Accepting request 1318602 from security

Update SELinux modules dir as macro to allow root path move

As discussed before we are going to move SELinux modules from /var/lib/selinux to /etc/selinux (bsc#1221342). This small change allows you to build your packages dynamically (not depending on selinux-package version) and us to change module directory macro in upcoming versions of selinux-policy package without interfering with other packages using custom SELinux modules. (forwarded request 1318594 from djz88)

OBS-URL: https://build.opensuse.org/request/show/1318602
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/tpm2.0-abrmd?expand=0&rev=31

tpm2.0-abrmd.changes

@@ -1,3 +1,23 @@
+-------------------------------------------------------------------
+Thu Nov 19 08:11:10 UTC 2025 - Zdenek Kubala <zkubala@suse.com>
+
+- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
+  to /etc/selinux (bsc#1221342)
+
+-------------------------------------------------------------------
+Tue Sep  9 09:16:27 UTC 2025 - Matthias Gerstner <matthias.gerstner@suse.com>
+
+- also package new /usr/share/selinux/devel/include/distributed directory to
+  fix build error.
+
+-------------------------------------------------------------------
+Mon Sep  8 13:32:00 UTC 2025 - Cathy Hu <cathy.hu@suse.com>
+
+- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
+  to /usr/share/selinux/devel/include/distributed/tabrmd.if
+  This is necessary to allow upstream drop-in interface replacements:
+  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if
+
 -------------------------------------------------------------------
 Wed Mar 26 11:06:46 UTC 2025 - Matthias Gerstner <matthias.gerstner@suse.com>
 

tpm2.0-abrmd.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package tpm2.0-abrmd
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2025 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -136,6 +136,8 @@ rm %{buildroot}/%{_datadir}/dbus-1/system-services/com.intel.tss2.Tabrmd.service
 %if %{with selinux}
 mkdir %{buildroot}%{_datadir}/selinux/packages/targeted
 mv %{buildroot}%{_datadir}/selinux/packages/tab* %{buildroot}%{_datadir}/selinux/packages/targeted
+install -p -m 644 -D %{buildroot}%{_datadir}/selinux/devel/include/contrib/tabrmd.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/tabrmd.if
+rm %{buildroot}%{_datadir}/selinux/devel/include/contrib/tabrmd.if
 %endif
 
 %pre
@@ -185,7 +187,7 @@ fi
 %if %{with selinux}
 %files selinux
 %{_datadir}/selinux/packages/targeted/tabrmd.pp.bz2
-%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
+%ghost %verify(not md5 size mtime) %{_selinux_store_path}/%{selinuxtype}/active/modules/200/%{modulename}
 %endif
 
 %files devel
@@ -194,7 +196,8 @@ fi
 %{_libdir}/pkgconfig/*.pc
 %{_mandir}/man3/Tss2*
 %if %{with selinux}
-%{_datadir}/selinux/devel/include/contrib/tabrmd.if
+%dir %{_datadir}/selinux/devel/include/distributed
+%{_datadir}/selinux/devel/include/distributed/tabrmd.if
 %endif
 
 %files -n libtss2-tcti-tabrmd0