rpms/swtpm
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix SELinux policy: use bool instead of tunable for virt_use_nfs

Browse Source 
RHEL 10 selinux-policy eliminated all tunables in favor of booleans.
The require block declared virt_use_nfs as a tunable, causing the
compiled .pp to use tunableif in CIL, which fails to resolve against
a boolean. Change to "bool virt_use_nfs" so the policy generates
booleanif instead.

Resolves: RHEL-210889

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
This commit is contained in:
Marc-André Lureau 2026-07-15 16:20:11 +04:00
parent 8b3d376f34
commit fdf08598f2
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
selinux.patch
View File

@ -17,7 +17,7 @@ index 2327721..c35056e 100644
type virtqemud_t;
type virtqemud_tmp_t;
+ class file map;
+ tunable virt_use_nfs;
+ bool virt_use_nfs;
}
attribute_role swtpm_roles;

6
swtpm.spec
View File

@ -8,7 +8,7 @@
Summary: TPM Emulator
Name: swtpm
Version: 0.9.0
Release: 5%{?dist}
Release: 6%{?dist}
License: BSD-3-Clause
Url: https://github.com/stefanberger/swtpm
Source0: https://github.com/stefanberger/swtpm/archive/v%{version}/%{name}-%{version}.tar.gz
@ -202,6 +202,10 @@ fi
%{_datadir}/swtpm/swtpm-create-tpmca
%changelog
* Wed Jul 15 2026 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-6
- Fix SELinux policy: use bool instead of tunable for virt_use_nfs
Resolves: RHEL-210889
* Tue Jan 14 2025 Marc-André Lureau <marcandre.lureau@redhat.com> - 0.9.0-5
- Add extra SELinux policies.
https://github.com/stefanberger/swtpm/issues/970