rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebuild policy before running {binsbin|varrun}-convert.sh

Browse Source 
Both {binsbin|varrun}-convert.sh scripts use
/etc/selinux/<policytype>/contexts/files/file_contexts file, which is
updated during policy rebuild. Therefore the policy needs to be rebuilt
before the scripts are executed in order for
%remove{Binsbin|VarRun}ModuleLua to take effect.

Without the policy rebuild, both extra_{binsbin|varrun} modules get
removed on each selinux-policy-targeted update, since
%remove{Binsbin|VarRun}ModuleLua removes the module file, but there is
no change to /contexts/files/file_contexts and
{binsbin|varrun}-convert.sh result in noop (no module installation).

Also, fix labels of both /var/run and /usr/sbin since %relabel is
executed before the -convert scripts.

Resolves: RHEL-141813
This commit is contained in:
Vit Mojzis 2026-02-23 12:32:52 +01:00
parent 10195126e9
commit e9fa604b58
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
selinux-policy.spec
View File

@ -625,11 +625,11 @@ exit 0
%posttrans targeted
%checkConfigConsistency targeted
%postInstall $1 targeted
%{_libexecdir}/selinux/varrun-convert.sh targeted
%{_libexecdir}/selinux/binsbin-convert.sh targeted
%postInstall $1 targeted
%{_sbindir}/restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm /etc/mdevctl.d
%{_sbindir}/restorecon -i /usr/sbin/fapolicyd* /usr/sbin/usbguard*
%{_sbindir}/restorecon -Ri /usr/sbin /var/run
%postun targeted
if [ $1 = 0 ]; then
@ -966,10 +966,11 @@ exit 0
%posttrans mls
%checkConfigConsistency mls
%postInstall $1 mls
%{_libexecdir}/selinux/varrun-convert.sh mls
%{_libexecdir}/selinux/binsbin-convert.sh mls
%postInstall $1 mls
%{_sbindir}/restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm
%{_sbindir}/restorecon -Ri /usr/sbin /var/run
%postun mls
if [ $1 = 0 ]; then