (PlainString, "context")], []; + optional = Some "selinux"; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "set SELinux security context"; + longdesc = "\ + This sets the SELinux security context of the daemon +@@ -577,7 +577,7 @@ See the documentation about SELINUX in L." }; + name = "getcon"; added = (1, 0, 67); + style = RString (RPlainString, "context"), [], []; + optional = Some "selinux"; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "get SELinux security context"; + longdesc = "\ + This gets the SELinux security context of the daemon. +diff --git a/generator/actions_properties_deprecated.ml b/generator/actions_properties_deprecated.ml +index 7fa49d44..3936a665 100644 +--- a/generator/actions_properties_deprecated.ml ++++ b/generator/actions_properties_deprecated.ml +@@ -64,7 +64,7 @@ return the default qemu binary name." }; + style = RErr, [Bool "selinux"], []; + fish_alias = ["selinux"]; config_only = true; + blocking = false; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "set SELinux enabled or disabled at appliance boot"; + longdesc = {|This sets the selinux flag that is passed to the appliance + at boot time. The default is C (disabled). +@@ -79,7 +79,7 @@ see L.|} }; + name = "get_selinux"; added = (1, 0, 67); + style = RBool "selinux", [], []; + blocking = false; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "get SELinux enabled flag"; + longdesc = {|This returns the current setting of the selinux flag which + is passed to the appliance at boot time. See C. diff --git a/0006-tests-relabel-Add-a-new-test-for-setfiles.patch b/0006-tests-relabel-Add-a-new-test-for-setfiles.patch new file mode 100644 index 0000000..15efafd --- /dev/null +++ b/0006-tests-relabel-Add-a-new-test-for-setfiles.patch @@ -0,0 +1,191 @@ +From 178256768566184a6d7b7dba16e3b64a68439542 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:25:19 +0100 +Subject: [PATCH] tests/relabel: Add a new test for setfiles + +Previously we tested only the deprecated guestfs_selinux_relabel +function. Add a new test for guestfs_setfiles. Since the APIs and +their usage are very similar, the test is basically the same at the +moment. + +(cherry picked from commit 3567dc6fe9685a1695bfff396fbeb15601c67eaa) +--- + tests/Makefile.am | 10 ++- + tests/relabel/test-relabel.py | 2 + + tests/relabel/test-setfiles.py | 133 +++++++++++++++++++++++++++++++++ + 3 files changed, 143 insertions(+), 2 deletions(-) + create mode 100755 tests/relabel/test-setfiles.py + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index 082217f9..3d60fc43 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -748,8 +748,14 @@ regressions_test_big_heap_LDADD = \ + SLOW_TESTS += regressions/rhbz909624.sh + EXTRA_DIST += regressions/rhbz909624.sh + +-TESTS += relabel/test-relabel.py +-EXTRA_DIST += relabel/test-relabel.py ++TESTS += \ ++ relabel/test-relabel.py \ ++ relabel/test-setfiles.py \ ++ $(NULL) ++EXTRA_DIST += \ ++ relabel/test-relabel.py \ ++ relabel/test-setfiles.py \ ++ $(NULL) + + # Test relative paths to backing files. Mainly this is a test that we + # don't break this. +diff --git a/tests/relabel/test-relabel.py b/tests/relabel/test-relabel.py +index c2c4c5e4..83e09ea8 100755 +--- a/tests/relabel/test-relabel.py ++++ b/tests/relabel/test-relabel.py +@@ -15,6 +15,8 @@ + # along with this program; if not, write to the Free Software + # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + ++# Test the deprecated selinux_relabel function. ++ + import os + import sys + import guestfs +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +new file mode 100755 +index 00000000..c3609864 +--- /dev/null ++++ b/tests/relabel/test-setfiles.py +@@ -0,0 +1,133 @@ ++#!/usr/bin/env python3 ++# Copyright (C) 2025-2026 Red Hat Inc. ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++ ++# Test the setfiles function. ++ ++import os ++import sys ++import guestfs ++ ++prog = os.path.basename(sys.argv[0]) ++# Because we parse error message strings below. ++os.environ["LANG"] = "C" ++ ++if os.environ.get("SKIP_TEST_SETFILES_PY"): ++ print(f"{prog}: test skipped because environment variable is set.") ++ sys.exit(77) ++ ++# SELinux labelling won't work (and can be skipped) if SELinux isn't ++# installed on the host. ++if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_policy", os.X_OK): ++ print(f"{prog}: test skipped because SELinux is not available.") ++ sys.exit(77) ++ ++# Create a filesystem. ++g = guestfs.GuestFS(python_return_dict=True) ++g.add_drive_scratch(256 * 1024 * 1024) ++g.launch() ++ ++# If Linux extended attrs aren't available then we cannot test this. ++if not g.feature_available(["linuxxattrs"]): ++ print(f"{prog}: test skipped because 'linuxxattrs' feature not available.") ++ g.close() ++ sys.exit(77) ++ ++# If SELinux relabelling is not available then we cannot test this. ++if not g.feature_available(["selinuxrelabel"]): ++ print(f"{prog}: test skipped because 'selinuxrelabel' feature not available.") ++ g.close() ++ sys.exit(77) ++ ++g.part_disk("/dev/sda", "mbr") ++g.mkfs("ext4", "/dev/sda1") ++g.mount_options("user_xattr", "/dev/sda1", "/") ++ ++# Create some files and directories that we want to have relabelled. ++g.mkdir("/bin") ++g.touch("/bin/ls") ++g.mkdir("/etc") ++g.mkdir("/tmp") ++g.touch("/tmp/test") ++g.mkdir("/var") ++g.mkdir("/var/log") ++g.touch("/var/log/messages") ++ ++# Create a spec file. ++# This doesn't test the optional file_type field. XXX ++# See also file_contexts(5). ++g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0 ++/bin/.* system_u:object_r:bin_t:s0 ++/etc/.* system_u:object_r:etc_t:s0 ++/etc/file_contexts <> ++/tmp/.* <> ++/var/.* system_u:object_r:var_t:s0 ++/var/log/.* system_u:object_r:var_log_t:s0 ++""") ++ ++# Do the relabel. ++g.setfiles("/etc/file_contexts", "/", force=True) ++ ++# Check the labels were set correctly. ++errors = 0 ++ ++def check_label(file, expected_label): ++ global errors ++ actual_label = g.lgetxattr(file, "security.selinux") ++ # The label returned from lgetxattr has \0 appended. ++ if (expected_label + "\0").encode() != actual_label: ++ print( ++ f"{prog}: expected label on file {file}: " ++ f"expected={expected_label} actual={actual_label.decode(errors='ignore')}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ ++def check_label_none(file): ++ global errors ++ try: ++ r = g.lgetxattr(file, "security.selinux") ++ if r: ++ print( ++ f"{prog}: expecting no label on file {file}, " ++ f"but got {r.decode(errors='ignore')}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ except RuntimeError as e: ++ if "No data available" not in str(e): ++ print( ++ f"{prog}: expecting an error reading label from file {file}, " ++ f"but got {e}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ ++check_label("/bin", "system_u:object_r:default_t:s0") ++check_label("/bin/ls", "system_u:object_r:bin_t:s0") ++check_label("/etc", "system_u:object_r:default_t:s0") ++check_label_none("/etc/file_contexts") ++check_label("/tmp", "system_u:object_r:default_t:s0") ++check_label_none("/tmp/test") ++check_label("/var", "system_u:object_r:default_t:s0") ++check_label("/var/log", "system_u:object_r:var_t:s0") ++check_label("/var/log/messages", "system_u:object_r:var_log_t:s0") ++ ++# Finish up. ++g.shutdown() ++g.close() ++ ++sys.exit(0 if errors == 0 else 1) diff --git a/0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch b/0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch new file mode 100644 index 0000000..3229a61 --- /dev/null +++ b/0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch @@ -0,0 +1,25 @@ +From 5b5dac9876fd2c80b6ebc186ee379d0a549b592d Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:31:35 +0100 +Subject: [PATCH] tests/relabel/test-setfiles.py: Add verbose logging + +This is useful for debugging the test if it fails. + +(cherry picked from commit 995f80c7fa4eaa843ae3c7f4fc6083512eef92dc) +--- + tests/relabel/test-setfiles.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +index c3609864..6b080d42 100755 +--- a/tests/relabel/test-setfiles.py ++++ b/tests/relabel/test-setfiles.py +@@ -37,6 +37,8 @@ if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_po + + # Create a filesystem. + g = guestfs.GuestFS(python_return_dict=True) ++g.set_verbose(True) ++g.set_trace(True) + g.add_drive_scratch(256 * 1024 * 1024) + g.launch() + diff --git a/0008-daemon-Implement-OStringList-for-OCaml-functions.patch b/0008-daemon-Implement-OStringList-for-OCaml-functions.patch new file mode 100644 index 0000000..a3db130 --- /dev/null +++ b/0008-daemon-Implement-OStringList-for-OCaml-functions.patch @@ -0,0 +1,43 @@ +From 44834336540a32ec422117a74c4c989165cb6457 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:13:35 +0100 +Subject: [PATCH] daemon: Implement OStringList for OCaml functions + +Implement optional string list parameters for OCaml functions. This +was unimplemented for daemon functions. + +Fixes: commit fd4db60cff ("generator: Implement StringList for OCaml functions", 2025) +Fixes: commit d5b6f1df5f ("daemon: Allow parts of the daemon and APIs to be written in OCaml.", 2017) +(cherry picked from commit 9d673ed25a59880aaabef29546871263ab5f4bac) +--- + daemon/daemon-c.c | 2 +- + generator/daemon.ml | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/daemon/daemon-c.c b/daemon/daemon-c.c +index 2af3eb57..a029147c 100644 +--- a/daemon/daemon-c.c ++++ b/daemon/daemon-c.c +@@ -116,7 +116,7 @@ guestfs_int_daemon_copy_mountable (const mountable_t *mountable) + CAMLreturn (r); + } + +-/* Implement StringList(...) parameter. */ ++/* Implement StringList and OStringList parameters. */ + value + guestfs_int_daemon_copy_string_list (char * const *strs) + { +diff --git a/generator/daemon.ml b/generator/daemon.ml +index 4e2b9718..d26acbc1 100644 +--- a/generator/daemon.ml ++++ b/generator/daemon.ml +@@ -807,7 +807,8 @@ let generate_daemon_caml_stubs () = + pr "caml_copy_int64 (%s)" n + | OString _ -> + pr "caml_copy_string (%s)" n +- | OStringList _ -> assert false ++ | OStringList _ -> ++ pr "guestfs_int_daemon_copy_string_list (%s)" n + ); + pr ";\n"; + pr " args[%d] = caml_alloc (1, 0);\n" !i; diff --git a/0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch b/0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch new file mode 100644 index 0000000..8f3fe1b --- /dev/null +++ b/0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch @@ -0,0 +1,59 @@ +From e77b1b3e26acc42a80b0842f7cb59576e1ff46b2 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:20:54 +0100 +Subject: [PATCH] daemon: Add new optional excludes parameter to + guestfs_setfiles + +This allows you to append strings to the built in list of exclude +directories. These are simply passed to setfiles via the -e option. + +(cherry picked from commit 5364e6abbcd1ee42f23b26306225269329e7c663) +--- + daemon/selinux.ml | 4 ++-- + generator/actions_core.ml | 7 +++++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/daemon/selinux.ml b/daemon/selinux.ml +index 9802e891..30a54326 100644 +--- a/daemon/selinux.ml ++++ b/daemon/selinux.ml +@@ -44,12 +44,12 @@ let setfiles_has_option = + Hashtbl.add h flag r; + r + +-let setfiles ?(force = false) specfile paths = ++let setfiles ?(force = false) ?(excludes = []) specfile paths = + if paths = [] then () + else ( + (* Prefix /sysroot on all paths. *) + let ignored_paths = +- [ "/dev"; "/proc"; "/selinux"; "/sys" ] |> ++ [ "/dev"; "/proc"; "/selinux"; "/sys" ] @ excludes |> + List.map sysroot_path in + let specfile = sysroot_path specfile in + let paths = List.map sysroot_path paths in +diff --git a/generator/actions_core.ml b/generator/actions_core.ml +index ef2d4dd0..4261eedd 100644 +--- a/generator/actions_core.ml ++++ b/generator/actions_core.ml +@@ -9543,7 +9543,7 @@ Use C to list all device mapper devices.|} }; + + { defaults with + name = "setfiles"; added = (1, 57, 1); +- style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"]; ++ style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"; OStringList "excludes"]; + impl = OCaml "Selinux.setfiles"; + optional = Some "selinuxrelabel"; + test_excuse = "tests are in the tests/relabel directory"; +@@ -9564,7 +9564,10 @@ If the list is empty, setfiles is not called. + + The optional C boolean controls whether the context + is reset for customizable files, and also whether the +-user, role and range parts of the file context is changed.|} }; ++user, role and range parts of the file context is changed. ++ ++The optional C list allows you to exclude parts of the ++directory tree by appending the C I<-e> option.|} }; + + { defaults with + name = "xfs_info2"; added = (1, 59, 2); diff --git a/0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch b/0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch new file mode 100644 index 0000000..d55d550 --- /dev/null +++ b/0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch @@ -0,0 +1,52 @@ +From c49ad50ceab28815158eb28e96249f38c24c2931 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:28:49 +0100 +Subject: [PATCH] tests/relabel/test-setfiles.py: Add a test of setfiles + excludes list + +Add a test that we don't relabel directories listed in the excludes +list. + +(cherry picked from commit 44d271a80308bb3898f48662aace25937481688b) +--- + tests/relabel/test-setfiles.py | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +index 6b080d42..0b0eb496 100755 +--- a/tests/relabel/test-setfiles.py ++++ b/tests/relabel/test-setfiles.py +@@ -62,6 +62,8 @@ g.mount_options("user_xattr", "/dev/sda1", "/") + g.mkdir("/bin") + g.touch("/bin/ls") + g.mkdir("/etc") ++g.mkdir("/lib") ++g.touch("/lib/libc.so") + g.mkdir("/tmp") + g.touch("/tmp/test") + g.mkdir("/var") +@@ -75,13 +77,14 @@ g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0 + /bin/.* system_u:object_r:bin_t:s0 + /etc/.* system_u:object_r:etc_t:s0 + /etc/file_contexts <> ++/lib/.* system_u:object_r:lib_t:s0 + /tmp/.* <> + /var/.* system_u:object_r:var_t:s0 + /var/log/.* system_u:object_r:var_log_t:s0 + """) + + # Do the relabel. +-g.setfiles("/etc/file_contexts", "/", force=True) ++g.setfiles("/etc/file_contexts", "/", force=True, excludes=["/lib", "/lib64"]) + + # Check the labels were set correctly. + errors = 0 +@@ -122,6 +125,8 @@ check_label("/bin", "system_u:object_r:default_t:s0") + check_label("/bin/ls", "system_u:object_r:bin_t:s0") + check_label("/etc", "system_u:object_r:default_t:s0") + check_label_none("/etc/file_contexts") ++check_label_none("/lib") # because /lib in excludes ++check_label_none("/lib/libc.so") # because /lib in excludes + check_label("/tmp", "system_u:object_r:default_t:s0") + check_label_none("/tmp/test") + check_label("/var", "system_u:object_r:default_t:s0") diff --git a/copy-patches.sh b/copy-patches.sh index 6720efa..afba4c0 100755 --- a/copy-patches.sh +++ b/copy-patches.sh @@ -7,24 +7,30 @@ set -e # it like this: # ./copy-patches.sh +project=libguestfs rhel_version=10.3 # Check we're in the right directory. -if [ ! -f libguestfs.spec ]; then - echo "$0: run this from the directory containing 'libguestfs.spec'" +if [ ! -f $project.spec ]; then + echo "$0: run this from the directory containing '$project.spec'" exit 1 fi -git_checkout=$HOME/d/libguestfs-rhel-$rhel_version +case `id -un` in + rjones) git_checkout=$HOME/d/$project-rhel-$rhel_version ;; + lacos) git_checkout=$HOME/src/v2v/$project ;; + sparimi) git_checkout=$HOME/rhel10.3/upstream/$project ;; + *) git_checkout=$HOME/d/$project-rhel-$rhel_version ;; +esac if [ ! -d $git_checkout ]; then echo "$0: $git_checkout does not exist" echo "This script is only for use by the maintainer when preparing a" - echo "libguestfs release on RHEL." + echo "$project release on RHEL." exit 1 fi -# Get the base version of libguestfs. -version=`grep '^Version:' libguestfs.spec | awk '{print $2}'` +# Get the base version of $project. +version=`grep '^Version:' $project.spec | awk '{print $2}'` tag="v$version" # Remove any existing patches. @@ -32,7 +38,12 @@ git rm -f [0-9]*.patch ||: rm -f [0-9]*.patch # Get the patches. -(cd $git_checkout; rm -f [0-9]*.patch; git format-patch -N --submodule=diff $tag) +( + cd $git_checkout + rm -f [0-9]*.patch + git -c core.abbrev=8 format-patch -O/dev/null --subject-prefix=PATCH -N \ + --submodule=diff --no-signature --patience $tag +) mv $git_checkout/[0-9]*.patch . # Remove any not to be applied. @@ -43,7 +54,7 @@ git add [0-9]*.patch # Print out the patch lines. echo -echo "--- Copy the following text into libguestfs.spec file" +echo "--- Copy the following text into $project.spec file" echo echo "# Patches." diff --git a/libguestfs.spec b/libguestfs.spec index 768738c..3080c95 100644 --- a/libguestfs.spec +++ b/libguestfs.spec @@ -35,7 +35,7 @@ Summary: Access and modify virtual machine disk images Name: libguestfs Epoch: 1 Version: 1.60.1 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPL-2.1-or-later # Build only for architectures that have a kernel @@ -80,6 +80,12 @@ Patch0001: 0001-RHEL-Disable-unsupported-remote-drive-protocols-RHBZ.patch Patch0002: 0002-RHEL-Reject-use-of-libguestfs-winsupport-features-ex.patch Patch0003: 0003-RHEL-appliance-init-Run-depmod-a-to-rebuild-kernel-m.patch Patch0004: 0004-RHEL-Use-alternate-location-for-qemu-kvm-in-direct-b.patch +Patch0005: 0005-generator-Point-deprecated-SELinux-functions-to-gues.patch +Patch0006: 0006-tests-relabel-Add-a-new-test-for-setfiles.patch +Patch0007: 0007-tests-relabel-test-setfiles.py-Add-verbose-logging.patch +Patch0008: 0008-daemon-Implement-OStringList-for-OCaml-functions.patch +Patch0009: 0009-daemon-Add-new-optional-excludes-parameter-to-guestf.patch +Patch0010: 0010-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch BuildRequires: autoconf, automake, libtool, gettext-devel @@ -1031,6 +1037,10 @@ rm ocaml/html/.gitignore %changelog +* Mon Aug 17 2026 Srihari Parimi - 1:1.60.1-2 +- Add setfiles optional excludes parameter to libguestfs + resolves: RHEL-232890 + * Tue Jul 14 2026 Richard W.M. Jones - 1:1.60.1-1 - Rebase to libguestfs 1.60.1 Synchronize spec file with Fedora