SOURCES/0015-libsemanage-Preserve-file-context-and-ownership-in-p.patch

@@ -1,146 +0,0 @@
-From 52f19bad2e4a3d5c7599df9afd5e3cd675ecac8c Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Mon, 29 Jul 2024 13:26:45 +0200
-Subject: [PATCH] libsemanage: Preserve file context and ownership in policy
- store
-
-Make sure that file context (all parts) and ownership of
-files/directories in policy store does not change no matter which user
-and under which context executes policy rebuild.
-
-Fixes:
-  # semodule -B
-  # ls -lZ  /etc/selinux/targeted/contexts/files
-
--rw-r--r--. 1 root root unconfined_u:object_r:file_context_t:s0 421397 Jul 11 09:57 file_contexts
--rw-r--r--. 1 root root unconfined_u:object_r:file_context_t:s0 593470 Jul 11 09:57 file_contexts.bin
--rw-r--r--. 1 root root unconfined_u:object_r:file_context_t:s0  14704 Jul 11 09:57 file_contexts.homedirs
--rw-r--r--. 1 root root unconfined_u:object_r:file_context_t:s0  20289 Jul 11 09:57 file_contexts.homedirs.bin
-
-  SELinux user changed from system_u to the user used to execute semodule
-
-  # capsh --user=testuser --caps="cap_dac_override,cap_chown+eip" --addamb=cap_dac_override,cap_chown -- -c "semodule -B"
-  # ls -lZ  /etc/selinux/targeted/contexts/files
-
--rw-r--r--. 1 testuser testuser unconfined_u:object_r:file_context_t:s0 421397 Jul 19 09:10 file_contexts
--rw-r--r--. 1 testuser testuser unconfined_u:object_r:file_context_t:s0 593470 Jul 19 09:10 file_contexts.bin
--rw-r--r--. 1 testuser testuser unconfined_u:object_r:file_context_t:s0  14704 Jul 19 09:10 file_contexts.homedirs
--rw-r--r--. 1 testuser testuser unconfined_u:object_r:file_context_t:s0  20289 Jul 19 09:10 file_contexts.homedirs.bin
-
-  Both file context and ownership changed -- causes remote login
-  failures and other issues in some scenarios.
-
-Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
-Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
----
- libsemanage/src/semanage_store.c | 32 ++++++++++++++++++++++++++++++++
- libsemanage/src/semanage_store.h |  1 +
- 2 files changed, 33 insertions(+)
-
-diff --git a/libsemanage/src/semanage_store.c b/libsemanage/src/semanage_store.c
-index 1fff667d..52cc72d7 100644
---- a/libsemanage/src/semanage_store.c
-+++ b/libsemanage/src/semanage_store.c
-@@ -36,6 +36,7 @@ typedef struct dbase_policydb dbase_t;
- #include "database_policydb.h"
- #include "handle.h"
- 
-+#include <selinux/restorecon.h>
- #include <selinux/selinux.h>
- #include <sepol/policydb.h>
- #include <sepol/module.h>
-@@ -763,6 +764,7 @@ int semanage_copy_file(const char *src, const char *dst, mode_t mode,
- 	if (!retval && rename(tmp, dst) == -1)
- 		return -1;
- 
-+	semanage_setfiles(dst);
- out:
- 	errno = errsv;
- 	return retval;
-@@ -801,6 +803,8 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
- 			goto cleanup;
- 		}
- 		umask(mask);
-+
-+		semanage_setfiles(dst);
- 	}
- 
- 	for (i = 0; i < len; i++) {
-@@ -819,6 +823,7 @@ static int semanage_copy_dir_flags(const char *src, const char *dst, int flag)
- 				goto cleanup;
- 			}
- 			umask(mask);
-+			semanage_setfiles(path2);
- 		} else if (S_ISREG(sb.st_mode) && flag == 1) {
- 			mask = umask(0077);
- 			if (semanage_copy_file(path, path2, sb.st_mode,
-@@ -920,6 +925,7 @@ int semanage_mkdir(semanage_handle_t *sh, const char *path)
- 
- 		}
- 		umask(mask);
-+		semanage_setfiles(path);
- 	}
- 	else {
- 		/* check that it really is a directory */
-@@ -1597,16 +1603,19 @@ static int semanage_validate_and_compile_fcontexts(semanage_handle_t * sh)
- 		    semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC)) != 0) {
- 		goto cleanup;
- 	}
-+	semanage_setfiles(semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_BIN));
- 
- 	if (sefcontext_compile(sh,
- 		    semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_LOCAL)) != 0) {
- 		goto cleanup;
- 	}
-+	semanage_setfiles(semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_LOCAL_BIN));
- 
- 	if (sefcontext_compile(sh,
- 		    semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_HOMEDIRS)) != 0) {
- 		goto cleanup;
- 	}
-+	semanage_setfiles(semanage_final_path(SEMANAGE_FINAL_TMP, SEMANAGE_FC_HOMEDIRS_BIN));
- 
- 	status = 0;
- cleanup:
-@@ -3001,3 +3010,26 @@ int semanage_nc_sort(semanage_handle_t * sh, const char *buf, size_t buf_len,
- 
- 	return 0;
- }
-+
-+/* Make sure the file context and ownership of files in the policy
-+ * store does not change */
-+void semanage_setfiles(const char *path){
-+	struct stat sb;
-+	int fd;
-+	/* Fix the user and role portions of the context, ignore errors
-+	 * since this is not a critical operation */
-+	selinux_restorecon(path, SELINUX_RESTORECON_SET_SPECFILE_CTX | SELINUX_RESTORECON_IGNORE_NOENTRY);
-+
-+	/* Make sure "path" is owned by root */
-+	if ((geteuid() != 0 || getegid() != 0) &&
-+	    ((fd = open(path, O_RDONLY)) != -1)){
-+		/* Skip files with the SUID or SGID bit set -- abuse protection */
-+		if ((fstat(fd, &sb) != -1) &&
-+		    !(S_ISREG(sb.st_mode) &&
-+		      (sb.st_mode & (S_ISUID | S_ISGID))) &&
-+		    (fchown(fd, 0, 0) == -1))
-+			fprintf(stderr, "Warning! Could not set ownership of %s to root\n", path);
-+
-+		close(fd);
-+	}
-+}
-diff --git a/libsemanage/src/semanage_store.h b/libsemanage/src/semanage_store.h
-index 1fc77da8..e21dadeb 100644
---- a/libsemanage/src/semanage_store.h
-+++ b/libsemanage/src/semanage_store.h
-@@ -124,6 +124,7 @@ int semanage_get_cil_paths(semanage_handle_t * sh, semanage_module_info_t *modin
- int semanage_get_active_modules(semanage_handle_t *sh,
- 			       semanage_module_info_t **modinfo, int *num_modules);
- 
-+void semanage_setfiles(const char *path);
- 
- /* lock file routines */
- int semanage_get_trans_lock(semanage_handle_t * sh);
--- 
-2.43.0
-

SOURCES/0016-libsemanage-Mute-error-messages-from-selinux_restore.patch

@@ -1,64 +0,0 @@
-From a0895d4219af61a56294ffca101d1d6fc2d0531c Mon Sep 17 00:00:00 2001
-From: Vit Mojzis <vmojzis@redhat.com>
-Date: Thu, 12 Dec 2024 19:44:25 +0100
-Subject: [PATCH] libsemanage: Mute error messages from selinux_restorecon
-Content-type: text/plain
-
-Mute error messages produced by selinux_restorecon when rebuilding the
-policy store to avoid error messages in containers, image mode, etc.
-
-Fixes:
- #podman build --security-opt=label=disable --cap-add=all --device /dev/fuse -t quay.io/jlebon/fedora-bootc:tier-x . --build-arg MANIFEST=fedora-tier-x.yaml --from quay.io/fedora/fedora:rawhide
-...
-Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas/lang_ext:  Operation not supported
-Could not set context for /etc/selinux/targeted/tmp/modules/100/rtas:  Operation not supported
-Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/cil:  Operation not supported
-Could not set context for /etc/selinux/targeted/tmp/modules/100/rtkit/hll:  Operation not supported
-...
-
-https://bugzilla.redhat.com/show_bug.cgi?id=2326348
-
-Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
-Acked-by: James Carter <jwcart2@gmail.com>
----
- libsemanage/src/semanage_store.c | 16 +++++++++++++++-
- 1 file changed, 15 insertions(+), 1 deletion(-)
-
-diff --git a/libsemanage/src/semanage_store.c b/libsemanage/src/semanage_store.c
-index 52cc72d7391c..29abbd0e6b6f 100644
---- a/libsemanage/src/semanage_store.c
-+++ b/libsemanage/src/semanage_store.c
-@@ -3011,15 +3011,29 @@ int semanage_nc_sort(semanage_handle_t * sh, const char *buf, size_t buf_len,
- 	return 0;
- }
- 
-+/* log_callback muting all logs */
-+static int __attribute__ ((format(printf, 2, 3)))
-+log_callback_mute(__attribute__((unused)) int type, __attribute__((unused)) const char *fmt, ...)
-+{
-+	return 0;
-+}
-+
- /* Make sure the file context and ownership of files in the policy
-  * store does not change */
- void semanage_setfiles(const char *path){
- 	struct stat sb;
- 	int fd;
-+	union selinux_callback cb_orig = selinux_get_callback(SELINUX_CB_LOG);
-+	union selinux_callback cb = { .func_log = log_callback_mute };
-+
-+	/* Mute all logs */
-+	selinux_set_callback(SELINUX_CB_LOG, cb);
-+
- 	/* Fix the user and role portions of the context, ignore errors
- 	 * since this is not a critical operation */
- 	selinux_restorecon(path, SELINUX_RESTORECON_SET_SPECFILE_CTX | SELINUX_RESTORECON_IGNORE_NOENTRY);
--
-+	/* restore log_logging */
-+	selinux_set_callback(SELINUX_CB_LOG, cb_orig);
- 	/* Make sure "path" is owned by root */
- 	if ((geteuid() != 0 || getegid() != 0) &&
- 	    ((fd = open(path, O_RDONLY)) != -1)){
--- 
-2.48.1
-

SOURCES/0017-libsemanage-Set-new-restorecon-handle-before-doing-r.patch

@@ -1,37 +0,0 @@
-From 6d5a1d424508f9554e92d6aac5eeca424503d028 Mon Sep 17 00:00:00 2001
-From: James Carter <jwcart2@gmail.com>
-Date: Wed, 22 Jan 2025 10:58:28 -0500
-Subject: [PATCH] libsemanage: Set new restorecon handle before doing
- restorecon
-Content-type: text/plain
-
-In semanage_setfiles(), need to reset the restorecon handle to make
-sure restorecon is not operating on old selabel data.
-
-Signed-off-by: James Carter <jwcart2@gmail.com>
----
- libsemanage/src/semanage_store.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/libsemanage/src/semanage_store.c b/libsemanage/src/semanage_store.c
-index 29abbd0e6b6f..33b950ff5451 100644
---- a/libsemanage/src/semanage_store.c
-+++ b/libsemanage/src/semanage_store.c
-@@ -3023,9 +3023,14 @@ log_callback_mute(__attribute__((unused)) int type, __attribute__((unused)) cons
- void semanage_setfiles(const char *path){
- 	struct stat sb;
- 	int fd;
-+	struct selabel_handle *sehandle;
-+
- 	union selinux_callback cb_orig = selinux_get_callback(SELINUX_CB_LOG);
- 	union selinux_callback cb = { .func_log = log_callback_mute };
- 
-+	sehandle = selinux_restorecon_default_handle();
-+	selinux_restorecon_set_sehandle(sehandle);
-+
- 	/* Mute all logs */
- 	selinux_set_callback(SELINUX_CB_LOG, cb);
- 
--- 
-2.48.1
-

SPECS/libsemanage.spec

@@ -1,10 +1,10 @@
 %define libsepolver 2.9-1
-%define libselinuxver 2.9-10
+%define libselinuxver 2.9-1
 
 Summary: SELinux binary policy manipulation library 
 Name: libsemanage
 Version: 2.9
-Release: 11%{?dist}
+Release: 9%{?dist}
 License: LGPLv2+
 Source0: https://github.com/SELinuxProject/selinux/releases/download/20190315/libsemanage-2.9.tar.gz
 # i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
@@ -22,9 +22,6 @@ Patch0011: 0011-libsemanage-clean-up-semanage_direct_commit-a-bit.patch
 Patch0012: 0012-libsemanage-optionally-rebuild-policy-when-modules-a.patch
 Patch0013: 0013-libsemanage-allow-spaces-in-user-group-names.patch
 Patch0014: 0014-libsemanage-always-write-kernel-policy-when-check_ex.patch
-Patch0015: 0015-libsemanage-Preserve-file-context-and-ownership-in-p.patch
-Patch0016: 0016-libsemanage-Mute-error-messages-from-selinux_restore.patch
-Patch0017: 0017-libsemanage-Set-new-restorecon-handle-before-doing-r.patch
 
 URL: https://github.com/SELinuxProject/selinux/wiki
 Source1: semanage.conf
@@ -171,13 +168,6 @@ rm %{buildroot}%{_libexecdir}/selinux/semanage_migrate_store~
 %{_libexecdir}/selinux/semanage_migrate_store
 
 %changelog
-* Fri Jan 24 2025 Petr Lautrbach <lautrbach@redhat.com> - 2.9-11
-- Set new restorecon handle before doing restorecon (RHEL-73348)
-- Mute error messages from selinux_restorecon
-
-* Mon Jul 29 2024 Vit Mojzis <vmojzis@redhat.com> - 2.9-10
-- Preserve file context and ownership in policy store (RHEL-17509)
-
 * Thu Jul 07 2022 Vit Mojzis <vmojzis@redhat.com> - 2.9-9
 - allow spaces in user/group names (#2042408)
 - always write kernel policy when check_ext_changes is specified (#2089802)