Accepting request 1186819 from security:SELinux

container-selinux update

OBS-URL: https://build.opensuse.org/request/show/1186819
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/container-selinux?expand=0&rev=21

_service

@@ -0,0 +1,21 @@
+<services>
+  <service name="tar_scm" mode="manual">
+    <param name="version">_auto_</param>
+    <param name="versionformat">@PARENT_TAG@</param>
+    <param name="url">https://github.com/containers/container-selinux.git</param>
+    <param name="scm">git</param>
+    <param name="changesgenerate">enable</param>
+    <param name="match-tag">v*</param>
+    <param name="revision">main</param>
+    <param name="versionrewrite-pattern">v(.*)</param>
+    <param name="versionrewrite-replacement">\1</param>
+  </service>
+  <service name="recompress" mode="manual">
+    <param name="compression">xz</param>
+    <param name="file">*.tar</param>
+  </service>
+  <service name="set_version" mode="manual" >
+    <param name="file">container-selinux.spec</param>
+  </service>
+</services>
+

_servicedata

@@ -0,0 +1,4 @@
+<servicedata>
+<service name="tar_scm">
+                <param name="url">https://github.com/containers/container-selinux.git</param>
+              <param name="changesrevision">a68865582e123856c191fe0ecbbba9301758e591</param></service></servicedata>

container-selinux-2.232.1.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:1acd56a634e738cfa61f469564850942c261529e4bf3557ef9723067bd536757
+size 28860

container-selinux.changes

@@ -1,3 +1,44 @@
+-------------------------------------------------------------------
+Wed Jul 10 07:52:16 UTC 2024 - cathy.hu@suse.com
+
+- Update to version 2.232.1:
+  * Bump to v2.232.1
+  * TMT: fix srpm download syntax on rawhide
+  * Bump to 2.232.0
+  * Packit: remove `update_release` key from downstream jobs (#313)
+  * Update container-selinux.8 man page
+  * Add ownership of /usr/share/udica (#312)
+  * Packit/TMT: upstream maintenance of downstream gating tests
+  * extend container_engine_t again
+  * Allow spc_t to use localectl
+  * Allow spc_t to use timedatectl
+  * introduce container_use_xserver_devices boolean to allow GPU access
+
+-------------------------------------------------------------------
+Mon May 06 07:36:02 UTC 2024 - jsegitz@suse.com
+
+- Update to version 2.231.0:
+  * Allow container domains to communicate with spc_t unix_stream_sockets
+  * Move to %posttrans to ensure selinux-policy got updated before
+    the commands run (bsc#1221720)
+
+-------------------------------------------------------------------
+Wed Apr 10 15:47:15 UTC 2024 - Cathy Hu <cathy.hu@suse.com>
+
+- Manual update to version 2.230.0+git4.a8e389d to include this 
+  commit that is needed for the main selinux-policy update to work:
+  * Rename all /var/run file context entries to /run
+
+-------------------------------------------------------------------
+Wed Apr 10 15:38:24 UTC 2024 - Cathy Hu <cathy.hu@suse.com>
+
+- Update to version 2.230.0:
+  * Move to tar_scm based packaging: added _service and _servicedata
+  * Allow containers to unmount file systems
+  * Add buildah as a container_runtime_exec_t label
+  * Additional rules for container_user_t
+  * improve container_engine_t
+
 -------------------------------------------------------------------
 Thu Jan 11 08:37:53 UTC 2024 - Johannes Segitz <jsegitz@suse.com>
 

container-selinux.spec

@@ -26,20 +26,20 @@
 # Version of SELinux we were using
 %define selinux_policyver %(rpm -q selinux-policy --qf '%%{version}')
 Name:           container-selinux
-Version:        2.228.0
+Version:        2.232.1
 Release:        0
 Summary:        SELinux policies for container runtimes
 License:        GPL-2.0-only
 URL:            https://github.com/containers/container-selinux
-Source0:        https://github.com/containers/container-selinux/archive/refs/tags/v%{version}.tar.gz
+Source0:        container-selinux-%{version}.tar.xz
 BuildRequires:  selinux-policy
 BuildRequires:  selinux-policy-devel
 Requires:       selinux-policy >= %(rpm -q selinux-policy --qf '%%{version}-%%{release}')
-Requires(post): policycoreutils
+Requires(posttrans): policycoreutils
-Requires(post): /usr/bin/sed
+Requires(posttrans): /usr/bin/sed
-Requires(post): selinux-policy-base >= %{selinux_policyver}
+Requires(posttrans): selinux-policy-base >= %{selinux_policyver}
-Requires(post): selinux-policy-targeted >= %{selinux_policyver}
+Requires(posttrans): selinux-policy-targeted >= %{selinux_policyver}
-Requires(post): selinux-tools
+Requires(posttrans): selinux-tools
 BuildArch:      noarch
 
 %description
@@ -68,7 +68,12 @@ install -m 0644 udica-templates/*.cil %{buildroot}%{_datadir}/udica/templates
 %pre
 %selinux_relabel_pre -s %{selinuxtype}
 
-%post
+%postun
+if [ $1 -eq 0 ]; then
+   %selinux_modules_uninstall -s %{selinuxtype} %{modulenames} docker
+fi
+
+%posttrans
 # Install all modules in a single transaction
 if [ $1 -eq 1 ]; then
    %{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
@@ -81,13 +86,6 @@ fi
 . %{_sysconfdir}/selinux/config
 sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/customizable_types
 matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedir}/containers &> /dev/null || :
-
-%postun
-if [ $1 -eq 0 ]; then
-   %selinux_modules_uninstall -s %{selinuxtype} %{modulenames} docker
-fi
-
-%posttrans
 %selinux_relabel_post -s %{selinuxtype}
 
 %files

v2.228.0.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:4ae7825a8460460934950f6b2a4a0928bc2f71915e71474d6d5d20c8eeb9bbdd
-size 31145