From fdf08598f2b399045385ae817dd6abee165afc79 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 15 Jul 2026 16:20:11 +0400 Subject: [PATCH] Fix SELinux policy: use bool instead of tunable for virt_use_nfs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RHEL 10 selinux-policy eliminated all tunables in favor of booleans. The require block declared virt_use_nfs as a tunable, causing the compiled .pp to use tunableif in CIL, which fails to resolve against a boolean. Change to "bool virt_use_nfs" so the policy generates booleanif instead. Resolves: RHEL-210889 Signed-off-by: Marc-André Lureau --- selinux.patch | 2 +- swtpm.spec | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/selinux.patch b/selinux.patch index 7e69bc2..6e5f55e 100644 --- a/selinux.patch +++ b/selinux.patch @@ -17,7 +17,7 @@ index 2327721..c35056e 100644 type virtqemud_t; type virtqemud_tmp_t; + class file map; -+ tunable virt_use_nfs; ++ bool virt_use_nfs; } attribute_role swtpm_roles; diff --git a/swtpm.spec b/swtpm.spec index e46b88a..4e239ea 100644 --- a/swtpm.spec +++ b/swtpm.spec @@ -8,7 +8,7 @@ Summary: TPM Emulator Name: swtpm Version: 0.9.0 -Release: 5%{?dist} +Release: 6%{?dist} License: BSD-3-Clause Url: https://github.com/stefanberger/swtpm Source0: https://github.com/stefanberger/swtpm/archive/v%{version}/%{name}-%{version}.tar.gz @@ -202,6 +202,10 @@ fi %{_datadir}/swtpm/swtpm-create-tpmca %changelog +* Wed Jul 15 2026 Marc-André Lureau - 0.9.0-6 +- Fix SELinux policy: use bool instead of tunable for virt_use_nfs + Resolves: RHEL-210889 + * Tue Jan 14 2025 Marc-André Lureau - 0.9.0-5 - Add extra SELinux policies. https://github.com/stefanberger/swtpm/issues/970