policycoreutils-3.2-4

- policycoreutils-dbus requires polkit
- fixfiles: do not exclude /dev and /run in -C mode
- dbus: use GLib.MainLoop

Resolves: rhbz#1949841

Modified-by: Petr Lautrbach <plautrba@redhat.com>
Modified-by: Petr Lautrbach <plautrba@redhat.com>
Modified-by: Petr Lautrbach <plautrba@redhat.com>

0018-Do-not-use-Python-slip.patch

@@ -1,4 +1,4 @@
-From ebfdc2e9e1eebfa75f1c230085ea4def40905158 Mon Sep 17 00:00:00 2001
+From 02fd46cee210fc693ddf985d7d03674397f8342f Mon Sep 17 00:00:00 2001
 From: Petr Lautrbach <plautrba@redhat.com>
 Date: Thu, 15 Apr 2021 17:39:39 +0200
 Subject: [PATCH] Do not use Python slip
@@ -14,7 +14,7 @@ Signed-off-by: Petr Lautrbach <plautrba@redhat.com>
  2 files changed, 41 insertions(+), 37 deletions(-)
 
 diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
-index be4f4557a9fa..f13f90cddbb6 100644
+index be4f4557a9fa..b7c9378bcb5d 100644
 --- a/dbus/selinux_server.py
 +++ b/dbus/selinux_server.py
 @@ -4,26 +4,33 @@ import dbus
@@ -118,7 +118,7 @@ index be4f4557a9fa..f13f90cddbb6 100644
 -    def relabel_on_boot(self, value):
 +    @dbus.service.method("org.selinux", in_signature='i', sender_keyword="sender")
 +    def relabel_on_boot(self, value, sender):
-+        if not self.is_authorized(sender, "org.selinux.relabel_on_reboot"):
++        if not self.is_authorized(sender, "org.selinux.relabel_on_boot"):
 +            raise dbus.exceptions.DBusException("Not authorized")
          if value == 1:
              fd = open("/.autorelabel", "w")

0019-dbus-Use-GLib.MainLoop.patch

@@ -0,0 +1,43 @@
+From 30b9e992819a2c94434a0a30d5ce96e642c84d20 Mon Sep 17 00:00:00 2001
+From: Petr Lautrbach <plautrba@redhat.com>
+Date: Wed, 12 May 2021 19:19:29 +0200
+Subject: [PATCH] dbus: Use GLib.MainLoop()
+
+Fixes:
+    PyGIDeprecationWarning: GObject.MainLoop is deprecated; use GLib.MainLoop instead
+---
+ dbus/selinux_server.py | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/dbus/selinux_server.py b/dbus/selinux_server.py
+index b7c9378bcb5d..a969f2268ceb 100644
+--- a/dbus/selinux_server.py
++++ b/dbus/selinux_server.py
+@@ -2,8 +2,9 @@
+ 
+ import dbus
+ import dbus.service
+-import dbus.mainloop.glib
++from dbus.mainloop.glib import DBusGMainLoop
+ from gi.repository import GObject
++from gi.repository import GLib
+ import os
+ import selinux
+ from subprocess import Popen, PIPE, STDOUT
+@@ -145,9 +146,10 @@ class selinux_server(dbus.service.Object):
+         raise ValueError("%s does not exist" % path)
+ 
+ if __name__ == "__main__":
+-    mainloop = GObject.MainLoop()
+-    dbus.mainloop.glib.DBusGMainLoop(set_as_default=True)
++    DBusGMainLoop(set_as_default=True)
++    mainloop = GLib.MainLoop()
++
+     system_bus = dbus.SystemBus()
+     name = dbus.service.BusName("org.selinux", system_bus)
+-    object = selinux_server(system_bus, "/org/selinux/object")
++    server = selinux_server(system_bus, "/org/selinux/object")
+     mainloop.run()
+-- 
+2.31.1
+

0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch

@@ -0,0 +1,67 @@
+From d36c5c43d17896ebd655f8bdc6e0303dcbf2f47b Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Fri, 19 Mar 2021 22:30:59 +0100
+Subject: [PATCH] policycoreutils/setfiles: do not create useless
+ setfiles.8.man file
+
+Seems to have been there to allow for some sed substitution over the
+text. Now that this is gone, the redundant intermediate file can be
+removed, too.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+---
+ policycoreutils/setfiles/.gitignore | 1 -
+ policycoreutils/setfiles/Makefile   | 9 +++------
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+ delete mode 100644 policycoreutils/setfiles/.gitignore
+
+diff --git a/policycoreutils/setfiles/.gitignore b/policycoreutils/setfiles/.gitignore
+deleted file mode 100644
+index 5e899c95af23..000000000000
+--- a/policycoreutils/setfiles/.gitignore
++++ /dev/null
+@@ -1 +0,0 @@
+-setfiles.8.man
+diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile
+index a3bbbe116b7f..63d818509791 100644
+--- a/policycoreutils/setfiles/Makefile
++++ b/policycoreutils/setfiles/Makefile
+@@ -13,7 +13,7 @@ ifeq ($(AUDITH), y)
+ 	override LDLIBS += -laudit
+ endif
+ 
+-all: setfiles restorecon restorecon_xattr man
++all: setfiles restorecon restorecon_xattr
+ 
+ setfiles: setfiles.o restore.o
+ 
+@@ -22,16 +22,13 @@ restorecon: setfiles
+ 
+ restorecon_xattr: restorecon_xattr.o restore.o
+ 
+-man:
+-	@cp -af setfiles.8 setfiles.8.man
+-
+ install: all
+ 	[ -d $(DESTDIR)$(MANDIR)/man8 ] || mkdir -p $(DESTDIR)$(MANDIR)/man8
+ 	-mkdir -p $(DESTDIR)$(SBINDIR)
+ 	install -m 755 setfiles $(DESTDIR)$(SBINDIR)
+ 	(cd $(DESTDIR)$(SBINDIR) && ln -sf setfiles restorecon)
+ 	install -m 755 restorecon_xattr $(DESTDIR)$(SBINDIR)
+-	install -m 644 setfiles.8.man $(DESTDIR)$(MANDIR)/man8/setfiles.8
++	install -m 644 setfiles.8 $(DESTDIR)$(MANDIR)/man8/setfiles.8
+ 	install -m 644 restorecon.8 $(DESTDIR)$(MANDIR)/man8/restorecon.8
+ 	install -m 644 restorecon_xattr.8 $(DESTDIR)$(MANDIR)/man8/restorecon_xattr.8
+ 	for lang in $(LINGUAS) ; do \
+@@ -42,7 +39,7 @@ install: all
+ 	done
+ 
+ clean:
+-	rm -f setfiles restorecon restorecon_xattr *.o setfiles.8.man
++	rm -f setfiles restorecon restorecon_xattr *.o
+ 
+ indent:
+ 	../../scripts/Lindent $(wildcard *.[ch])
+-- 
+2.31.1
+

0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch

@@ -0,0 +1,50 @@
+From 38d88fc70844b6f5b02883172af6df7bbd05de24 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Mon, 1 Mar 2021 18:19:22 +0100
+Subject: [PATCH] fixfiles: do not exclude /dev and /run in -C mode
+
+I can't think of a good reason why they should be excluded. On the
+contrary, excluding them can cause trouble very easily if some labeling
+rules for these directories change. For example, we changed the label
+for /dev/nvme* from nvme_device_t to fixed_disk_device_t in Fedora
+(updating the allow rules accordingly) and after policy update they
+ended up with an invalid context, causing denials.
+
+Thus, remove /dev and /run from the excludes. While there, also add
+/root to the basic excludes to match the regex that excludes fc rules
+(that should be effectively no functional change).
+
+I did a sanity check on my system by running `restorecon -nv /dev /run`
+and it didn't report any label differences.
+
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Petr Lautrbach <plautrba@redhat.com>
+---
+ policycoreutils/scripts/fixfiles | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/policycoreutils/scripts/fixfiles b/policycoreutils/scripts/fixfiles
+index e73bb81c3336..cb20002ab613 100755
+--- a/policycoreutils/scripts/fixfiles
++++ b/policycoreutils/scripts/fixfiles
+@@ -163,7 +163,7 @@ newer() {
+ #
+ diff_filecontext() {
+ EXCLUDEDIRS="`exclude_dirs_from_relabelling`"
+-for i in /sys /proc /dev /run /mnt /var/tmp /var/lib/BackupPC /home /tmp /dev; do
++for i in /sys /proc /mnt /var/tmp /var/lib/BackupPC /home /root /tmp; do
+     [ -e $i ]  && EXCLUDEDIRS="${EXCLUDEDIRS} -e $i";
+ done
+ LogExcluded
+@@ -176,7 +176,7 @@ if [ -f ${PREFC} -a -x /usr/bin/diff ]; then
+ 	sed -r -e 's,:s0, ,g' $FC | sort -u | \
+ 	/usr/bin/diff -b ${PREFCTEMPFILE} - | \
+ 	    grep '^[<>]'|cut -c3-| grep ^/ | \
+-	    egrep -v '(^/home|^/root|^/tmp|^/dev)' |\
++	    egrep -v '(^/home|^/root|^/tmp)' |\
+ 	sed -r -e 's,[[:blank:]].*,,g' \
+ 	       -e 's|\(([/[:alnum:]]+)\)\?|{\1,}|g' \
+ 	       -e 's|([/[:alnum:]])\?|{\1,}|g' \
+-- 
+2.31.1
+

policycoreutils.spec

@@ -11,7 +11,7 @@
 Summary: SELinux policy core utilities
 Name:    policycoreutils
 Version: 3.2
-Release: 3.1%{?dist}
+Release: 4%{?dist}
 License: GPLv2
 # https://github.com/SELinuxProject/selinux/wiki/Releases
 Source0: https://github.com/SELinuxProject/selinux/releases/download/3.2/selinux-3.2.tar.gz
@@ -49,6 +49,9 @@ Patch0015: 0015-semodule-utils-Fix-RESOURCE_LEAK-coverity-scan-defec.patch
 Patch0016: 0016-sandbox-Use-matchbox-window-manager-instead-of-openb.patch
 Patch0017: 0017-sepolicy-Fix-flake8-warnings-in-Fedora-only-code.patch
 Patch0018: 0018-Do-not-use-Python-slip.patch
+Patch0019: 0019-dbus-Use-GLib.MainLoop.patch
+Patch0020: 0020-policycoreutils-setfiles-do-not-create-useless-setfi.patch
+Patch0021: 0021-fixfiles-do-not-exclude-dev-and-run-in-C-mode.patch
 # Patch list end
 
 Obsoletes: policycoreutils < 2.0.61-2
@@ -91,6 +94,8 @@ tar -xvf %{SOURCE14} -C python/sepolicy/
 
 # Since patches containing translation changes were too big, translations were moved to separate tarballs
 # For more information see README.translations
+# First remove old translation files
+rm -f policycoreutils/po/*.po python/po/*.po gui/po/*.po sandbox/po/*.po
 tar -x -f %{SOURCE20} -C policycoreutils -z
 tar -x -f %{SOURCE21} -C python -z
 tar -x -f %{SOURCE22} -C gui -z
@@ -213,6 +218,7 @@ an SELinux environment.
 Summary:    SELinux policy core DBUS api
 Requires:   python3-policycoreutils = %{version}-%{release}
 Requires:   python3-gobject-base
+Requires:   polkit
 BuildArch:  noarch
 
 %description dbus
@@ -508,6 +514,11 @@ The policycoreutils-restorecond package contains the restorecond service.
 %systemd_postun_with_restart restorecond.service
 
 %changelog
+* Thu May 13 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-4
+- policycoreutils-dbus requires polkit
+- fixfiles: do not exclude /dev and /run in -C mode
+- dbus: use GLib.MainLoop
+
 * Fri Apr 23 2021 Petr Lautrbach <plautrba@redhat.com> - 3.2-3.1
 - Do not use Python slip (#1949841)