[rpms/selinux-policy] f44: Remove deprecated checkreqprot tmpfiles write

[rpms/selinux-policy] f44: Remove deprecated checkreqprot tmpfiles write

[Rachel Menge]

            A new commit has been pushed.

            Repo   : rpms/selinux-policy
            Branch : f44
            Commit : 87b3351d9b830865f5317187cdb3c66c44604a02
            Author : Rachel Menge <rlmenge@gmail.com>
            Date   : 2026-06-05T18:24:28+02:00
            Stats  : +4/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/selinux-policy/c/87b3351d9b830865f5317187cdb3c66c44604a02?branch=f44

            Log:
            Remove deprecated checkreqprot tmpfiles write

Remove the tmpfiles entry that writes to
/sys/fs/selinux/checkreqprot during boot.

checkreqprot was a legacy SELinux compatibility knob controlling how
mmap and mprotect permission checks handled requested protections
versus kernel-applied protections. Linux commit a7e4676e8e2c
("selinux: remove the 'checkreqprot' functionality") removed support
for changing the value.

A newer Linux commit, 644132a48f4e ("selinux: prune
/sys/fs/selinux/checkreqprot"), keeps userspace writes successful but
emits an error-level diagnostic once when the deprecated interface is
written. This causes a boot-time dmesg error from systemd-tmpfiles.

Remove the tmpfiles write so Fedora no longer touches the deprecated
interface at boot.

Signed-off-by: Rachel Menge <rlmenge@gmail.com>

---
diff --git a/changelog b/changelog
index 5832bdf..e5e3a46 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,6 @@
+* Wed May 20 2026 Rachel Menge <rlmenge@gmail.com> - 44.1-2
+- Remove deprecated checkreqprot tmpfiles write in selinux-policy.conf
+
 * Tue Apr 28 2026 Zdenek Pytela <zpytela@redhat.com> - 44.1-1
 - Allow init nnp domain transition do dirsrv_t and dirsrv_snmp_t
 - Allow accounts-daemon read accountsd_share_t symlinks

diff --git a/selinux-policy.conf b/selinux-policy.conf
index f2f1ced..eb98593 100644
--- a/selinux-policy.conf
+++ b/selinux-policy.conf
@@ -1,4 +1,3 @@
 z /sys/devices/system/cpu/online - - -
 Z /sys/class/net - - -
 z /sys/kernel/uevent_helper - - -
-w /sys/fs/selinux/checkreqprot - - - - 0

diff --git a/selinux-policy.spec b/selinux-policy.spec
index efe8396..e0898f7 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 44.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
 Source1: Makefile.devel