diff --git a/0030-generator-Point-deprecated-SELinux-functions-to-gues.patch b/0030-generator-Point-deprecated-SELinux-functions-to-gues.patch new file mode 100644 index 0000000..50568a3 --- /dev/null +++ b/0030-generator-Point-deprecated-SELinux-functions-to-gues.patch @@ -0,0 +1,67 @@ +From 6b63f86f8dd6b66aa7ee29fe4b1b6388192de446 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:02:17 +0100 +Subject: [PATCH] generator: Point deprecated SELinux functions to + guestfs_setfiles + +The four functions guestfs_{set_selinux,get_selinux,setcon,getcon} +have been deprecated for a very long time. Previously the deprecation +message pointed to the also now-deprecated guestfs_selinux_relabel. +Point it instead to the guestfs_setfiles function. + +This just changes documentation and warning messages and has no other +effects. + +(cherry picked from commit 287784095647673b2c81134dc5d5ecf4460df494) +--- + generator/actions_core_deprecated.ml | 4 ++-- + generator/actions_properties_deprecated.ml | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/generator/actions_core_deprecated.ml b/generator/actions_core_deprecated.ml +index d930b8b88..f3c444ee1 100644 +--- a/generator/actions_core_deprecated.ml ++++ b/generator/actions_core_deprecated.ml +@@ -565,7 +565,7 @@ attaches it as a device.|} }; + name = "setcon"; added = (1, 0, 67); + style = RErr, [String (PlainString, "context")], []; + optional = Some "selinux"; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "set SELinux security context"; + longdesc = "\ + This sets the SELinux security context of the daemon +@@ -577,7 +577,7 @@ See the documentation about SELINUX in L." }; + name = "getcon"; added = (1, 0, 67); + style = RString (RPlainString, "context"), [], []; + optional = Some "selinux"; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "get SELinux security context"; + longdesc = "\ + This gets the SELinux security context of the daemon. +diff --git a/generator/actions_properties_deprecated.ml b/generator/actions_properties_deprecated.ml +index 9e9369ce9..9c8597ca6 100644 +--- a/generator/actions_properties_deprecated.ml ++++ b/generator/actions_properties_deprecated.ml +@@ -71,7 +71,7 @@ return the default qemu binary name." }; + style = RErr, [Bool "selinux"], []; + fish_alias = ["selinux"]; config_only = true; + blocking = false; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "set SELinux enabled or disabled at appliance boot"; + longdesc = {|This sets the selinux flag that is passed to the appliance + at boot time. The default is C (disabled). +@@ -86,7 +86,7 @@ see L.|} }; + name = "get_selinux"; added = (1, 0, 67); + style = RBool "selinux", [], []; + blocking = false; +- deprecated_by = Replaced_by "selinux_relabel"; ++ deprecated_by = Replaced_by "setfiles"; + shortdesc = "get SELinux enabled flag"; + longdesc = {|This returns the current setting of the selinux flag which + is passed to the appliance at boot time. See C. +-- +2.47.3 + diff --git a/0031-tests-relabel-Add-a-new-test-for-setfiles.patch b/0031-tests-relabel-Add-a-new-test-for-setfiles.patch new file mode 100644 index 0000000..565921d --- /dev/null +++ b/0031-tests-relabel-Add-a-new-test-for-setfiles.patch @@ -0,0 +1,194 @@ +From dc1c3f25709aa675cfe045b5cf9e5444c4034f0c Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:25:19 +0100 +Subject: [PATCH] tests/relabel: Add a new test for setfiles + +Previously we tested only the deprecated guestfs_selinux_relabel +function. Add a new test for guestfs_setfiles. Since the APIs and +their usage are very similar, the test is basically the same at the +moment. + +(cherry picked from commit 3567dc6fe9685a1695bfff396fbeb15601c67eaa) +--- + tests/Makefile.am | 10 ++- + tests/relabel/test-relabel.py | 2 + + tests/relabel/test-setfiles.py | 133 +++++++++++++++++++++++++++++++++ + 3 files changed, 143 insertions(+), 2 deletions(-) + create mode 100755 tests/relabel/test-setfiles.py + +diff --git a/tests/Makefile.am b/tests/Makefile.am +index f4d92eaa7..f59ec4a25 100644 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am +@@ -735,8 +735,14 @@ regressions_test_big_heap_LDADD = \ + SLOW_TESTS += regressions/rhbz909624.sh + EXTRA_DIST += regressions/rhbz909624.sh + +-TESTS += relabel/test-relabel.py +-EXTRA_DIST += relabel/test-relabel.py ++TESTS += \ ++ relabel/test-relabel.py \ ++ relabel/test-setfiles.py \ ++ $(NULL) ++EXTRA_DIST += \ ++ relabel/test-relabel.py \ ++ relabel/test-setfiles.py \ ++ $(NULL) + + # Test relative paths to backing files. Mainly this is a test that we + # don't break this. +diff --git a/tests/relabel/test-relabel.py b/tests/relabel/test-relabel.py +index c2c4c5e41..83e09ea86 100755 +--- a/tests/relabel/test-relabel.py ++++ b/tests/relabel/test-relabel.py +@@ -15,6 +15,8 @@ + # along with this program; if not, write to the Free Software + # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + ++# Test the deprecated selinux_relabel function. ++ + import os + import sys + import guestfs +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +new file mode 100755 +index 000000000..c36098645 +--- /dev/null ++++ b/tests/relabel/test-setfiles.py +@@ -0,0 +1,133 @@ ++#!/usr/bin/env python3 ++# Copyright (C) 2025-2026 Red Hat Inc. ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program; if not, write to the Free Software ++# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++ ++# Test the setfiles function. ++ ++import os ++import sys ++import guestfs ++ ++prog = os.path.basename(sys.argv[0]) ++# Because we parse error message strings below. ++os.environ["LANG"] = "C" ++ ++if os.environ.get("SKIP_TEST_SETFILES_PY"): ++ print(f"{prog}: test skipped because environment variable is set.") ++ sys.exit(77) ++ ++# SELinux labelling won't work (and can be skipped) if SELinux isn't ++# installed on the host. ++if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_policy", os.X_OK): ++ print(f"{prog}: test skipped because SELinux is not available.") ++ sys.exit(77) ++ ++# Create a filesystem. ++g = guestfs.GuestFS(python_return_dict=True) ++g.add_drive_scratch(256 * 1024 * 1024) ++g.launch() ++ ++# If Linux extended attrs aren't available then we cannot test this. ++if not g.feature_available(["linuxxattrs"]): ++ print(f"{prog}: test skipped because 'linuxxattrs' feature not available.") ++ g.close() ++ sys.exit(77) ++ ++# If SELinux relabelling is not available then we cannot test this. ++if not g.feature_available(["selinuxrelabel"]): ++ print(f"{prog}: test skipped because 'selinuxrelabel' feature not available.") ++ g.close() ++ sys.exit(77) ++ ++g.part_disk("/dev/sda", "mbr") ++g.mkfs("ext4", "/dev/sda1") ++g.mount_options("user_xattr", "/dev/sda1", "/") ++ ++# Create some files and directories that we want to have relabelled. ++g.mkdir("/bin") ++g.touch("/bin/ls") ++g.mkdir("/etc") ++g.mkdir("/tmp") ++g.touch("/tmp/test") ++g.mkdir("/var") ++g.mkdir("/var/log") ++g.touch("/var/log/messages") ++ ++# Create a spec file. ++# This doesn't test the optional file_type field. XXX ++# See also file_contexts(5). ++g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0 ++/bin/.* system_u:object_r:bin_t:s0 ++/etc/.* system_u:object_r:etc_t:s0 ++/etc/file_contexts <> ++/tmp/.* <> ++/var/.* system_u:object_r:var_t:s0 ++/var/log/.* system_u:object_r:var_log_t:s0 ++""") ++ ++# Do the relabel. ++g.setfiles("/etc/file_contexts", "/", force=True) ++ ++# Check the labels were set correctly. ++errors = 0 ++ ++def check_label(file, expected_label): ++ global errors ++ actual_label = g.lgetxattr(file, "security.selinux") ++ # The label returned from lgetxattr has \0 appended. ++ if (expected_label + "\0").encode() != actual_label: ++ print( ++ f"{prog}: expected label on file {file}: " ++ f"expected={expected_label} actual={actual_label.decode(errors='ignore')}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ ++def check_label_none(file): ++ global errors ++ try: ++ r = g.lgetxattr(file, "security.selinux") ++ if r: ++ print( ++ f"{prog}: expecting no label on file {file}, " ++ f"but got {r.decode(errors='ignore')}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ except RuntimeError as e: ++ if "No data available" not in str(e): ++ print( ++ f"{prog}: expecting an error reading label from file {file}, " ++ f"but got {e}", ++ file=sys.stderr, ++ ) ++ errors += 1 ++ ++check_label("/bin", "system_u:object_r:default_t:s0") ++check_label("/bin/ls", "system_u:object_r:bin_t:s0") ++check_label("/etc", "system_u:object_r:default_t:s0") ++check_label_none("/etc/file_contexts") ++check_label("/tmp", "system_u:object_r:default_t:s0") ++check_label_none("/tmp/test") ++check_label("/var", "system_u:object_r:default_t:s0") ++check_label("/var/log", "system_u:object_r:var_t:s0") ++check_label("/var/log/messages", "system_u:object_r:var_log_t:s0") ++ ++# Finish up. ++g.shutdown() ++g.close() ++ ++sys.exit(0 if errors == 0 else 1) +-- +2.47.3 + diff --git a/0032-tests-relabel-test-setfiles.py-Add-verbose-logging.patch b/0032-tests-relabel-test-setfiles.py-Add-verbose-logging.patch new file mode 100644 index 0000000..251e3a9 --- /dev/null +++ b/0032-tests-relabel-test-setfiles.py-Add-verbose-logging.patch @@ -0,0 +1,28 @@ +From 8a027eed6d9cecce30158d27db16da30c055026a Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:31:35 +0100 +Subject: [PATCH] tests/relabel/test-setfiles.py: Add verbose logging + +This is useful for debugging the test if it fails. + +(cherry picked from commit 995f80c7fa4eaa843ae3c7f4fc6083512eef92dc) +--- + tests/relabel/test-setfiles.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +index c36098645..6b080d42a 100755 +--- a/tests/relabel/test-setfiles.py ++++ b/tests/relabel/test-setfiles.py +@@ -37,6 +37,8 @@ if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_po + + # Create a filesystem. + g = guestfs.GuestFS(python_return_dict=True) ++g.set_verbose(True) ++g.set_trace(True) + g.add_drive_scratch(256 * 1024 * 1024) + g.launch() + +-- +2.47.3 + diff --git a/0033-daemon-Implement-OStringList-for-OCaml-functions.patch b/0033-daemon-Implement-OStringList-for-OCaml-functions.patch new file mode 100644 index 0000000..ae0adc6 --- /dev/null +++ b/0033-daemon-Implement-OStringList-for-OCaml-functions.patch @@ -0,0 +1,46 @@ +From 5cd0f10dac7047aa09dafd6280ff700118b9bb27 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:13:35 +0100 +Subject: [PATCH] daemon: Implement OStringList for OCaml functions + +Implement optional string list parameters for OCaml functions. This +was unimplemented for daemon functions. + +Fixes: commit fd4db60cff ("generator: Implement StringList for OCaml functions", 2025) +Fixes: commit d5b6f1df5f ("daemon: Allow parts of the daemon and APIs to be written in OCaml.", 2017) +(cherry picked from commit 9d673ed25a59880aaabef29546871263ab5f4bac) +--- + daemon/daemon-c.c | 2 +- + generator/daemon.ml | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/daemon/daemon-c.c b/daemon/daemon-c.c +index 371c2a9e4..17d1ad217 100644 +--- a/daemon/daemon-c.c ++++ b/daemon/daemon-c.c +@@ -114,7 +114,7 @@ guestfs_int_daemon_copy_mountable (const mountable_t *mountable) + CAMLreturn (r); + } + +-/* Implement StringList(...) parameter. */ ++/* Implement StringList and OStringList parameters. */ + value + guestfs_int_daemon_copy_string_list (char * const *strs) + { +diff --git a/generator/daemon.ml b/generator/daemon.ml +index 4e2b97180..d26acbc1a 100644 +--- a/generator/daemon.ml ++++ b/generator/daemon.ml +@@ -807,7 +807,8 @@ let generate_daemon_caml_stubs () = + pr "caml_copy_int64 (%s)" n + | OString _ -> + pr "caml_copy_string (%s)" n +- | OStringList _ -> assert false ++ | OStringList _ -> ++ pr "guestfs_int_daemon_copy_string_list (%s)" n + ); + pr ";\n"; + pr " args[%d] = caml_alloc (1, 0);\n" !i; +-- +2.47.3 + diff --git a/0034-daemon-Add-new-optional-excludes-parameter-to-guestf.patch b/0034-daemon-Add-new-optional-excludes-parameter-to-guestf.patch new file mode 100644 index 0000000..58670ab --- /dev/null +++ b/0034-daemon-Add-new-optional-excludes-parameter-to-guestf.patch @@ -0,0 +1,62 @@ +From d35736f98be5c84cc8e5cc0fc08ee2588046ce47 Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:20:54 +0100 +Subject: [PATCH] daemon: Add new optional excludes parameter to + guestfs_setfiles + +This allows you to append strings to the built in list of exclude +directories. These are simply passed to setfiles via the -e option. + +(cherry picked from commit 5364e6abbcd1ee42f23b26306225269329e7c663) +--- + daemon/selinux.ml | 4 ++-- + generator/actions_core.ml | 7 +++++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/daemon/selinux.ml b/daemon/selinux.ml +index 9802e8913..30a54326e 100644 +--- a/daemon/selinux.ml ++++ b/daemon/selinux.ml +@@ -44,12 +44,12 @@ let setfiles_has_option = + Hashtbl.add h flag r; + r + +-let setfiles ?(force = false) specfile paths = ++let setfiles ?(force = false) ?(excludes = []) specfile paths = + if paths = [] then () + else ( + (* Prefix /sysroot on all paths. *) + let ignored_paths = +- [ "/dev"; "/proc"; "/selinux"; "/sys" ] |> ++ [ "/dev"; "/proc"; "/selinux"; "/sys" ] @ excludes |> + List.map sysroot_path in + let specfile = sysroot_path specfile in + let paths = List.map sysroot_path paths in +diff --git a/generator/actions_core.ml b/generator/actions_core.ml +index 5ded987f4..294abbdff 100644 +--- a/generator/actions_core.ml ++++ b/generator/actions_core.ml +@@ -9537,7 +9537,7 @@ Use C to list all device mapper devices.|} }; + + { defaults with + name = "setfiles"; added = (1, 57, 1); +- style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"]; ++ style = RErr, [String (PlainString, "specfile"); StringList (Pathname, "paths")], [OBool "force"; OStringList "excludes"]; + impl = OCaml "Selinux.setfiles"; + optional = Some "selinuxrelabel"; + test_excuse = "tests are in the tests/relabel directory"; +@@ -9558,7 +9558,10 @@ If the list is empty, setfiles is not called. + + The optional C boolean controls whether the context + is reset for customizable files, and also whether the +-user, role and range parts of the file context is changed.|} }; ++user, role and range parts of the file context is changed. ++ ++The optional C list allows you to exclude parts of the ++directory tree by appending the C I<-e> option.|} }; + + { defaults with + name = "xfs_info2"; added = (1, 59, 2); +-- +2.47.3 + diff --git a/0035-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch b/0035-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch new file mode 100644 index 0000000..5852309 --- /dev/null +++ b/0035-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch @@ -0,0 +1,55 @@ +From 9cf3c9dcefcd8c136725e2a40128166cd52d20ca Mon Sep 17 00:00:00 2001 +From: "Richard W.M. Jones" +Date: Wed, 22 Jul 2026 14:28:49 +0100 +Subject: [PATCH] tests/relabel/test-setfiles.py: Add a test of setfiles + excludes list + +Add a test that we don't relabel directories listed in the excludes +list. + +(cherry picked from commit 44d271a80308bb3898f48662aace25937481688b) +--- + tests/relabel/test-setfiles.py | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py +index 6b080d42a..0b0eb4966 100755 +--- a/tests/relabel/test-setfiles.py ++++ b/tests/relabel/test-setfiles.py +@@ -62,6 +62,8 @@ g.mount_options("user_xattr", "/dev/sda1", "/") + g.mkdir("/bin") + g.touch("/bin/ls") + g.mkdir("/etc") ++g.mkdir("/lib") ++g.touch("/lib/libc.so") + g.mkdir("/tmp") + g.touch("/tmp/test") + g.mkdir("/var") +@@ -75,13 +77,14 @@ g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0 + /bin/.* system_u:object_r:bin_t:s0 + /etc/.* system_u:object_r:etc_t:s0 + /etc/file_contexts <> ++/lib/.* system_u:object_r:lib_t:s0 + /tmp/.* <> + /var/.* system_u:object_r:var_t:s0 + /var/log/.* system_u:object_r:var_log_t:s0 + """) + + # Do the relabel. +-g.setfiles("/etc/file_contexts", "/", force=True) ++g.setfiles("/etc/file_contexts", "/", force=True, excludes=["/lib", "/lib64"]) + + # Check the labels were set correctly. + errors = 0 +@@ -122,6 +125,8 @@ check_label("/bin", "system_u:object_r:default_t:s0") + check_label("/bin/ls", "system_u:object_r:bin_t:s0") + check_label("/etc", "system_u:object_r:default_t:s0") + check_label_none("/etc/file_contexts") ++check_label_none("/lib") # because /lib in excludes ++check_label_none("/lib/libc.so") # because /lib in excludes + check_label("/tmp", "system_u:object_r:default_t:s0") + check_label_none("/tmp/test") + check_label("/var", "system_u:object_r:default_t:s0") +-- +2.47.3 + diff --git a/libguestfs.spec b/libguestfs.spec index 6a1ca2a..3a3cee6 100644 --- a/libguestfs.spec +++ b/libguestfs.spec @@ -35,7 +35,7 @@ Summary: Access and modify virtual machine disk images Name: libguestfs Epoch: 1 Version: 1.58.1 -Release: 8%{?dist}.alma.1 +Release: 9%{?dist}.alma.1 License: LGPL-2.1-or-later # Build only for architectures that have a kernel @@ -104,6 +104,12 @@ Patch0026: 0026-generator-daemon.ml-Implement-OInt-and-OInt64-for-OC.patch Patch0027: 0027-daemon-xfs-Rewrite-xfs_repair-implementation-in-OCam.patch Patch0028: 0028-daemon-xfs.ml-xfs_repair-Ignore-RHEL-7-AGFL-inconsis.patch Patch0029: 0029-daemon-sh.c-o-ro-should-be-two-separate-parameters.patch +Patch0030: 0030-generator-Point-deprecated-SELinux-functions-to-gues.patch +Patch0031: 0031-tests-relabel-Add-a-new-test-for-setfiles.patch +Patch0032: 0032-tests-relabel-test-setfiles.py-Add-verbose-logging.patch +Patch0033: 0033-daemon-Implement-OStringList-for-OCaml-functions.patch +Patch0034: 0034-daemon-Add-new-optional-excludes-parameter-to-guestf.patch +Patch0035: 0035-tests-relabel-test-setfiles.py-Add-a-test-of-setfile.patch # For applying patches: BuildRequires: git @@ -1117,9 +1123,13 @@ rm ocaml/html/.gitignore %changelog -* Thu Aug 06 2026 Eduard Abdullin - 1:1.58.1-8.alma.1 +* Tue Aug 18 2026 Eduard Abdullin - 1:1.58.1-9.alma.1 - Enable building for ppc64le +* Thu Aug 13 2026 Richard W.M. Jones - 1:1.58.1-9 +- Add setfiles optional excludes parameter to libguestfs + resolves: RHEL-239808 + * Fri Jul 10 2026 Richard W.M. Jones - 1:1.58.1-8 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920