Accepting request 1329427 from network:ha-clustering:Factory

OBS-URL: https://build.opensuse.org/request/show/1329427
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/drbd-utils?expand=0&rev=71

1252991-selinux-domtrans-from-kernel.patch

@@ -0,0 +1,46 @@
+From c2a3e3ea3de7eb7b9e0a8cf78cdb3bb7f56d52f3 Mon Sep 17 00:00:00 2001
+From: Cathy Hu <cahu@suse.de>
+Date: Fri, 14 Nov 2025 11:38:23 +0100
+Subject: [PATCH] selinux: Allow domtrans from kernel_t to drbd_t
+
+/usr/lib/drbd/crm-fence-peer.9.sh is labelled drbd_exec_t, however
+the domain lands in kernel_generic_helper_t as it is not allowed
+to transition from kernel_t to drbd_t.
+
+Additionally, when the domtrans succeeds, crm-fence-peer.9.sh
+will create entries in /proc with drbd_t label, so allowing that.
+---
+ selinux/drbd.te | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/selinux/drbd.te b/selinux/drbd.te
+index 8aa2c573..5b2e9861 100644
+--- a/selinux/drbd.te
++++ b/selinux/drbd.te
+@@ -50,6 +50,7 @@ require {
+ #============= drbd_t ==============
+ allow drbd_t self:capability { dac_read_search  kill net_admin sys_admin };
+ dontaudit drbd_t self:capability sys_tty_config;
++allow drbd_t self:dir rw_dir_perms;
+ allow drbd_t self:fifo_file rw_fifo_file_perms;
+ allow drbd_t self:unix_stream_socket create_stream_socket_perms;
+ allow drbd_t self:netlink_socket create_socket_perms;
+@@ -72,6 +73,7 @@ manage_dirs_pattern(drbd_t, drbd_tmp_t, drbd_tmp_t)
+ manage_files_pattern(drbd_t, drbd_tmp_t, drbd_tmp_t)
+ files_tmp_filetrans(drbd_t, drbd_tmp_t, {file dir})
+ 
++kernel_domtrans_to(drbd_t, drbd_exec_t)
+ kernel_read_system_state(drbd_t)
+ kernel_load_module(drbd_t)
+ 
+@@ -91,6 +93,7 @@ files_read_kernel_modules(drbd_t)
+ 
+ logging_send_syslog_msg(drbd_t)
+ 
++fs_associate_proc(drbd_t)
+ fs_getattr_xattr_fs(drbd_t)
+ 
+ modutils_read_module_config(drbd_t)
+-- 
+2.51.1
+

bsc-1233273-1252991_drbd.ocf-update-for-OCF-1.1.patch

@@ -1,7 +1,7 @@
-From 3baaf88af512492dd5315a50cf421fbcf51ef9b8 Mon Sep 17 00:00:00 2001
+From 8c53c6777e4336f1d4e50279dc539ed70aa04f33 Mon Sep 17 00:00:00 2001
 From: Su Yue <glass.su@suse.com>
 Date: Sun, 7 Jul 2024 16:52:18 +0800
-Subject: [PATCH 3/3] drbd.ocf: update for OCF 1.1
+Subject: [PATCH] drbd.ocf: update for OCF 1.1
 
 According to [1], the commit
 1. bumps drbd ocf version to 1.5
@@ -13,17 +13,47 @@ According to [1], the commit
 Because of change <4>, the drbd ocf RA won't be able to support old
 names so we need to bump version of the RA.
 
+Also set default role in crm-fence-peer scripts to 'Promoted'.
+
 [1] Links: https://projects.clusterlabs.org/w/development/update_resource_agent_for_ocf_1.1/
 Signed-off-by: Su Yue <glass.su@suse.com>
 ---
- scripts/drbd.ocf | 16 ++++++++--------
- 1 file changed, 8 insertions(+), 8 deletions(-)
+ scripts/crm-fence-peer.9.sh |  2 +-
+ scripts/crm-fence-peer.sh   |  2 +-
+ scripts/drbd.ocf            | 16 ++++++++--------
+ 3 files changed, 10 insertions(+), 10 deletions(-)
 
+diff --git a/scripts/crm-fence-peer.9.sh b/scripts/crm-fence-peer.9.sh
+index b326a1656c15..9fb0b7dee34d 100755
+--- a/scripts/crm-fence-peer.9.sh
++++ b/scripts/crm-fence-peer.9.sh
+@@ -1444,7 +1444,7 @@ fi
+ # apply defaults:
+ : "== fencing_attribute   == ${fencing_attribute:="#uname"}"
+ : "== id_prefix           == ${id_prefix:="drbd-fence-by-handler"}"
+-: "== role                == ${role:="Master"}"
++: "== role                == ${role:="Promoted"}"
+ 
+ # defaults suitable for most cases
+ : "== net_hickup_time     == ${net_hickup_time:=0}"
+diff --git a/scripts/crm-fence-peer.sh b/scripts/crm-fence-peer.sh
+index 3932937940ce..ad857e4dfcce 100755
+--- a/scripts/crm-fence-peer.sh
++++ b/scripts/crm-fence-peer.sh
+@@ -1046,7 +1046,7 @@ fi
+ # apply defaults:
+ : "== fencing_attribute   == ${fencing_attribute:="#uname"}"
+ : "== id_prefix           == ${id_prefix:="drbd-fence-by-handler"}"
+-: "== role                == ${role:="Master"}"
++: "== role                == ${role:="Promoted"}"
+ 
+ # defaults suitable for most cases
+ : "== net_hickup_time     == ${net_hickup_time:=0}"
 diff --git a/scripts/drbd.ocf b/scripts/drbd.ocf
-index bbe25f38edda..5b213640ec38 100755
+index 1d051baa550d..8dfa5c465f5b 100755
 --- a/scripts/drbd.ocf
 +++ b/scripts/drbd.ocf
-@@ -233,13 +233,13 @@ meta_data() {
+@@ -221,13 +221,13 @@ meta_data() {
  <?xml version="1.0"?>
  <!DOCTYPE resource-agent SYSTEM "ra-api-1.dtd">
  <!-- version attribute is version of this resource agent -->
@@ -40,7 +70,7 @@ index bbe25f38edda..5b213640ec38 100755
  DRBD is a shared-nothing replicated storage device.
  
  NOTE:
-@@ -253,10 +253,10 @@ See the DRBD User's Guide for more information.
+@@ -241,10 +241,10 @@ See the DRBD User's Guide for more information.
  https://docs.linbit.com/
  </longdesc>
  
@@ -53,7 +83,7 @@ index bbe25f38edda..5b213640ec38 100755
  <longdesc lang="en">
  The name of the drbd resource from the drbd.conf file.
  </longdesc>
-@@ -483,8 +483,8 @@ to be generated after the failover of a "healthy" DRBD.
+@@ -471,8 +471,8 @@ to be generated after the failover of a "healthy" DRBD.
  <action name="demote"	timeout="90" />
  <action name="notify"	timeout="90" />
  <action name="stop"    timeout="100" />
@@ -64,7 +94,7 @@ index bbe25f38edda..5b213640ec38 100755
  <action name="meta-data"  timeout="5" />
  <action name="validate-all" />
  </actions>
-@@ -974,7 +974,7 @@ drbd_monitor() {
+@@ -962,7 +962,7 @@ drbd_monitor() {
  	fi
  
  	case $status in
@@ -74,5 +104,5 @@ index bbe25f38edda..5b213640ec38 100755
  	(2) : "OCF_ERR_ARGS" ;;
  	(3) : "OCF_ERR_UNIMPLEMENTED" ;;
 -- 
-2.45.2
+2.50.1 (Apple Git-155)
 

bsc-1239437_drbd.rules-fix-missing-udev-device.patch

@@ -1,37 +0,0 @@
-From 9cd344fadd8b142c9995055619695d7b96014d83 Mon Sep 17 00:00:00 2001
-From: Heming Zhao <heming.zhao@suse.com>
-Date: Thu, 13 Mar 2025 15:43:50 +0800
-Subject: [PATCH] drbd.rules: fix missing udev device
-
-This commit partialy reverts commit aa6409657553 ("drbd.rules: use
-drbdsetup udev command"). The changes in aa6409657553 switch udev
-generator from drbdadm to drbdsetup, which introduces incompatibility
-with existing udev rules.
-
-See bsc#1239437 for more details.
-
-Signed-off-by: Heming Zhao <heming.zhao@suse.com>
----
- scripts/drbd.rules.in | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scripts/drbd.rules.in b/scripts/drbd.rules.in
-index c918facb8768..469996e23efd 100644
---- a/scripts/drbd.rules.in
-+++ b/scripts/drbd.rules.in
-@@ -3,10 +3,11 @@
- SUBSYSTEM!="block", GOTO="drbd_end"
- KERNEL!="drbd*", GOTO="drbd_end"
- 
--IMPORT{program}="@sbindir@/drbdsetup udev %m"
-+IMPORT{program}="@sbindir@/drbdadm sh-udev minor-%m"
- 
- ENV{SYMLINK_BY_DISK}!="", SYMLINK+="$env{SYMLINK_BY_DISK}"
- ENV{SYMLINK_BY_RES}!="", SYMLINK+="$env{SYMLINK_BY_RES}"
-+ENV{DEVICE}=="drbd_?*", SYMLINK+="$env{DEVICE}"
- ENV{SYSTEMD_WANTS}="drbd-graceful-shutdown.service"
- 
- LABEL="drbd_end"
--- 
-2.43.0
-

bsc-1247534_drbd-didnt-start-due-to-drbd_rules-returning-err.patch

@@ -0,0 +1,25 @@
+diff -Nupr a/scripts/drbd.ocf b/scripts/drbd.ocf
+--- a/scripts/drbd.ocf	2025-08-15 14:56:51.370952179 +0800
++++ b/scripts/drbd.ocf	2025-08-15 14:57:19.900056780 +0800
+@@ -1621,6 +1621,21 @@ _drbd_validate_all () {
+ 		# (as is the case here), we don't need to add "--stacked"
+ 		# anymore, even if they are stacked.
+ 		: # nothing to do.
++
++		# ref bsc#1239437 bsc#1247534
++		# For device names like drbd_tom, drbd_jerry, ... (not style: drbd[0-9]+
++		# we change the path to /dev/drbd${minor}.
++		for i in "${!DRBD_DEVICES[@]}"; do
++			dev=$(basename ${DRBD_DEVICES[$i]})
++			if [[ ! $dev =~ drbd[0-9]+ ]]; then
++				minor=$($DRBDADM dump $DRBD_RESOURCE | grep -Eo "${dev}[[:space:]]minor[[:space:]][0-9]+" | cut -d' ' -f 3)
++				if [[ $minor =~ ^[0-9]+$ ]]; then
++					DRBD_DEVICES[$i]="/dev/drbd${minor}"
++				else
++					ocf_log warn "$dev doesn't have minor"
++				fi
++			fi
++		done
+ 	elif DRBD_DEVICES=($($DRBDADM --stacked sh-dev $DRBD_RESOURCE 2>/dev/null)); then
+ 		# apparently a "stacked" resource. Remember for future DRBDADM calls.
+ 		DRBDADM="$DRBDADM -S"

bsc-1256961_drbdmon-remove-unused-variables-to-fix-gcc16-errors.patch

@@ -0,0 +1,54 @@
+From e826915c83bf93cb13aebf0ff61477787ccbf55b Mon Sep 17 00:00:00 2001
+From: Su Yue <glass.su@suse.com>
+Date: Tue, 27 Jan 2026 12:41:06 +0800
+Subject: [PATCH] drbdmon: remove unused variables to fix gcc16 errors
+
+drbd-utils doesn't build with GCC 16:
+
+[   38s] terminal/MDspTaskDetail.cpp: In member function virtual void MDspTaskDetail::display_content():
+[   38s] terminal/MDspTaskDetail.cpp:263:22: error: variable skip_ctr set but not used [-Werror=unused-but-set-variable=]
+[   38s]   263 |             uint32_t skip_ctr = 0;
+[   38s]       |                      ^~~~~~~~
+[   38s] terminal/MDspTaskDetail.cpp:277:22: error: variable print_ctr set but not used [-Werror=unused-but-set-variable=]
+[   38s]   277 |             uint32_t print_ctr = 0;
+[   38s]       |                      ^~~~~~~~~
+[   38s] cc1plus: all warnings being treated as errors
+
+Starting with GCC 16, var pre/postincrements and var @= expr no longer count as uses at some warning levels.
+
+skip_ctr and print_ctr are set but not used so remove them to fix errors.
+
+Signed-off-by: Su Yue <glass.su@suse.com>
+---
+ user/drbdmon/terminal/MDspTaskDetail.cpp | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/user/drbdmon/terminal/MDspTaskDetail.cpp b/user/drbdmon/terminal/MDspTaskDetail.cpp
+index bab08eae6775..edfcf981f7a2 100644
+--- a/user/drbdmon/terminal/MDspTaskDetail.cpp
++++ b/user/drbdmon/terminal/MDspTaskDetail.cpp
+@@ -260,10 +260,8 @@ void MDspTaskDetail::display_content()
+             uint32_t page_ctr = 1;
+             uint32_t page_line_ctr = first_page_lines;
+             format_text.restart();
+-            uint32_t skip_ctr = 0;
+             while (page_ctr < page_nr && format_text.skip_line())
+             {
+-                ++skip_ctr;
+                 ++page_line_ctr;
+                 if (page_line_ctr >= lines_per_page)
+                 {
+@@ -274,10 +272,8 @@ void MDspTaskDetail::display_content()
+ 
+             std::string line;
+             uint32_t line_ctr = page_nr == 1 ? line_offset : 0;
+-            uint32_t print_ctr = 0;
+             while (format_text.next_line(line, dsp_comp_hub.active_color_table->rst) && line_ctr < lines_per_page)
+             {
+-                ++print_ctr;
+                 dsp_comp_hub.dsp_io->cursor_xy(1, current_line);
+                 dsp_comp_hub.dsp_io->write_text(line.c_str());
+                 ++current_line;
+-- 
+2.50.1 (Apple Git-155)
+

drbd-utils.changes

@@ -1,3 +1,53 @@
+-------------------------------------------------------------------
+Tue Jan 27 04:52:30 UTC 2026 - Glass Su <glass.su@suse.com>
+
+- Package drbd-utils doesn't build with GCC 16 (bsc#1256961)
+  * Add patch
+    + bsc-1256961_drbdmon-remove-unused-variables-to-fix-gcc16-errors.patch
+
+-------------------------------------------------------------------
+Tue Jan 13 11:47:08 UTC 2026 - heming zhao <heming.zhao@suse.com>
+
+- drbd-selinux: change arch from x86_64 to noarch
+  * Update drbd-utils.spec:  add "BuildArch: noarch"
+
+-------------------------------------------------------------------
+Thu Nov 19 08:32:12 UTC 2025 - Zdenek Kubala <zkubala@suse.com>
+
+- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
+  to /etc/selinux (bsc#1221342)
+
+-------------------------------------------------------------------
+Tue Nov 18 08:43:39 UTC 2025 - Glass Su <glass.su@suse.com>
+
+- [SELinux] nfs_drbd: "fence-peer helper broken, returned 0" and nfs WRITE hang when power off the secondary node (bsc#1252991)
+  * Update and rename patch
+    - bsc-1233273_drbd.ocf-update-for-OCF-1.1.patch
+    + bsc-1233273-1252991_drbd.ocf-update-for-OCF-1.1.patch
+
+-------------------------------------------------------------------
+Fri Nov 14 11:10:58 UTC 2025 - Cathy Hu <cathy.hu@suse.com>
+
+- Allow domtrans from kernel_t to drbd_t (bsc#1252991)
+  * add patch
+    - 1252991-selinux-domtrans-from-kernel.patch
+
+-------------------------------------------------------------------
+Tue Aug 19 12:28:46 UTC 2025 - heming zhao <heming.zhao@suse.com>
+
+- drbd_passive didn't start due to drbd.rules returning error (bsc#1247534)
+  * update patch
+    - bsc-1247534_drbd-didnt-start-due-to-drbd_rules-returning-err.patch
+
+-------------------------------------------------------------------
+Fri Aug 15 07:12:00 UTC 2025 - Heming Zhao <heming.zhao@suse.com>
+
+- drbd_passive didn't start due to drbd.rules returning error (bsc#1247534)
+  * remove patch
+    - bsc-1239437_drbd.rules-fix-missing-udev-device.patch
+  * add patch
+    - bsc-1247534_drbd-didnt-start-due-to-drbd_rules-returning-err.patch
+
 -------------------------------------------------------------------
 Tue Jun 17 14:38:00 UTC 2025 - Heming Zhao <heming.zhao@suse.com>
 

drbd-utils.spec

@@ -1,7 +1,8 @@
 #
 # spec file for package drbd-utils
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -71,9 +72,11 @@ Patch1003:      bsc-1032142_Disable-quorum-in-default-configuration.patch
 Patch1004:      move_fencing_from_disk_to_net_in_example.patch
 Patch1005:      pie-fix.patch
 Patch1006:      bsc-1233273_drbd.ocf-replace-crm_master-with-ocf_promotion_score.patch
-Patch1007:      bsc-1233273_drbd.ocf-update-for-OCF-1.1.patch
+Patch1007:      bsc-1233273-1252991_drbd.ocf-update-for-OCF-1.1.patch
 Patch1008:      rpmlint-build-error.patch
-Patch1009:      bsc-1239437_drbd.rules-fix-missing-udev-device.patch
+Patch1009:      bsc-1247534_drbd-didnt-start-due-to-drbd_rules-returning-err.patch
+Patch1010:      1252991-selinux-domtrans-from-kernel.patch
+Patch1011:      bsc-1256961_drbdmon-remove-unused-variables-to-fix-gcc16-errors.patch
 #############################################
 
 Provides:       drbd-bash-completion = %{version}
@@ -169,6 +172,7 @@ rm -rf %{buildroot}%{libdir}/drbd/crm-*fence-peer.sh     # bsc#1204276
 
 %package -n drbd-selinux
 Summary:        SElinux policy for DRBD
+BuildArch:      noarch
 BuildRequires:  checkpolicy
 BuildRequires:  selinux-policy
 BuildRequires:  selinux-policy-%{selinuxtype}
@@ -182,7 +186,7 @@ drbd-selinux contains the SELinux policy meant to be used with this version of D
 
 %files -n drbd-selinux
 %attr(0644,root,root) %{_datadir}/selinux/packages/%{selinuxmodulename}.pp.bz2
-%ghost %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{selinuxmodulename}
+%ghost %{_selinux_store_path}/%{selinuxtype}/active/modules/200/%{selinuxmodulename}
 
 %pre -n drbd-selinux
 %selinux_relabel_pre -s %{selinuxtype}