[rpms/swtpm] rawhide: Add patch to resolve SELinux policy build issue

[rpms/swtpm] rawhide: Add patch to resolve SELinux policy build issue

[Stefan Berger]

A new commit has been pushed.

Repo   : rpms/swtpm
Branch : rawhide
Commit : 9fc8bec6ce8ed7304f46ab4a6bf2b47d708b9324
Author : Stefan Berger <stefanb@linux.vnet.ibm.com>
Date   : 2026-08-04T17:52:36-04:00
Stats  : +43/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/swtpm/c/9fc8bec6ce8ed7304f46ab4a6bf2b47d708b9324?branch=rawhide

Log:
Add patch to resolve SELinux policy build issue

---
diff --git a/db2386b2c1530de3a7fa57a8214c3630e785ec2f.patch b/db2386b2c1530de3a7fa57a8214c3630e785ec2f.patch
new file mode 100644
index 0000000..8a39bdb
--- /dev/null
+++ b/db2386b2c1530de3a7fa57a8214c3630e785ec2f.patch
@@ -0,0 +1,37 @@
+From db2386b2c1530de3a7fa57a8214c3630e785ec2f Mon Sep 17 00:00:00 2001
+From: Cathy Hu <cathy.hu@suse.com>
+Date: Wed, 15 Jul 2026 12:17:50 +0200
+Subject: [PATCH] Fix policy loading with 3.11 SElinux toolchain (bsc#1271417)
+
+This is not needed and causes issues with policy loading
+due to this fix in the 3.11 SELinux toolchain:
+https://github.com/SELinuxProject/selinux/commit/81fae2f376f6c4f9928ce29264e534b841e975f5
+
+The virt_use_nfs is created with "gen_tunable":
+https://github.com/fedora-selinux/selinux-policy/blob/c905bb439845daff1ff442650b3225ad84ee724a/policy/modules/contrib/virt.te#L69
+
+"tunable_policy" is a bool in fedora and openSUSE:
+https://github.com/fedora-selinux/selinux-policy/blob/c905bb439845daff1ff442650b3225ad84ee724a/policy/support/loadable_module.spt#L129
+
+Adding "tunable virt_use_nfs;" makes it a tunable, not a bool.
+
+Signed-off-by: Cathy Hu <cathy.hu@suse.com>
+---
+ src/selinux/swtpm.te | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/src/selinux/swtpm.te b/src/selinux/swtpm.te
+index d53aad09..9fab8f0c 100644
+--- a/src/selinux/swtpm.te
++++ b/src/selinux/swtpm.te
+@@ -14,7 +14,6 @@ require {
+ 	type virtqemud_t;
+ 	type virtqemud_tmp_t;
+ 	class file map;
+-	tunable virt_use_nfs;
+ }
+ 
+ attribute_role swtpm_roles;
+-- 
+2.55.0
+

diff --git a/swtpm.spec b/swtpm.spec
index 3afb021..993eee6 100644
--- a/swtpm.spec
+++ b/swtpm.spec
@@ -8,12 +8,14 @@
 Summary: TPM Emulator
 Name:           swtpm
 Version:        0.10.1
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        BSD-3-Clause
 Url:            https://github.com/stefanberger/swtpm
 Source0:        https://github.com/stefanberger/swtpm/archive/v%{version}/%{name}-%{version}.tar.gz
 # tests: Retry NVWrite command after 0x922 return code and inc lockout counter
 Patch0:         https://github.com/stefanberger/swtpm/commit/4da66c66f92438443e66b67555673c9cb898b0ae.patch
+# Fix policy loading with 3.11 SElinux toolchain (bsc#1271417)
+Patch1:         https://github.com/stefanberger/swtpm/commit/db2386b2c1530de3a7fa57a8214c3630e785ec2f.patch
 
 BuildRequires: make
 BuildRequires:  git-core
@@ -203,6 +205,9 @@ fi
 %{_libexecdir}/installed-tests/swtpm/
 
 %changelog
+* Tue Aug  4 2026 Stefan Berger <stefanb@linux.ibm.com> - 0.10.1-6
+- Applied patch to resolve SELinux policy build issue
+
 * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 0.10.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild