Add extra requirements to cockpit-selinux-policies

cockpit.changes

@@ -1,3 +1,15 @@
+-------------------------------------------------------------------
+Wed Apr 16 11:48:12 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add extra requirements for selinux policies to cockpit-selinux-policies
+  so it can't be installed before selinux or policycoreutils
+
+-------------------------------------------------------------------
+Fri Apr 11 13:27:42 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
+
+- Add a requires for either sudo or polkit for assuming admin rights
+  (bsc#1240569)
+
 -------------------------------------------------------------------
 Mon Apr  7 10:41:09 UTC 2025 - Alice Brooks <alice.brooks@suse.com>
 

cockpit.spec

@@ -505,6 +505,7 @@ Requires: grep
 Requires: jeos-firstboot
 Requires: /usr/bin/pwscore
 Requires: /usr/bin/date
+Requires: (sudo or polkit)
 Provides: cockpit-shell = %{version}-%{release}
 Provides: cockpit-systemd = %{version}-%{release}
 Provides: cockpit-tuned = %{version}-%{release}
@@ -712,6 +713,9 @@ done
 %if 0%{?with_selinux}
 %package selinux-policies
 Summary: selinux policies required by cockpit
+Requires(post): selinux-policy-%{selinuxtype} >= %{selinux_policyver}
+Requires(post): selinux-tools
+Requires(post): policycoreutils
 
 %description selinux-policies
 package that contains selinux rules/policies needed by cockpit when selinux is enabled
@@ -723,15 +727,21 @@ package that contains selinux rules/policies needed by cockpit when selinux is e
 %ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
 
 %pre selinux-policies
-%selinux_relabel_pre -s %{selinuxtype}
+if %{_sbindir}/selinuxenabled 2>/dev/null; then
+    %selinux_relabel_pre -s %{selinuxtype}
+fi
 
 %post selinux-policies
 %selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
-%selinux_relabel_post -s %{selinuxtype}
+if [ -x %{_sbindir}/selinuxenabled ]; then
+    %selinux_relabel_post -s %{selinuxtype}
+fi
 
 %postun selinux-policies
 %selinux_modules_uninstall -s %{selinuxtype} %{name}
-%selinux_relabel_post -s %{selinuxtype}
+if [ -x %{_sbindir}/selinuxenabled ]; then
+    %selinux_relabel_post -s %{selinuxtype}
+fi
 %endif