Sync from SUSE:SLFO:1.1 pcp revision 826e534da9f66b17f2c71604f81f885c

pcp.changes

@@ -1,5 +1,10 @@
 -------------------------------------------------------------------
-Tue Jan 21 08:05:48 UTC 2025 - pgajdos@suse.com
+Tue Mar 25 15:21:38 UTC 2025 - Martin Schreiner <martin.schreiner@suse.com>
+
+- Enable custom pcp-selinux module (bsc#1237260)
+
+-------------------------------------------------------------------
+Wed Sep 18 11:33:30 UTC 2024 - David Disseldorp <ddiss@suse.com>
 
 - Fix symlink race; CVE-2024-45770; (bsc#1230552)
   + 0012-src-pmpost-pmpost.c-guard-against-possible-symlink-a.patch
@@ -12,12 +17,6 @@ Tue Jan 21 08:05:48 UTC 2025 - pgajdos@suse.com
   + 0018-src-libpcp-src-p_result.c-re-instate-__pmPrintResult.patch
   + 0019-src-libpcp-src-p_result.c-32-bit-fix-for-SUSE-Issue-.patch
 
--------------------------------------------------------------------
-Wed Nov 27 14:42:34 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
-
-- Replace dejavu-fonts with liberation-fonts.
-- Fix for bsc#1232695.
-
 -------------------------------------------------------------------
 Mon Apr 15 10:51:06 UTC 2024 - Dirk Müller <dmueller@suse.com>
 
@@ -30,7 +29,7 @@ Wed Apr  3 14:49:06 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
 - Add fix for bsc#1222121 CVE-2024-3019:
   * 0011-disable-redis-proxying-by-default.patch
 
-------------------------------------------------------------------
+-------------------------------------------------------------------
 Mon Apr  1 01:21:44 UTC 2024 - Martin Schreiner <martin.schreiner@suse.com>
 
 - Upgrade to 6.2.0 (bsc#1217826 CVE-2023-6917, bsc#1217783):

pcp.spec

@@ -101,9 +101,8 @@ Patch17:        0017-src-libpcp-src-p_result.c-re-instate-__pmPrintResult.patch
 Patch18:        0018-src-libpcp-src-p_result.c-re-instate-__pmPrintResult.patch
 Patch19:        0019-src-libpcp-src-p_result.c-32-bit-fix-for-SUSE-Issue-.patch
 
-%if 0%{?fedora} || 0%{?rhel}
 %global disable_selinux 0
-%else
+%if 0%{?suse_version} < 1600
 %global disable_selinux 1
 %endif
 
@@ -380,7 +379,7 @@ BuildRequires:  qt5-qtsvg-devel
 %endif	# default_qt
 %endif	# !disable_qt
 %if !%{disable_selinux}
-Requires:       pcp-selinux = %{version}-%{release}
+Requires:       (pcp-selinux = %{version}-%{release} if selinux-policy-targeted)
 %endif
 
 Requires:       bash
@@ -414,8 +413,7 @@ Provides:       pcp-pmda-nvidia = %{version}
 %global _pmdasdir	%{_localstatedir}/lib/pcp/pmdas
 %global _pmdasexecdir	%{_libexecdir}/pcp/pmdas
 %global _testsdir	%{_localstatedir}/lib/pcp/testsuite
-%global _selinuxdir	%{_localstatedir}/lib/pcp/selinux
-%global _selinuxexecdir	%{_libexecdir}/pcp/selinux
+%global _selinuxdir     %{_datadir}/selinux/packages/targeted
 %global _logconfdir	%{_localstatedir}/lib/pcp/config/pmlogconf
 %global _ieconfdir	%{_localstatedir}/lib/pcp/config/pmieconf
 %global _tapsetdir	%{_datadir}/systemtap/tapset
@@ -546,16 +544,6 @@ else
 fi
 }
 
-%global selinux_handle_policy() %{expand:
-if [ %1 -ge 1 ]
-then
-    %{_libexecdir}/pcp/bin/selinux-setup %{_selinuxdir} install %2
-elif [ %1 -eq 0 ]
-then
-    %{_libexecdir}/pcp/bin/selinux-setup %{_selinuxdir} remove %2
-fi
-}
-
 %description
 Performance Co-Pilot (PCP) provides a framework and services to support
 system-level performance monitoring and performance management.
@@ -3023,6 +3011,7 @@ License:        %{license_gplv2plus} AND %{license_cc_by}
 Group:          Applications/System
 URL:            https://pcp.io
 BuildRequires:  selinux-policy-devel
+BuildRequires:  selinux-policy-targeted
 %if 0%{?rhel} == 5
 BuildRequires:  setools
 %else
@@ -3250,8 +3239,6 @@ ls -1 %{buildroot}/%{_libexecdir}/pcp/bin |\
 %if !%{disable_selinux}
 ls -1 %{buildroot}/%{_selinuxdir} |\
   sed -e 's#^#'%{_selinuxdir}'\/#' > pcp-selinux.list
-ls -1 %{buildroot}/%{_selinuxexecdir} |\
-  sed -e 's#^#'%{_selinuxexecdir}'\/#' >> pcp-selinux.list
 ls -1 %{buildroot}/%{_libexecdir}/pcp/bin |\
   grep -E 'selinux-setup' |\
   sed -e 's#^#'%{_libexecdir}/pcp/bin'\/#' >> pcp-selinux.list
@@ -3400,17 +3387,6 @@ fi
 %endif
 %endif #zeroconf
 
-%if !%{disable_selinux}
-%post selinux
-%{selinux_handle_policy "$1" "pcpupstream"}
-
-%triggerin selinux -- docker-selinux
-%{selinux_handle_policy "$1" "pcpupstream-docker"}
-
-%triggerin selinux -- container-selinux
-%{selinux_handle_policy "$1" "pcpupstream-container"}
-%endif
-
 %post
 PCP_PMNS_DIR=%{_pmnsdir}
 PCP_LOG_DIR=%{_logsdir}
@@ -3472,17 +3448,6 @@ PCP_LOG_DIR=%{_logsdir}
 %postun -n libpcp_web%{libpcp_web_sover} -p /sbin/ldconfig
 %endif
 
-%if !%{disable_selinux}
-%preun selinux
-%{selinux_handle_policy "$1" "pcpupstream"}
-
-%triggerun selinux -- docker-selinux
-%{selinux_handle_policy "$1" "pcpupstream-docker"}
-
-%triggerun selinux -- container-selinux
-%{selinux_handle_policy "$1" "pcpupstream-container"}
-%endif
-
 %if 0%{?suse_version}
 %postun
 /sbin/ldconfig
@@ -3494,6 +3459,25 @@ PCP_LOG_DIR=%{_logsdir}
 %endif
 %endif
 
+%if !%{disable_selinux}
+%pre selinux
+%selinux_relabel_pre -s targeted
+
+%post selinux
+PCP_SELINUX_DIR=%{_selinuxdir}
+semodule -r pcpupstream-container >/dev/null 2>&1 || true
+semodule -r pcpupstream-docker >/dev/null 2>&1 || true
+semodule -r pcpupstream >/dev/null 2>&1 || true
+%selinux_modules_install -s targeted "$PCP_SELINUX_DIR/pcp.pp.bz2"
+%selinux_relabel_post -s targeted
+
+%postun selinux
+if [ $1 -eq 0 ]; then
+    %selinux_modules_uninstall -s targeted pcp
+    %selinux_relabel_post -s targeted
+fi
+%endif
+
 %files -f base.list
 #
 # Note: there are some headers (e.g. domain.h) and in a few cases some
@@ -4352,7 +4336,6 @@ PCP_LOG_DIR=%{_logsdir}
 %if !%{disable_selinux}
 %files selinux -f pcp-selinux.list
 %dir %{_selinuxdir}
-%dir %{_selinuxexecdir}
 %endif
 
 %if !%{disable_python3}