import tpm2-abrmd-selinux-2.3.1-1.el8

.gitignore

@@ -1 +1 @@
-SOURCES/tpm2-abrmd-2.0.0.tar.gz
+SOURCES/tpm2-abrmd-2.3.1.tar.gz

.tpm2-abrmd-selinux.metadata

@@ -1 +1 @@
-da4ee09c282617b771195e8058817a702417618a SOURCES/tpm2-abrmd-2.0.0.tar.gz
+02f70f06068fd32d7b9cd2394500e3eb8e7b1667 SOURCES/tpm2-abrmd-2.3.1.tar.gz

SOURCES/selinux-allow-fwupd-to-communicate-with-tpm2-abrmd.patch

@@ -0,0 +1,31 @@
+From 0bb388cc57231cb46f5bfa1a52425588fa149e89 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javierm@redhat.com>
+Date: Wed, 12 Feb 2020 13:48:29 +0100
+Subject: [PATCH] selinux: allow fwupd to communicate with tpm2-abrmd
+
+In Fedora, we have the following SELinux AVC error:
+
+Mar 07 09:18:35 river audit[1078]: USER_AVC pid=1078 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_return dest=:1.558 spid=8554 tpid=8550 scontext=system_u:system_r:tabrmd_t:s0 tcontext=system_u:system_r:fwupd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
+
+Allow fwupd to chat with tpm2-abrmd over D-BUS.
+
+Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
+---
+ selinux/tabrmd.te | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/selinux/tabrmd.te b/selinux/tabrmd.te
+index 59d7e548051..8996a46a0ea 100644
+--- a/selinux/tabrmd.te
++++ b/selinux/tabrmd.te
+@@ -21,6 +21,7 @@ optional_policy(`
+     dbus_stub()
+     dbus_system_domain(tabrmd_t, tabrmd_exec_t)
+     allow system_dbusd_t tabrmd_t:unix_stream_socket rw_stream_socket_perms;
++    fwupd_dbus_chat(tabrmd_t)
+ ')
+ 
+ tunable_policy(`tabrmd_connect_all_unreserved',`
+-- 
+2.24.1
+

SPECS/tpm2-abrmd-selinux.spec

@@ -5,13 +5,14 @@
 %global modulename tabrmd
 
 Name: tpm2-abrmd-selinux
-Version: 2.0.0
+Version: 2.3.1
-Release: 3%{?dist}
+Release: 1%{?dist}
 Summary: SELinux policies for tpm2-abrmd
 
 License: BSD
 URL:     https://github.com/tpm2-software/tpm2-abrmd
 Source0: https://github.com/tpm2-software/tpm2-abrmd/archive/%{version}/tpm2-abrmd-%{version}.tar.gz
+Patch0: selinux-allow-fwupd-to-communicate-with-tpm2-abrmd.patch
 
 BuildArch: noarch
 Requires: selinux-policy >= %{selinux_policyver}
@@ -28,7 +29,7 @@ Requires(post): policycoreutils-python-utils
 SELinux policy modules for tpm2-abrmd.
 
 %prep
-%setup -q -n tpm2-abrmd-%{version}
+%autosetup -p1 -n tpm2-abrmd-%{version}
 
 %build
 pushd selinux
@@ -67,6 +68,10 @@ fi
 %{_datadir}/selinux/devel/include/%{moduletype}/%{modulename}.if
 
 %changelog
+* Mon Nov 16 2020 Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.3-1
+- Rebase to 2.3.1 release
+resolves: rhbz#1898384
+
 * Tue May 14 2019 Jerry Snitselaar <jsnitsel@redhat.com> - 2.0.0-3
 - Fix Requires issue.
 - Add initial CI gating support.