public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Vit Mojzis <vmojzis@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/selinux-policy] f44: Rebuild policy before running {binsbin|varrun}-convert.sh
Date: Fri, 12 Jun 2026 19:10:18 GMT [thread overview]
Message-ID: <178129141804.1.8934231721936412820.rpms-selinux-policy-ca9ffc1af2b2@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : rpms/selinux-policy
Branch : f44
Commit : ca9ffc1af2b2eed4dd2dc7d7457511ad6cea2124
Author : Vit Mojzis <vmojzis@redhat.com>
Date : 2026-06-05T21:25:47+02:00
Stats : +4/-3 in 1 file(s)
URL : https://src.fedoraproject.org/rpms/selinux-policy/c/ca9ffc1af2b2eed4dd2dc7d7457511ad6cea2124?branch=f44
Log:
Rebuild policy before running {binsbin|varrun}-convert.sh
Both {binsbin|varrun}-convert.sh scripts use
/etc/selinux/<policytype>/contexts/files/file_contexts file, which is
updated during policy rebuild. Therefore the policy needs to be rebuilt
before the scripts are executed in order for
%remove{Binsbin|VarRun}ModuleLua to take effect.
Without the policy rebuild, both extra_{binsbin|varrun} modules get
removed on each selinux-policy-targeted update, since
%remove{Binsbin|VarRun}ModuleLua removes the module file, but there is
no change to /contexts/files/file_contexts and
{binsbin|varrun}-convert.sh result in noop (no module installation).
Also, fix labels of both /var/run and /usr/sbin since %relabel is
executed before the -convert scripts.
Fixes:
Grafana running as unconfined service after selinux-policy update.
$ sudo dnf install grafana
$ sudo dnf reinstall selinux-policy-targeted
$ sudo systemctl start grafana-server
$ ps -efZ | grep grafana-server
system_u:system_r:unconfined_service_t:s0 grafana ...
---
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 0971366..5775a64 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -587,11 +587,11 @@ exit 0
%posttrans targeted
%checkConfigConsistency targeted
+%postInstall $1 targeted
%{_libexecdir}/selinux/varrun-convert.sh targeted
%{_libexecdir}/selinux/binsbin-convert.sh targeted
-%postInstall $1 targeted
restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm /etc/mdevctl.d
-restorecon -i /usr/sbin/fapolicyd* /usr/sbin/usbguard*
+restorecon -Ri /usr/sbin /var/run
%postun targeted
if [ $1 = 0 ]; then
@@ -773,10 +773,11 @@ exit 0
%posttrans mls
%checkConfigConsistency mls
+%postInstall $1 mls
%{_libexecdir}/selinux/varrun-convert.sh mls
%{_libexecdir}/selinux/binsbin-convert.sh mls
-%postInstall $1 mls
restorecon -Ri /usr/lib/sysimage/rpm /var/lib/rpm
+restorecon -Ri /usr/sbin /var/run
%postun mls
if [ $1 = 0 ]; then
reply other threads:[~2026-06-12 19:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178129141804.1.8934231721936412820.rpms-selinux-policy-ca9ffc1af2b2@fedoraproject.org \
--to=vmojzis@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox