policycoreutils-3.6-8

- sepolicy: Fix detection of writeable locations

Resolves: RHEL-141295

0031-sepolicy-Fix-detection-of-writeable-locations.patch

@@ -0,0 +1,65 @@
+From c5dbf35de55fadcc404149b02aad219da5bd3c4c Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <lautrbach@redhat.com>
+Date: Mon, 5 May 2025 18:28:40 +0200
+Subject: [PATCH] sepolicy: Fix detection of writeable locations
+
+- update substitutions from /etc/dnf/var
+
+It seems that by default dnf api does not read /etc/dnf/var/* files to
+update substitutions and so it can't resolve correct mirror list when a
+variable is part of the link.
+
+- alway run query.run()
+
+Fixes:
+    Traceback (most recent call last):
+      File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load
+        ret = self._repo.load()
+              ^^^^^^^^^^^^^^^^^
+      File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load
+        return _repo.Repo_load(self)
+               ^^^^^^^^^^^^^^^^^^^^^
+    libdnf._error.Error: Failed to download metadata for repo 'baseos':
+    Cannot prepare internal mirrorlist: Status code: 404 for
+    https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198)
+
+Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
+---
+ python/sepolicy/sepolicy/generate.py | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
+index f726ad51..a0314a70 100644
+--- a/python/sepolicy/sepolicy/generate.py
++++ b/python/sepolicy/sepolicy/generate.py
+@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s;
+         import dnf
+ 
+         with dnf.Base() as base:
++            base.conf.substitutions.update_from_etc('/')
+             base.read_all_repos()
+             base.fill_sack(load_system_repo=True)
+ 
+             query = base.sack.query()
+ 
+-            pq = query.available()
+-            pq = pq.filter(file=self.program)
++            pq = query.filter(file=self.program)
+ 
+-            for pkg in pq:
++            for pkg in pq.run():
+                 self.rpms.append(pkg.name)
+                 for fname in pkg.files:
+                     for b in self.DEFAULT_DIRS:
+@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s;
+                                 self.add_dir(fname)
+                 sq = query.available()
+                 sq = sq.filter(provides=pkg.source_name)
+-                for bpkg in sq:
++                for bpkg in sq.run():
+                     for fname in bpkg.files:
+                         for b in self.DEFAULT_DIRS:
+                             if b == "/etc":
+-- 
+2.53.0
+

policycoreutils.spec

@@ -11,7 +11,7 @@
 Summary: SELinux policy core utilities
 Name:    policycoreutils
 Version: 3.6
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPL-2.0-or-later
 # https://github.com/SELinuxProject/selinux/wiki/Releases
 Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz
@@ -66,6 +66,7 @@ Patch0027: 0027-improve-semanage-man-pages-Add-examples-for-r-RANGE-.patch
 Patch0028: 0028-semanage-fcontext-8-improve-e-documentation.patch
 Patch0029: 0029-restorecond-Add-F-for-run-in-foreground.patch
 Patch0030: 0030-restorecond.service-Use-Type-simple.patch
+Patch0031: 0031-sepolicy-Fix-detection-of-writeable-locations.patch
 # Patch list end
 Obsoletes: policycoreutils < 2.0.61-2
 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138
@@ -475,6 +476,9 @@ The policycoreutils-restorecond package contains the restorecond service.
 %systemd_postun_with_restart restorecond.service
 
 %changelog
+* Fri Jul 17 2026 Vit Mojzis <vmojzis@redhat.com> - 3.6-8
+- sepolicy: Fix detection of writeable locations (RHEL-141295)
+
 * Tue Apr 07 2026 Petr Lautrbach <lautrbach@redhat.com> - 3.6-7
 - restorecond.service: Use Type=simple