- Update to version 1699_20250120:

* profiles: whitelist nvidia-modprobe (bsc#1230950)

OBS-URL: https://build.opensuse.org/package/show/Base:System/permissions?expand=0&rev=353

.gitattributes

@@ -0,0 +1,23 @@
+## Default LFS
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.bsp filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.gem filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.jar filter=lfs diff=lfs merge=lfs -text
+*.lz filter=lfs diff=lfs merge=lfs -text
+*.lzma filter=lfs diff=lfs merge=lfs -text
+*.obscpio filter=lfs diff=lfs merge=lfs -text
+*.oxt filter=lfs diff=lfs merge=lfs -text
+*.pdf filter=lfs diff=lfs merge=lfs -text
+*.png filter=lfs diff=lfs merge=lfs -text
+*.rpm filter=lfs diff=lfs merge=lfs -text
+*.tbz filter=lfs diff=lfs merge=lfs -text
+*.tbz2 filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.ttf filter=lfs diff=lfs merge=lfs -text
+*.txz filter=lfs diff=lfs merge=lfs -text
+*.whl filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1 @@
+.osc

_service

@@ -0,0 +1,16 @@
+<services>
+  <service name="tar_scm" mode="manual">
+    <param name="url">https://github.com/openSUSE/permissions.git</param>
+    <param name="scm">git</param>
+    <param name="revision">master</param>
+    <param name="versionformat">1699_%cd</param>
+    <param name="changesgenerate">enable</param>
+  </service>
+  <service name="recompress" mode="manual">
+    <param name="file">*.tar</param>
+    <param name="compression">xz</param>
+  </service>
+  <service name="set_version" mode="manual">
+    <param name="regex">permissions-(.+_[0-9]+)</param>
+  </service>
+</services>

_servicedata

@@ -0,0 +1,4 @@
+<servicedata>
+<service name="tar_scm">
+            <param name="url">https://github.com/openSUSE/permissions.git</param>
+          <param name="changesrevision">cbba970c587889e1bcbf2e62fadb1387534f1df6</param></service></servicedata>

permissions-1699_20240522.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c7133fe91afc7d14e530a41a8ce6c9c303638e4b18b5ed331785e6362b4e2c3f
+size 55940

permissions-1699_20241029.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a6826bedd01d7ff7f3fbd8989dfdc64061bce360830f10a2fa89ac17cf810ed6
+size 56088

permissions-1699_20250120.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:84ff461cd998090d082b4705e2ede7422a5d3273b61f395b1a9887e50f49363c
+size 56088

permissions.rpmlintrc

@@ -0,0 +1,5 @@
+# the base package needs to have Arch, otherwise we get no -source and
+# -debuginfo package (which we need for the chkstat sub package)
+addFilter("no-binary")
+# it's hard not to repeat "permissions" in the summary
+addFilter("name-repeated-in-summary")

permissions.spec

@@ -0,0 +1,142 @@
+#
+# spec file for package permissions
+#
+# Copyright (c) 2025 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+
+Name:           permissions
+Version:        1699_20250120
+Release:        0
+Summary:        SUSE Linux Default Permissions
+# Maintained in github by the security team.
+License:        GPL-2.0-or-later
+Group:          Productivity/Security
+URL:            http://github.com/openSUSE/permissions
+Source:         permissions-%{version}.tar.xz
+Source2:        permissions.rpmlintrc
+BuildRequires:  gcc-c++
+BuildRequires:  libacl-devel
+BuildRequires:  libcap-devel
+BuildRequires:  libcap-progs
+BuildRequires:  meson
+BuildRequires:  python-rpm-macros
+BuildRequires:  tclap
+# test suite
+BuildRequires:  python3-base
+BuildRequires:  acl
+BuildRequires:  system-user-bin
+BuildRequires:  system-user-nobody
+Requires:       permctl
+Requires:       permissions-config
+Provides:       aaa_base:%{_datadir}/permissions
+
+%prep
+%autosetup
+
+%build
+%meson
+%meson_build
+
+%install
+%meson_install
+# Fix shebang in scripts: Remove dependency on /usr/bin/python3,
+# making scripts to depends on the real python3 binary, not the link.
+# (bsc#1212476)
+for f in %{buildroot}/usr/lib/zypp/plugins/commit/*
+do
+  [ -f $f ] && sed -i "1s@#\!.*python.*@#\!$(realpath %__python3)@" $f
+done
+
+%check
+# will fail on qemu with  unshare: unshare failed: Invalid argument
+#%%if !0%{?qemu_user_space_build}
+#%tests/regtest.py --skip-build %_vpath_builddir >/dev/null
+#%%endif
+
+%description
+File and directory permission settings depending on the local security
+settings. The local security setting ("easy", "secure", or "paranoid") can be
+configured in /etc/sysconfig/security.
+
+This package does not contain files, it just requires the necessary packages.
+
+%files
+
+%package config
+Summary:        SUSE Linux Default Permissions config files
+Group:          Productivity/Security
+Requires(post): %fillup_prereq
+Requires(post): permctl
+#!BuildIgnore:  group(trusted)
+Requires(pre):  group(trusted)
+Obsoletes:      permissions-doc <= %{version}
+BuildArch:      noarch
+
+%description config
+The actual permissions configuration files, /usr/share/permissions/permission.*.
+
+%files config
+%defattr(644, root, root, 755)
+%dir %{_datadir}/permissions
+%dir %{_datadir}/permissions/permissions.d
+%{_datadir}/permissions/permissions
+%{_datadir}/permissions/permissions.easy
+%{_datadir}/permissions/permissions.secure
+%{_datadir}/permissions/permissions.paranoid
+%{_datadir}/permissions/variables.conf
+%config(noreplace) %{_sysconfdir}/permissions.local
+%{_fillupdir}/sysconfig.security
+%{_mandir}/man5/permissions.5%{ext_man}
+
+%post config
+%{fillup_only -n security}
+# apply all potentially changed permissions
+%{_bindir}/permctl --system || :
+
+%package -n permctl
+Summary:        SUSE Linux Default Permissions tool
+Group:          Productivity/Security
+Provides:       chkstat = %version-%release
+Obsoletes:      chkstat < %version-%release
+
+%description -n permctl
+Tool to check and set file permissions.
+
+%files -n permctl
+%{_bindir}/chkstat
+%{_bindir}/permctl
+%{_mandir}/man8/permctl.8%{ext_man}
+%{_rpmconfigdir}/macros.d/macros.*
+
+%package -n permissions-zypp-plugin
+BuildArch:      noarch
+Requires:       permissions = %{version}
+Requires:       python3-zypp-plugin
+Requires:       libzypp(plugin:commit) = 1
+Summary:        A zypper commit plugin for calling permctl
+Group:          Productivity/Security
+
+%description -n permissions-zypp-plugin
+This package contains a plugin for zypper that calls `permctl --system` after
+new packages have been installed. This is helpful for maintaining custom
+entries in /etc/permissions.local.
+
+%files -n permissions-zypp-plugin
+%dir /usr/lib/zypp
+%dir /usr/lib/zypp/plugins
+%dir /usr/lib/zypp/plugins/commit
+/usr/lib/zypp/plugins/commit/permissions.py
+
+%changelog