diff --git a/.gitignore b/.gitignore index 01eae6f..f6cc265 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -libselinux-3.8.tar.gz +libselinux-3.9.tar.gz diff --git a/0002-libselinux-prioritize-local-literal-fcontext-definit.patch b/0002-libselinux-prioritize-local-literal-fcontext-definit.patch deleted file mode 100644 index 0e1eb4e..0000000 --- a/0002-libselinux-prioritize-local-literal-fcontext-definit.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 6a9958d504853efa4e36900398490afe05a1134c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= -Date: Thu, 17 Apr 2025 21:08:11 +0200 -Subject: [PATCH] libselinux: prioritize local literal fcontext definitions -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Content-type: text/plain - -For literal file context definitions respect overrides from homedirs or -local configurations by ordering them first. - -Fixes: 92306daf ("libselinux: rework selabel_file(5) database") -Reported-by: Paul Holzinger -Link: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 -Signed-off-by: Christian Göttsche ---- - libselinux/src/label_file.c | 5 +++-- - libselinux/src/label_file.h | 10 +++++++++- - libselinux/src/selinux_internal.h | 2 ++ - 3 files changed, 14 insertions(+), 3 deletions(-) - -diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c -index 2c7615174e5f..d1d1d01c769f 100644 ---- a/libselinux/src/label_file.c -+++ b/libselinux/src/label_file.c -@@ -480,7 +480,7 @@ static int load_mmap_ctxarray(struct mmap_area *mmap_area, const char *path, str - return 0; - } - --static int load_mmap_literal_spec(struct mmap_area *mmap_area, bool validating, -+static int load_mmap_literal_spec(struct mmap_area *mmap_area, bool validating, uint8_t inputno, - struct literal_spec *lspec, const struct context_array *ctx_array) - { - uint32_t data_u32, ctx_id; -@@ -489,6 +489,7 @@ static int load_mmap_literal_spec(struct mmap_area *mmap_area, bool validating, - int rc; - - lspec->from_mmap = true; -+ lspec->inputno = inputno; - - - /* -@@ -732,7 +733,7 @@ static int load_mmap_spec_node(struct mmap_area *mmap_area, const char *path, bo - node->literal_specs_alloc = lspec_num; - - for (uint32_t i = 0; i < lspec_num; i++) { -- rc = load_mmap_literal_spec(mmap_area, validating, &node->literal_specs[i], ctx_array); -+ rc = load_mmap_literal_spec(mmap_area, validating, inputno, &node->literal_specs[i], ctx_array); - if (rc) - return -1; - } -diff --git a/libselinux/src/label_file.h b/libselinux/src/label_file.h -index 60ebbb472dda..eb7239719a85 100644 ---- a/libselinux/src/label_file.h -+++ b/libselinux/src/label_file.h -@@ -96,6 +96,7 @@ struct literal_spec { - char *regex_str; /* original regular expression string for diagnostics */ - char *literal_match; /* simplified string from regular expression */ - uint16_t prefix_len; /* length of fixed path prefix, i.e. length of the literal match */ -+ uint8_t inputno; /* Input number of source file */ - uint8_t file_kind; /* file type */ - bool any_matches; /* whether any pathname match */ - bool from_mmap; /* whether this spec is from an mmap of the data */ -@@ -368,7 +369,13 @@ static inline int compare_literal_spec(const void *p1, const void *p2) - return ret; - - /* Order wildcard mode (0) last */ -- return (l1->file_kind < l2->file_kind) - (l1->file_kind > l2->file_kind); -+ ret = spaceship_cmp(l1->file_kind, l2->file_kind); -+ if (ret) -+ return -ret; -+ -+ /* Order by input number (higher number means added later, means higher priority) */ -+ ret = spaceship_cmp(l1->inputno, l2->inputno); -+ return -ret; - } - - static inline int compare_spec_node(const void *p1, const void *p2) -@@ -746,6 +753,7 @@ static int insert_spec(const struct selabel_handle *rec, struct saved_data *data - .regex_str = regex, - .prefix_len = prefix_len, - .literal_match = literal_regex, -+ .inputno = inputno, - .file_kind = file_kind, - .any_matches = false, - .lr.ctx_raw = context, -diff --git a/libselinux/src/selinux_internal.h b/libselinux/src/selinux_internal.h -index 964b84189649..3fe7d4c3953a 100644 ---- a/libselinux/src/selinux_internal.h -+++ b/libselinux/src/selinux_internal.h -@@ -150,4 +150,6 @@ static inline void fclose_errno_safe(FILE *stream) - # define unlikely(x) (x) - #endif /* __GNUC__ */ - -+#define spaceship_cmp(a, b) (((a) > (b)) - ((a) < (b))) -+ - #endif /* SELINUX_INTERNAL_H_ */ --- -2.49.0 - diff --git a/0003-libselinux-Revert-part-of-previous-patch.patch b/0003-libselinux-Revert-part-of-previous-patch.patch deleted file mode 100644 index 2be8aac..0000000 --- a/0003-libselinux-Revert-part-of-previous-patch.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 3d7fb67ad45a7fa7efe24ca81ce6abceaa3a7d64 Mon Sep 17 00:00:00 2001 -From: Petr Lautrbach -Date: Tue, 27 May 2025 14:17:49 +0200 -Subject: [PATCH] libselinux: Revert part of previous patch -Content-type: text/plain - -These four lines should be removed. It makes sense to consider the -wildcard mode as less specific and give priority to a rule that is not -using a wildcard, but that is not how it was done in the past and that -is not (from my testing) what is being done if a regex is involved. So -for both consistency and in keeping with past practice, we should not -use the file kind to sort here. - -Proposed-by: James Carter -Signed-off-by: Petr Lautrbach ---- - libselinux/src/label_file.h | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/libselinux/src/label_file.h b/libselinux/src/label_file.h -index eb7239719a85..284028a054ce 100644 ---- a/libselinux/src/label_file.h -+++ b/libselinux/src/label_file.h -@@ -368,11 +368,6 @@ static inline int compare_literal_spec(const void *p1, const void *p2) - if (ret) - return ret; - -- /* Order wildcard mode (0) last */ -- ret = spaceship_cmp(l1->file_kind, l2->file_kind); -- if (ret) -- return -ret; -- - /* Order by input number (higher number means added later, means higher priority) */ - ret = spaceship_cmp(l1->inputno, l2->inputno); - return -ret; --- -2.49.0 - diff --git a/libselinux-3.8.tar.gz.asc b/libselinux-3.8.tar.gz.asc deleted file mode 100644 index d9fcece..0000000 --- a/libselinux-3.8.tar.gz.asc +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN PGP SIGNATURE----- - -iQIzBAABCAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmeaa/0ACgkQzcroySfG -vjFQkg//T/nkfDTyjP/PNqZaya3gxbWBwRBhUCGXQTjaGCfcZDgcnphXnwhj5gkE -ATCrTAYixg5apjWvH8faToo8ds3hVhdgpOL0ew5mx3M0PBTqBKReL6Y5YxQDDgLj -fPF+ISai4xywv4MIUm0tQjOPbsuN1b5HhCP3/n+oUcvAehJqEZ471sB+o4EW7kHT -L4v9vouhaaYWEpC0eLUnb4kaEaf6qWPrIZ+2td0Mwc4+KHl2P1v5siVzL3uNwoUR -CL3EpnzEFHiKOGw8ymBL879RBCUG68noYGO22Fzk+Zw1WAsoDJqSYpGTdcnHlwB5 -dJFspO+41jy7OYneslji+sfKgUej8ZvK7ohn4xTw96fHp9cGmh+4We52//ZdnZMn -AXinyIMeDCr29JE1XnWsJd48LqRJHcBx0Tm6pf5sA59giFiv4pYAvntafFu28yqP -gPdyfRShVEeVSyE59O4YS0hYs7lsl/4pIzlgNOZwkKtzMwwwBLPZSWn57KqoUxNZ -7IlKx80AKWbK6hASjt60PQnWKQE4Hm94HJOv4cbOFsYkUBeQfv4+4P+5FhU608fp -oz/UK9VEl6QhvzIO7bIsTD+2h8jz3ecsjjrRRVsAuI34VJBF/8OOchMqp0w6WZ13 -IhSdwNypCZtAVv9fjgFhVmYxAZtHuy+7BGjGgEVKatteIhAVEic= -=C5fM ------END PGP SIGNATURE----- diff --git a/libselinux-3.9.tar.gz.asc b/libselinux-3.9.tar.gz.asc new file mode 100644 index 0000000..e7df69a --- /dev/null +++ b/libselinux-3.9.tar.gz.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmh3hTQACgkQzcroySfG +vjFz9Q//S/h3ZeD24rqBIodIhyJMrD5gZ1aE550iGeYQBfTpfyU1ythOUhqnY2zj +7CpmZG9I4v4RYdyL169Q/sfYu1Apt/79+0rutfA5Ho1LzxkIEyPidwSdC+PRNUHk +VggPnxaulpSnIKGcNmQ00d7GIcniD0fZzJQS7j55VYV0yIFXXOxnMGsDgcm7Rzqr +4fRE9Iz8Y99B7dmfTTSqpMqSYPwXOx4lzFQ9dwUA9yRTbZJyIETTzb9eJBe8ajKr +etIoE+IkBIJiBUVpq99qxy+qjWeGRFJZ1yPFSN1/iB5/4qrrJu8qFLNPhQkmd0ZY +ci5NGF/gGaxqvn3jjiBGrT4+mvI/Mbkhr16x65FZU2x4f1S4B/MzruhnO2A9b13V +q7FB3j7LvqBj3oWAKZHjPB2h6eDbZltVF1OoxxJLdVLmqABC1ZKhibD1KXqugZWQ +boL2QJeBz81naC8Hc2oTr9Nuhd7YDdYLUefrCkLS41w+vGFr9w7XQ/qV/FqiK8CT +4NfxLgv7X9Mp01K92QTKUYbdNFT7y1V42jhIY7pv2sFB+VGlZWRCbqhAqoU5kbmO +MCHKB7/9ZDl5PqJLkzPSgURveEZjQV+Mmj0ItAT4oSXVsZQ6hARyFtRpSR/UAZds +Dy6LCoEO+EYTP57NXc3mEMDyRBWUlJ+BmFqe1muerWQwssYb8qI= +=9G1j +-----END PGP SIGNATURE----- diff --git a/libselinux.spec b/libselinux.spec index e60c915..7c108c9 100644 --- a/libselinux.spec +++ b/libselinux.spec @@ -4,12 +4,12 @@ ## END: Set by rpmautospec %define ruby_inc %(pkg-config --cflags ruby) -%define libsepolver 3.8-1 +%define libsepolver 3.9-1 Summary: SELinux library and simple utilities Name: libselinux -Version: 3.8 -Release: 2%{?dist} +Version: 3.9 +Release: 1%{?dist} License: LicenseRef-Fedora-Public-Domain # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/%{version}/libselinux-%{version}.tar.gz @@ -21,12 +21,10 @@ Source4: selinuxdefcon.8 Url: https://github.com/SELinuxProject/selinux/wiki # $ git clone https://github.com/fedora-selinux/selinux.git # $ cd selinux -# $ git format-patch -N 3.8 -- libselinux +# $ git format-patch -N 3.9 -- libselinux # $ i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done # Patch list start Patch0001: 0001-Use-SHA-2-instead-of-SHA-1.patch -Patch0002: 0002-libselinux-prioritize-local-literal-fcontext-definit.patch -Patch0003: 0003-libselinux-Revert-part-of-previous-patch.patch # Patch list end BuildRequires: gcc make BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel @@ -227,6 +225,12 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool* %changelog ## START: Generated by rpmautospec +* Tue Jul 22 2025 Vit Mojzis - 3.9-1 +- SELinux userspace 3.9 release + +* Mon Jun 30 2025 Petr Lautrbach - 3.9-0.rc2.1 +- SELinux userspace 3.9-rc2 release + * Tue May 27 2025 Petr Lautrbach - 3.8-2 - Prioritize local literal fcontext definitions (rhbz#2360183) diff --git a/sources b/sources index 7414748..e9b3b9e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libselinux-3.8.tar.gz) = e36edec33c3960679a8975f839a4d64d4b1f82d51346fba21082c2686136259040099c7fee2c947ac2ca180d61d10356c9b3d359a1c5f1242b6ecdd7c036005e +SHA512 (libselinux-3.9.tar.gz) = a91942e7d16673396610d969f2471173989995a048edacf6076f6df3200a0d541a1c9932a7632d70aa7c728de7e7d3c62712e5aab6c0b763826e7ffef808cadb