[rpms/selinux-policy] rawhide: Remove deprecated checkreqprot tmpfiles write

[rpms/selinux-policy] rawhide: Remove deprecated checkreqprot tmpfiles write

[Rachel Menge]

            A new commit has been pushed.

            Repo   : rpms/selinux-policy
            Branch : rawhide
            Commit : b2494a23fd849a16d9ff613b2627c7d3cc1a377f
            Author : Rachel Menge <rlmenge@gmail.com>
            Date   : 2026-05-20T22:37:24+00:00
            Stats  : +4/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/selinux-policy/c/b2494a23fd849a16d9ff613b2627c7d3cc1a377f?branch=rawhide

            Log:
            Remove deprecated checkreqprot tmpfiles write

Remove the tmpfiles entry that writes to
/sys/fs/selinux/checkreqprot during boot.

checkreqprot was a legacy SELinux compatibility knob controlling how
mmap and mprotect permission checks handled requested protections
versus kernel-applied protections. Linux commit a7e4676e8e2c
("selinux: remove the 'checkreqprot' functionality") removed support
for changing the value.

A newer Linux commit, 644132a48f4e ("selinux: prune
/sys/fs/selinux/checkreqprot"), keeps userspace writes successful but
emits an error-level diagnostic once when the deprecated interface is
written. This causes a boot-time dmesg error from systemd-tmpfiles.

Remove the tmpfiles write so Fedora no longer touches the deprecated
interface at boot.

Signed-off-by: Rachel Menge <rlmenge@gmail.com>

---
diff --git a/changelog b/changelog
index e55e244..dac8aa1 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,6 @@
+* Wed May 20 2026 Rachel Menge <rlmenge@gmail.com> - 45.3-2
+- Remove deprecated checkreqprot tmpfiles write in selinux-policy.conf
+
 * Mon May 18 2026 Zdenek Pytela <zpytela@redhat.com> - 45.3-1
 - Allow sys_resource on execution of generic executables conditionally
 - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t

diff --git a/selinux-policy.conf b/selinux-policy.conf
index f2f1ced..eb98593 100644
--- a/selinux-policy.conf
+++ b/selinux-policy.conf
@@ -1,4 +1,3 @@
 z /sys/devices/system/cpu/online - - -
 Z /sys/class/net - - -
 z /sys/kernel/uevent_helper - - -
-w /sys/fs/selinux/checkreqprot - - - - 0

diff --git a/selinux-policy.spec b/selinux-policy.spec
index 65e9c3a..ddba5e4 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 45.3
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
 Source1: Makefile.devel