diff --git a/fedora-policy-20210223.tar.bz2 b/fedora-policy-20210223.tar.bz2 new file mode 100644 index 0000000..d7b2014 --- /dev/null +++ b/fedora-policy-20210223.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:516f56e5a18c26d521edd8046ce05f9b7ce4fc3a3fcd365613fead98355ed70d +size 720664 diff --git a/fedora-policy.20210111.tar.bz2 b/fedora-policy.20210111.tar.bz2 deleted file mode 100644 index 3c7fc75..0000000 --- a/fedora-policy.20210111.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:6b79293eb39ccccb68464902cae1a2665522dee82c70323d58e78fca05a1ee8b -size 717105 diff --git a/fix_init.patch b/fix_init.patch index ffbff36..f5e5d71 100644 --- a/fix_init.patch +++ b/fix_init.patch @@ -1,8 +1,16 @@ -Index: fedora-policy/policy/modules/system/init.te -=================================================================== ---- fedora-policy.orig/policy/modules/system/init.te -+++ fedora-policy/policy/modules/system/init.te -@@ -257,6 +257,7 @@ corecmd_exec_bin(init_t) +--- fedora-policy/policy/modules/system/init.if 2021-02-23 14:51:08.683163653 +0100 ++++ fedora-policy/policy/modules/system/init.if 2021-02-23 15:04:46.397087937 +0100 +@@ -3242,6 +3242,7 @@ + files_etc_filetrans($1, machineid_t, file, "machine-id" ) + files_pid_filetrans($1, initctl_t, fifo_file, "fifo" ) + init_pid_filetrans($1, systemd_unit_file_t, dir, "generator") ++ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late") + init_pid_filetrans($1, systemd_unit_file_t, dir, "system") + ') + +--- fedora-policy/policy/modules/system/init.te 2021-02-23 14:51:08.683163653 +0100 ++++ fedora-policy/policy/modules/system/init.te 2021-02-23 15:06:10.293290652 +0100 +@@ -262,6 +262,7 @@ corenet_all_recvfrom_netlabel(init_t) corenet_tcp_bind_all_ports(init_t) corenet_udp_bind_all_ports(init_t) @@ -10,7 +18,7 @@ Index: fedora-policy/policy/modules/system/init.te dev_create_all_files(init_t) dev_create_all_chr_files(init_t) -@@ -378,6 +379,7 @@ logging_manage_audit_config(init_t) +@@ -388,6 +389,7 @@ logging_create_syslog_netlink_audit_socket(init_t) logging_write_var_log_dirs(init_t) logging_manage_var_log_symlinks(init_t) @@ -18,23 +26,24 @@ Index: fedora-policy/policy/modules/system/init.te seutil_read_config(init_t) seutil_read_login_config(init_t) -@@ -427,10 +429,15 @@ ifdef(`distro_redhat',` +@@ -437,11 +439,16 @@ corecmd_shell_domtrans(init_t, initrc_t) storage_raw_rw_fixed_disk(init_t) +storage_raw_read_removable_device(init_t) sysnet_read_dhcpc_state(init_t) + sysnet_watch_config(init_t) optional_policy(` -+ networkmanager_initrc_read_lnk_files(init_t) ++ networkmanager_initrc_read_lnk_files(init_t) +') + +optional_policy(` bootloader_domtrans(init_t) ') -@@ -544,7 +551,7 @@ tunable_policy(`init_create_dirs',` +@@ -555,10 +562,10 @@ allow init_t self:system all_system_perms; allow init_t self:system module_load; allow init_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -42,8 +51,12 @@ Index: fedora-policy/policy/modules/system/init.te +allow init_t self:process { setkeycreate setsockcreate setfscreate setrlimit setexec execmem }; allow init_t self:process { getcap setcap }; allow init_t self:unix_stream_socket { create_stream_socket_perms connectto recvfrom }; - allow init_t self:netlink_kobject_uevent_socket create_socket_perms; -@@ -606,6 +613,7 @@ files_delete_all_spool_sockets(init_t) +-allow init_t self:netlink_kobject_uevent_socket create_socket_perms; ++allow init_t self:netlink_kobject_uevent_socket create_socket_perms; + allow init_t self:netlink_selinux_socket create_socket_perms; + allow init_t self:unix_dgram_socket lock; + # Until systemd is fixed +@@ -616,6 +623,7 @@ files_create_var_lib_dirs(init_t) files_create_var_lib_symlinks(init_t) files_read_var_lib_symlinks(init_t) @@ -51,7 +64,16 @@ Index: fedora-policy/policy/modules/system/init.te files_manage_urandom_seed(init_t) files_list_locks(init_t) files_list_spool(init_t) -@@ -698,6 +706,7 @@ systemd_write_inherited_logind_sessions_ +@@ -652,7 +660,7 @@ + fs_list_auto_mountpoints(init_t) + fs_register_binary_executable_type(init_t) + fs_relabel_tmpfs_sock_file(init_t) +-fs_rw_tmpfs_files(init_t) ++fs_rw_tmpfs_files(init_t) + fs_relabel_cgroup_dirs(init_t) + fs_search_cgroup_dirs(init_t) + # for network namespaces +@@ -708,6 +716,7 @@ create_sock_files_pattern(init_t, init_sock_file_type, init_sock_file_type) create_dirs_pattern(init_t, var_log_t, var_log_t) @@ -59,7 +81,7 @@ Index: fedora-policy/policy/modules/system/init.te auth_use_nsswitch(init_t) auth_rw_login_records(init_t) -@@ -1543,6 +1552,8 @@ optional_policy(` +@@ -1561,6 +1570,8 @@ optional_policy(` postfix_list_spool(initrc_t) @@ -68,15 +90,3 @@ Index: fedora-policy/policy/modules/system/init.te ') optional_policy(` -Index: fedora-policy/policy/modules/system/init.if -=================================================================== ---- fedora-policy.orig/policy/modules/system/init.if -+++ fedora-policy/policy/modules/system/init.if -@@ -3205,6 +3205,7 @@ interface(`init_filetrans_named_content' - files_etc_filetrans($1, machineid_t, file, "machine-id" ) - files_pid_filetrans($1, initctl_t, fifo_file, "fifo" ) - init_pid_filetrans($1, systemd_unit_file_t, dir, "generator") -+ init_pid_filetrans($1, systemd_unit_file_t, dir, "generator.late") - init_pid_filetrans($1, systemd_unit_file_t, dir, "system") - ') - diff --git a/selinux-policy.changes b/selinux-policy.changes index e2f5648..657ce88 100644 --- a/selinux-policy.changes +++ b/selinux-policy.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Tue Feb 23 13:53:40 UTC 2021 - Thorsten Kukuk + +- Update to version 20210223 +- Change name of tar file to a more common schema to allow + parallel installation of several source versions +- Adjust fix_init.patch + ------------------------------------------------------------------- Mon Jan 11 09:29:18 UTC 2021 - Thorsten Kukuk diff --git a/selinux-policy.spec b/selinux-policy.spec index 71d3648..24f141a 100644 --- a/selinux-policy.spec +++ b/selinux-policy.spec @@ -33,9 +33,9 @@ Summary: SELinux policy configuration License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20210111 +Version: 20210223 Release: 0 -Source: fedora-policy.%{version}.tar.bz2 +Source: fedora-policy-%{version}.tar.bz2 Source1: selinux-policy-rpmlintrc Source10: modules-targeted-base.conf @@ -384,7 +384,7 @@ fi; exit 0 %prep -%setup -n fedora-policy +%setup -n fedora-policy-%{version} %patch001 -p1 %patch002 -p1 %patch003 -p1 diff --git a/update.sh b/update.sh index 7af332b..a2790b1 100644 --- a/update.sh +++ b/update.sh @@ -9,14 +9,14 @@ rm -rf fedora-policy container-selinux git clone --depth 1 https://github.com/fedora-selinux/selinux-policy.git git clone --depth 1 https://github.com/containers/container-selinux.git -mv selinux-policy fedora-policy -rm -rf fedora-policy/.git* -mv container-selinux/container.* fedora-policy/policy/modules/contrib/ +mv selinux-policy fedora-policy-$date +rm -rf fedora-policy-$date/.git* +mv container-selinux/container.* fedora-policy-$date/policy/modules/contrib/ -rm -f fedora-policy.$date.tar* -tar cf fedora-policy.$date.tar fedora-policy -bzip2 fedora-policy.$date.tar -rm -rf fedora-policy container-selinux +rm -f fedora-policy?$date.tar* +tar cf fedora-policy-$date.tar fedora-policy-$date +bzip2 fedora-policy-$date.tar +rm -rf fedora-policy-$date container-selinux sed -i -e "s/^Version:.*/Version: $date/" selinux-policy.spec