rpms/policycoreutils
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI policycoreutils-3.9-1.el10

Browse Source
This commit is contained in:
eabdullin 2025-11-11 21:47:25 +00:00
parent 14010ed68c
commit 56f6f68b30
12 changed files with 127 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1,4 +1,4 @@
selinux-3.8.tar.gz
selinux-3.9.tar.gz
selinux-gui.zip
selinux-policycoreutils.zip
selinux-python.zip

7
0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
View File

@ -1,15 +1,14 @@
From 12f57453e8b53a8aab6d3581fd1a4c921fe36918 Mon Sep 17 00:00:00 2001
From ce28d432bef8d1a346054b56a989e58533fecfa7 Mon Sep 17 00:00:00 2001
From: Dan Walsh <dwalsh@redhat.com>
Date: Fri, 14 Feb 2014 12:32:12 -0500
Subject: [PATCH] Don't be verbose if you are not on a tty
Content-type: text/plain
---
policycoreutils/scripts/fixfiles | 1 +
1 file changed, 1 insertion(+)
diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
index b7cd765c15e4..f2518e96e34c 100755
index b7cd765c..f2518e96 100755
--- a/policycoreutils/scripts/fixfiles
+++ b/policycoreutils/scripts/fixfiles
@@ -108,6 +108,7 @@ exclude_dirs_from_relabelling() {
@ -21,5 +20,5 @@ index b7cd765c15e4..f2518e96e34c 100755
THREADS=""
RPMFILES=""
--
2.47.0
2.49.0

7
0002-sepolicy-generate-Handle-more-reserved-port-types.patch
View File

@ -1,8 +1,7 @@
From fb7357cd097801fcdfa21ed49a17a3875db05e42 Mon Sep 17 00:00:00 2001
From 618ae48ebf1334f9380a9ae7460c553515f9c4ca Mon Sep 17 00:00:00 2001
From: Masatake YAMATO <yamato@redhat.com>
Date: Thu, 14 Dec 2017 15:57:58 +0900
Subject: [PATCH] sepolicy-generate: Handle more reserved port types
Content-type: text/plain
Currently only reserved_port_t, port_t and hi_reserved_port_t are
handled as special when making a ports-dictionary. However, as fas as
@ -53,7 +52,7 @@ https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redha
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
index adf65f27a822..f726ad51b775 100644
index adf65f27..f726ad51 100644
--- a/python/sepolicy/sepolicy/generate.py
+++ b/python/sepolicy/sepolicy/generate.py
@@ -100,7 +100,9 @@ def get_all_ports():
@ -68,5 +67,5 @@ index adf65f27a822..f726ad51b775 100644
dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
return dict
--
2.47.0
2.49.0

11
0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
View File

@ -1,8 +1,7 @@
From f2092a1b859a028f2c5c79b41c70b135ba3ad0fa Mon Sep 17 00:00:00 2001
From 16fd581da479f80b8f8ff8ae8ff58a4f0a610d54 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Wed, 18 Jul 2018 09:09:35 +0200
Subject: [PATCH] sandbox: Use matchbox-window-manager instead of openbox
Content-type: text/plain
---
sandbox/sandbox | 4 ++--
@ -11,7 +10,7 @@ Content-type: text/plain
3 files changed, 3 insertions(+), 17 deletions(-)
diff --git a/sandbox/sandbox b/sandbox/sandbox
index e3fd6119ed4d..e01425f0c637 100644
index e3fd6119..e01425f0 100644
--- a/sandbox/sandbox
+++ b/sandbox/sandbox
@@ -270,7 +270,7 @@ class Sandbox:
@ -33,7 +32,7 @@ index e3fd6119ed4d..e01425f0c637 100644
parser.add_option("-l", "--level", dest="level",
diff --git a/sandbox/sandbox.8 b/sandbox/sandbox.8
index 095b9e27042d..1c1870190e51 100644
index 095b9e27..1c187019 100644
--- a/sandbox/sandbox.8
+++ b/sandbox/sandbox.8
@@ -80,7 +80,7 @@ Specifies the windowsize when creating an X based Sandbox. The default windowsiz
@ -46,7 +45,7 @@ index 095b9e27042d..1c1870190e51 100644
\fB\-X\fR
Create an X based Sandbox for gui apps, temporary files for
diff --git a/sandbox/sandboxX.sh b/sandbox/sandboxX.sh
index 28169182ce42..e2a7ad9b2ac7 100644
index 28169182..e2a7ad9b 100644
--- a/sandbox/sandboxX.sh
+++ b/sandbox/sandboxX.sh
@@ -7,20 +7,6 @@ export TITLE="Sandbox $context -- `grep ^#TITLE: ~/.sandboxrc | /usr/bin/cut -b8
@ -71,5 +70,5 @@ index 28169182ce42..e2a7ad9b2ac7 100644
if [ -z "$WAYLAND_DISPLAY" ]; then
DISPLAY_COMMAND='/usr/bin/Xephyr -resizeable -title "$TITLE" -terminate -screen $SCREENSIZE -dpi $DPI -nolisten tcp -displayfd 5 5>&1 2>/dev/null'
--
2.47.0
2.49.0

25
0004-Use-SHA-2-instead-of-SHA-1.patch
View File

@ -1,8 +1,7 @@
From 4780b755bb1171f5aa4cd7545535839d451a2070 Mon Sep 17 00:00:00 2001
From 1a3fc195c6dc7fe51ef76e4484910f7b41161ccc Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <plautrba@redhat.com>
Date: Fri, 30 Jul 2021 14:14:37 +0200
Subject: [PATCH] Use SHA-2 instead of SHA-1
Content-type: text/plain
The use of SHA-1 in RHEL9 is deprecated
---
@ -13,10 +12,10 @@ The use of SHA-1 in RHEL9 is deprecated
4 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
index c3cc5c9b0e52..6160aced5922 100644
index 1134420e..77dd0542 100644
--- a/policycoreutils/setfiles/restorecon.8
+++ b/policycoreutils/setfiles/restorecon.8
@@ -95,14 +95,14 @@ display usage information and exit.
@@ -103,14 +103,14 @@ display usage information and exit.
ignore files that do not exist.
.TP
.B \-I
@ -34,7 +33,7 @@ index c3cc5c9b0e52..6160aced5922 100644
enable usage of the
.IR security.sehash
extended attribute.
@@ -200,7 +200,7 @@ the
@@ -208,7 +208,7 @@ the
.B \-D
option to
.B restorecon
@ -43,7 +42,7 @@ index c3cc5c9b0e52..6160aced5922 100644
attribute named
.IR security.sehash
on each directory specified in
@@ -217,7 +217,7 @@ for further details.
@@ -225,7 +225,7 @@ for further details.
.sp
The
.B \-I
@ -53,7 +52,7 @@ index c3cc5c9b0e52..6160aced5922 100644
and provided the
.B \-n
diff --git a/policycoreutils/setfiles/restorecon_xattr.8 b/policycoreutils/setfiles/restorecon_xattr.8
index 51d12a4dbb80..09bfd8c40ab4 100644
index 51d12a4d..09bfd8c4 100644
--- a/policycoreutils/setfiles/restorecon_xattr.8
+++ b/policycoreutils/setfiles/restorecon_xattr.8
@@ -23,7 +23,7 @@ or
@ -90,7 +89,7 @@ index 51d12a4dbb80..09bfd8c40ab4 100644
.I security.sehash
directory digest entries, and is shown for reference only).
diff --git a/policycoreutils/setfiles/restorecon_xattr.c b/policycoreutils/setfiles/restorecon_xattr.c
index 31fb82fd2099..bc22d3fd4560 100644
index 31fb82fd..bc22d3fd 100644
--- a/policycoreutils/setfiles/restorecon_xattr.c
+++ b/policycoreutils/setfiles/restorecon_xattr.c
@@ -38,7 +38,7 @@ int main(int argc, char **argv)
@ -134,10 +133,10 @@ index 31fb82fd2099..bc22d3fd4560 100644
}
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index ee01725050bb..57c663a99d67 100644
index eabf0a1c..187f4513 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -95,14 +95,14 @@ display usage information and exit.
@@ -104,14 +104,14 @@ display usage information and exit.
ignore files that do not exist.
.TP
.B \-I
@ -155,7 +154,7 @@ index ee01725050bb..57c663a99d67 100644
enable usage of the
.IR security.sehash
extended attribute.
@@ -261,7 +261,7 @@ the
@@ -270,7 +270,7 @@ the
.B \-D
option to
.B setfiles
@ -164,7 +163,7 @@ index ee01725050bb..57c663a99d67 100644
.B spec_file
set in an extended attribute named
.IR security.sehash
@@ -282,7 +282,7 @@ for further details.
@@ -291,7 +291,7 @@ for further details.
.sp
The
.B \-I
@ -174,5 +173,5 @@ index ee01725050bb..57c663a99d67 100644
and provided the
.B \-n
--
2.47.0
2.49.0

7
0005-python-sepolicy-Fix-spec-file-dependencies.patch
View File

@ -1,8 +1,7 @@
From 7e8d67e63daebd675284afaf98aa07530659272f Mon Sep 17 00:00:00 2001
From 84b051139ab536519cc8e9c333483475d830d40b Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Tue, 30 May 2023 09:07:28 +0200
Subject: [PATCH] python/sepolicy: Fix spec file dependencies
Content-type: text/plain
semanage is part of policycoreutils-python-utils package, selinuxenabled
is part of libselinux-utils (required by ^^^) and restorecon/load_policy
@ -14,7 +13,7 @@ Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/python/sepolicy/sepolicy/templates/spec.py b/python/sepolicy/sepolicy/templates/spec.py
index 433c298a17e0..a6d4508bb670 100644
index 433c298a..a6d4508b 100644
--- a/python/sepolicy/sepolicy/templates/spec.py
+++ b/python/sepolicy/sepolicy/templates/spec.py
@@ -11,18 +11,20 @@ Version: 1.0
@ -44,5 +43,5 @@ index 433c298a17e0..a6d4508bb670 100644
mid_section="""\
--
2.47.0
2.49.0

65
0006-sepolicy-Fix-detection-of-writeable-locations.patch Normal file
View File

@ -0,0 +1,65 @@
From 98cd707e8106e9e77b179bccbeb4fd4004b4c601 Mon Sep 17 00:00:00 2001
From: Petr Lautrbach <lautrbach@redhat.com>
Date: Mon, 5 May 2025 18:28:40 +0200
Subject: [PATCH] sepolicy: Fix detection of writeable locations
- update substitutions from /etc/dnf/var
It seems that by default dnf api does not read /etc/dnf/var/* files to
update substitutions and so it can't resolve correct mirror list when a
variable is part of the link.
- alway run query.run()
Fixes:
Traceback (most recent call last):
File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load
ret = self._repo.load()
^^^^^^^^^^^^^^^^^
File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load
return _repo.Repo_load(self)
^^^^^^^^^^^^^^^^^^^^^
libdnf._error.Error: Failed to download metadata for repo 'baseos':
Cannot prepare internal mirrorlist: Status code: 404 for
https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198)
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
---
python/sepolicy/sepolicy/generate.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
index f726ad51..a0314a70 100644
--- a/python/sepolicy/sepolicy/generate.py
+++ b/python/sepolicy/sepolicy/generate.py
@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s;
import dnf
with dnf.Base() as base:
+ base.conf.substitutions.update_from_etc('/')
base.read_all_repos()
base.fill_sack(load_system_repo=True)
query = base.sack.query()
- pq = query.available()
- pq = pq.filter(file=self.program)
+ pq = query.filter(file=self.program)
- for pkg in pq:
+ for pkg in pq.run():
self.rpms.append(pkg.name)
for fname in pkg.files:
for b in self.DEFAULT_DIRS:
@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s;
self.add_dir(fname)
sq = query.available()
sq = sq.filter(provides=pkg.source_name)
- for bpkg in sq:
+ for bpkg in sq.run():
for fname in bpkg.files:
for b in self.DEFAULT_DIRS:
if b == "/etc":
--
2.49.0

20
policycoreutils.spec
View File

@ -4,9 +4,9 @@
## END: Set by rpmautospec
%global libauditver 3.0
%global libsepolver 3.8-1
%global libsemanagever 3.8-1
%global libselinuxver 3.8-1
%global libsepolver 3.9-1
%global libsemanagever 3.9-1
%global libselinuxver 3.9-1
%global generatorsdir %{_prefix}/lib/systemd/system-generators
@ -15,7 +15,7 @@
Summary: SELinux policy core utilities
Name: policycoreutils
Version: 3.8
Version: 3.9
Release: 1%{?dist}
License: GPL-2.0-or-later
# https://github.com/SELinuxProject/selinux/wiki/Releases
@ -40,7 +40,7 @@ Source22: selinux-gui.zip
# wlc --key <apikey> --url https://translate.fedoraproject.org/api/ download selinux/sandbox --output ./
Source23: selinux-sandbox.zip
# https://github.com/fedora-selinux/selinux
# $ git format-patch -N 3.8 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
# $ git format-patch -N 3.9 -- policycoreutils python gui sandbox dbus semodule-utils restorecond
# $ for j in [0-9]*.patch; do printf "Patch%s: %s\n" ${j/-*/} $j; done
# Patch list start
Patch0001: 0001-Don-t-be-verbose-if-you-are-not-on-a-tty.patch
@ -48,6 +48,7 @@ Patch0002: 0002-sepolicy-generate-Handle-more-reserved-port-types.patch
Patch0003: 0003-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
Patch0004: 0004-Use-SHA-2-instead-of-SHA-1.patch
Patch0005: 0005-python-sepolicy-Fix-spec-file-dependencies.patch
Patch0006: 0006-sepolicy-Fix-detection-of-writeable-locations.patch
# Patch list end
Obsoletes: policycoreutils < 2.0.61-2
@ -434,6 +435,15 @@ The policycoreutils-restorecond package contains the restorecond service.
%changelog
## START: Generated by rpmautospec
* Wed Jul 23 2025 Vit Mojzis <vmojzis@redhat.com> - 3.9-1
- SELinux userspace 3.9 release
* Fri Jul 04 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.9-0.rc2.1
- SELinux userspace 3.9-rc2 release
* Sat May 10 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.8-2
- sepolicy: Fix detection of writeable locations
* Fri Jan 31 2025 Petr Lautrbach <lautrbach@redhat.com> - 3.8-1
- SELinux userspace 3.8 release

16
selinux-3.8.tar.gz.asc
View File

@ -1,16 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmeaa/8ACgkQzcroySfG
vjH2og//XNOPQw/9CCuW55KAJL2U2zU4mq9kL3WrkT4ViKhgctPFmPc77oMU+sZp
K8+FNxenNgObe9c+rv3tWMwSHRBKc+PTzrI9E2pm9ZB7JJIYwPkrJEW9DKP22E5q
3ccMuIUQbml9s7OPwHXLEHeL0WHUunTR47xgAuvVODYYuTVhumHOWY/E5cEEh4Of
GeStN6nAtCRohP7lqOWnCRgo0u8EDMX41zsE6EgUZonxZF+u5tx4FU0yBhfKhlgA
uvZYqFQdw/wOwWqKqljR22TCGJG9l1lTJVGGIICkOQNmmJa185dvRX/yTP0FIkfQ
vRkpchYicctix3rgfH6wvuYaCWyI/xZgCOakGKXoe5PBBMRsNUAW0z1gUC+Y0SQu
dukGrHlHn4jBvd0IsgxIsEac7Vt6dmlxK2CiWh+pJlKe3tItyYBerpMyMcvUQMv5
OKtqvGoaJBiavENzjDbv7Bzo+kgZuo70y6CV7g+tljboWT29N2QimSssS4Cr81KG
WFfUTDk+vvOFwDEOePufMPR0XMeybT5DDabNYOKr2kRlbktkpZKFyTAiIvwdKgpg
DAcudeTjlVeMXu2lZ1tC1MHXppAreWSiq88J6HIrmQJ3A99OVpCHHi+rGAyjcTRV
LueGRWy4PfovMKUMSkqftLPdjEY0W9J9WxLrmLSCLxTBwYnbyNU=
=0ej6
-----END PGP SIGNATURE-----

16
selinux-3.9.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcgDrLD9eSIRjwM6ezcroySfGvjEFAmh3hTkACgkQzcroySfG
vjGG5hAAsRzu21MGtqiS7stJCRoNY5gD6aqrbt/mQnxSKQEmBZfZyjO2w/KyPKjy
ZSrDTb4yvjMBP599qo7IuxmDZv6xFF38L5VM5YcRoRYzVepNqM12WzLnf9YVRq2I
xgOWqYhwaYrjJZ1qCwFomTVfm8CnxbiRK3YL8I3gbbz6BS8eMZUsUrdmRn/1nW+0
DxFqmnrqJx+LgtHRCSQEToay/Ed7YIDNcDpxtdOukMSfgsuMmsecQSTIqs2j9hgg
DZ8yFbOIUkLp7YcEAS28JvWDrtkwCatyun2Ehle9rg5jbNBBhsQPsiBNcXJPchod
plv44+eVBv8a9SS0YlJkcOa6FNTwY6+4AF75HqOlFztnm6LsFK2Wvd5FFDmB0Fey
JGMvt+z8HFtAFjOLN2Slh4ei45UdaiXfnOoGc953HPBekkzUI+TI40GokeN7C8OS
mNn0BMGcjZRFNdqIHo7ITWGC7oovD7rLaLzEIYsG6FX5RgERZkDMhEuh1swGyL8c
jy+MDaol/QEPLqVFlbaiWXsprnLdkxG4IhDs0d2SFQ+EvQM7b0+YthKaCxoJZyAl
GZi4nWYtOVPktOGs/BRAXkOAg7Vge9dZlxE4IJ++PIBBUxiXPRf9LKLwg/wQH8YF
L4Gki2a453OWhthQ0ROD7B+5XBsy/8t0xeu214WNfwI6UsqiD30=
=GwMD
-----END PGP SIGNATURE-----

5
selinux-autorelabel
View File

@ -30,8 +30,9 @@ efi_set_boot_next() {
}
relabel_selinux() {
# if /sbin/init is not labeled correctly this process is running in the
# wrong context, so a reboot will be required after relabel
# Switch SELinux to permissive mode, fix labeling issues (or execute shell
# and have the user fix them) and reboot the machine so that the correct
# labels are applied to all services.
AUTORELABEL=
. /etc/selinux/config
echo "0" > /sys/fs/selinux/enforce

2
sources
View File

@ -1,4 +1,4 @@
SHA512 (selinux-3.8.tar.gz) = 58d05cd17ebcb4975e49573d2019304e6bbe0692f0ec230d79dfbcd144c2ff695c137b83318cc5e04c618031db7764e697162a3a8ff753ecfa314e552ccb8b81
SHA512 (selinux-3.9.tar.gz) = ccfe9c8907ef50e35cda1e8282a4e02e8d2e1749dabde856343f236724214c89d0bcd4e799f383961b990c5fb9a6b0191880a478a8930af447951c8b36689720
SHA512 (selinux-gui.zip) = 3ae41eba5dd6d34e10dfdb97f4194d170ace2f3044e984077db7d26d05bdaad86625e48e5694e3e8680487ad99a50861d4bea30c4bf08e2820e3b7a8671270c7
SHA512 (selinux-policycoreutils.zip) = 0df9dc274e0d1a2e4e2467f95a18a5bf7b6de2428ac90a0a73d7f3bd766a897062af142ba3cf39cdb79565ba78af960bcd2e35865cc26e14bf2305321780c918
SHA512 (selinux-python.zip) = 35d209f8bcff498f66465499fcc4cef0780781276a4ba060b2d1d56eed1dd72d253f6b0eae5f679d46cf426b967a7aadac909363513be5d483c95a31249eacdd