[rpms/selinux-policy] rawhide: Backport PR #3396 to fix initial-setup on kmscon (rhbz#2484542)

[rpms/selinux-policy] rawhide: Backport PR #3396 to fix initial-setup on kmscon (rhbz#2484542)

[Adam Williamson]

A new commit has been pushed.

Repo   : rpms/selinux-policy
Branch : rawhide
Commit : b8be01b79d9a75d9317616f043febd69a638a2f6
Author : Adam Williamson <adamwill@fedoraproject.org>
Date   : 2026-09-02T14:24:27-07:00
Stats  : +56/-1 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/selinux-policy/c/b8be01b79d9a75d9317616f043febd69a638a2f6?branch=rawhide

Log:
Backport PR #3396 to fix initial-setup on kmscon (rhbz#2484542)

---
diff --git a/0001-Support-console-version-of-initial-setup.patch b/0001-Support-console-version-of-initial-setup.patch
new file mode 100644
index 0000000..f5f601a
--- /dev/null
+++ b/0001-Support-console-version-of-initial-setup.patch
@@ -0,0 +1,47 @@
+From 3b83c9107365b8484a37731d5da87ef29dc2787a Mon Sep 17 00:00:00 2001
+From: Zdenek Pytela <zpytela@redhat.com>
+Date: Tue, 1 Sep 2026 21:41:45 +0200
+Subject: [PATCH] Support console version of initial-setup
+
+kmscon spawns scripts in /usr/libexec/initial-setup, so:
+Label /usr/libexec/initial-setup with install_exec_t.
+Allow kmscon run install_t executables with a domain transition.
+
+Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2484542
+---
+ policy/modules/contrib/anaconda.fc | 2 ++
+ policy/modules/contrib/kmscon.te   | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/policy/modules/contrib/anaconda.fc b/policy/modules/contrib/anaconda.fc
+index 28d774a3c..17fd0dd57 100644
+--- a/policy/modules/contrib/anaconda.fc
++++ b/policy/modules/contrib/anaconda.fc
+@@ -7,7 +7,9 @@
+ /usr/bin/bootc          --  gen_context(system_u:object_r:install_exec_t,s0)
+ /usr/bin/ostree         --  gen_context(system_u:object_r:install_exec_t,s0)
+ /usr/bin/rpm-ostree     --  gen_context(system_u:object_r:install_exec_t,s0)
++
+ /usr/libexec/rpm-ostreed --  gen_context(system_u:object_r:install_exec_t,s0)
++/usr/libexec/initial-setup(/.*)?	-- system_u:object_r:install_exec_t:s0
+ 
+ /usr/bin/preupg.*   --  gen_context(system_u:object_r:preupgrade_exec_t,s0)
+ /var/lib/preupgrade(/.*)?   gen_context(system_u:object_r:preupgrade_data_t,s0)
+diff --git a/policy/modules/contrib/kmscon.te b/policy/modules/contrib/kmscon.te
+index 46bc0723a..b8f565d3e 100644
+--- a/policy/modules/contrib/kmscon.te
++++ b/policy/modules/contrib/kmscon.te
+@@ -74,6 +74,10 @@ miscfiles_manage_fonts_cache(kmscon_t)
+ # Open the tty, so that it can be handed over to the seat manager
+ term_use_unallocated_ttys(kmscon_t)
+ 
++optional_policy(`
++	anaconda_domtrans_install(kmscon_t)
++')
++
+ optional_policy(`
+     # Allow domtrans to agetty using --login
+     # see https://github.com/Aetf/kmscon/commit/21cf668c58867a100272adea6f323cd56fc73e78
+-- 
+2.55.0
+

diff --git a/changelog b/changelog
index 5b76321..40d9371 100644
--- a/changelog
+++ b/changelog
@@ -1,3 +1,6 @@
+* Wed Sep 02 2026 Adam Williamson <adamwill@fedoraproject.org> - 45.15-2
+- Backport PR #3396 to fix initial-setup on kmscon (rhbz#2484542)
+
 * Thu Aug 27 2026 Zdenek Pytela <zpytela@redhat.com> - 45.15-1
 - Fix NFS mount with xprtsec=tls / xprtsec=mtls (bsc#1275783)
 - Allow ssh_agent_type manage ssh_home_t files and sock_files

diff --git a/selinux-policy.spec b/selinux-policy.spec
index d4ca6cf..a23779f 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -20,7 +20,7 @@
 Summary: SELinux policy configuration
 Name: selinux-policy
 Version: 45.15
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL-2.0-or-later
 Source: %{giturl}/archive/%{commit}/%{name}-%{shortcommit}.tar.gz
 Source1: Makefile.devel
@@ -54,6 +54,11 @@ Source39: selinux-policy-mls.conf
 # Script to convert /usr/sbin file context entries to /usr/bin
 Source40: binsbin-convert.sh
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=2484542
+# https://github.com/fedora-selinux/selinux-policy/pull/3396
+# Fix denials for initial-setup on kmscon
+Patch: 0001-Support-console-version-of-initial-setup.patch
+
 # add_changelog
 %{load:%{SOURCE7}}