diff --git a/0031-sepolicy-Fix-detection-of-writeable-locations.patch b/0031-sepolicy-Fix-detection-of-writeable-locations.patch new file mode 100644 index 0000000..8db8f5e --- /dev/null +++ b/0031-sepolicy-Fix-detection-of-writeable-locations.patch @@ -0,0 +1,65 @@ +From c5dbf35de55fadcc404149b02aad219da5bd3c4c Mon Sep 17 00:00:00 2001 +From: Petr Lautrbach +Date: Mon, 5 May 2025 18:28:40 +0200 +Subject: [PATCH] sepolicy: Fix detection of writeable locations + +- update substitutions from /etc/dnf/var + +It seems that by default dnf api does not read /etc/dnf/var/* files to +update substitutions and so it can't resolve correct mirror list when a +variable is part of the link. + +- alway run query.run() + +Fixes: + Traceback (most recent call last): + File "/usr/lib/python3.12/site-packages/dnf/repo.py", line 574, in load + ret = self._repo.load() + ^^^^^^^^^^^^^^^^^ + File "/usr/lib64/python3.12/site-packages/libdnf/repo.py", line 467, in load + return _repo.Repo_load(self) + ^^^^^^^^^^^^^^^^^^^^^ + libdnf._error.Error: Failed to download metadata for repo 'baseos': + Cannot prepare internal mirrorlist: Status code: 404 for + https://mirrors.centos.org/metalink?repo=centos-baseos-$stream&arch=x86_64&protocol=https,http (IP:152.19.134.198) + +Signed-off-by: Petr Lautrbach +--- + python/sepolicy/sepolicy/generate.py | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py +index f726ad51..a0314a70 100644 +--- a/python/sepolicy/sepolicy/generate.py ++++ b/python/sepolicy/sepolicy/generate.py +@@ -1267,15 +1267,15 @@ allow %s_t %s_t:%s_socket name_%s; + import dnf + + with dnf.Base() as base: ++ base.conf.substitutions.update_from_etc('/') + base.read_all_repos() + base.fill_sack(load_system_repo=True) + + query = base.sack.query() + +- pq = query.available() +- pq = pq.filter(file=self.program) ++ pq = query.filter(file=self.program) + +- for pkg in pq: ++ for pkg in pq.run(): + self.rpms.append(pkg.name) + for fname in pkg.files: + for b in self.DEFAULT_DIRS: +@@ -1288,7 +1288,7 @@ allow %s_t %s_t:%s_socket name_%s; + self.add_dir(fname) + sq = query.available() + sq = sq.filter(provides=pkg.source_name) +- for bpkg in sq: ++ for bpkg in sq.run(): + for fname in bpkg.files: + for b in self.DEFAULT_DIRS: + if b == "/etc": +-- +2.53.0 + diff --git a/policycoreutils.spec b/policycoreutils.spec index 183ed59..f318cb2 100644 --- a/policycoreutils.spec +++ b/policycoreutils.spec @@ -11,7 +11,7 @@ Summary: SELinux policy core utilities Name: policycoreutils Version: 3.6 -Release: 7%{?dist} +Release: 8%{?dist} License: GPL-2.0-or-later # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/selinux-3.6.tar.gz @@ -66,6 +66,7 @@ Patch0027: 0027-improve-semanage-man-pages-Add-examples-for-r-RANGE-.patch Patch0028: 0028-semanage-fcontext-8-improve-e-documentation.patch Patch0029: 0029-restorecond-Add-F-for-run-in-foreground.patch Patch0030: 0030-restorecond.service-Use-Type-simple.patch +Patch0031: 0031-sepolicy-Fix-detection-of-writeable-locations.patch # Patch list end Obsoletes: policycoreutils < 2.0.61-2 Conflicts: filesystem < 3, selinux-policy-base < 3.13.1-138 @@ -475,6 +476,9 @@ The policycoreutils-restorecond package contains the restorecond service. %systemd_postun_with_restart restorecond.service %changelog +* Fri Jul 17 2026 Vit Mojzis - 3.6-8 +- sepolicy: Fix detection of writeable locations (RHEL-141295) + * Tue Apr 07 2026 Petr Lautrbach - 3.6-7 - restorecond.service: Use Type=simple