diff --git a/container-selinux.spec b/container-selinux.spec index 98b000cc116b09b3874001faa793eee8faf65201..2ef86990849150611492393010a1f5ced33148b0 100644 --- a/container-selinux.spec +++ b/container-selinux.spec @@ -1,47 +1,38 @@ %define anolis_release 1 -%global debug_package %{nil} -# container-selinux stuff (prefix with ds_ for version/release etc.) -# Some bits borrowed from the openstack-selinux package -%global selinuxtype targeted -%global moduletype services -%global modulenames container +%global debug_package %{nil} +%global selinux_type targeted +%global module_names container -# Usage: _format var format -# Expand 'modulenames' into various formats as needed -# Format must contain '$x' somewhere to do anything useful -%global _format() export %1=""; for x in %{modulenames}; do %1+=%2; %1+=" "; done; +%global _format() export %1=""; for x in %{module_names}; do %1+=%2; %1+=" "; done; %global selinux_policyver 3.13.1-220 -# Hooked up to autobuilder, please check with @lsm5 before updating -Name: container-selinux -Epoch: 2 -Version: 2.201.0 +Name: container-selinux +Epoch: 2 +Version: 2.210.0 Release: %{anolis_release}%{dist} -License: GPLv2 -URL: https://github.com/containers/container-selinux Summary: SELinux policies for container runtimes +License: GPLv2 +URL: https://github.com/containers/container-selinux Source0: https://github.com/containers/container-selinux/archive/refs/tags/v%{version}.tar.gz BuildArch: noarch -BuildRequires: make -BuildRequires: git-core -BuildRequires: pkgconfig(systemd) + +BuildRequires: make pkgconfig(systemd) BuildRequires: selinux-policy >= %selinux_policyver BuildRequires: selinux-policy-devel >= %selinux_policyver + Requires: selinux-policy >= %selinux_policyver -Requires(post): selinux-policy-base >= %selinux_policyver -Requires(post): selinux-policy-targeted >= %selinux_policyver -Requires(post): policycoreutils -Requires(post): libselinux-utils -Requires(post): sed -Obsoletes: %{name} <= 2:1.12.5-13 -Obsoletes: docker-selinux <= 2:1.12.4-28 +Requires(post): policycoreutils sed selinux-policy-base >= %selinux_policyver +Requires(post): libselinux-utils selinux-policy-targeted >= %selinux_policyver + +Obsoletes: %{name} <= %{?epoch:%{epoch}:}1.12.5-13 +Obsoletes: docker-selinux <= %{?epoch:%{epoch}:}1.12.4-28 Provides: docker-selinux = %{?epoch:%{epoch}:}%{version}-%{release} Conflicts: udica < 0.2.6-1 Conflicts: k3s-selinux <= 0.4-1 %description -SELinux policy modules for use with container runtimes. +SELinux policy files for Container Runtimes %package doc Summary: Documentation files for %{name} @@ -51,65 +42,60 @@ Requires: %{name} = %{epoch}:%{version}-%{release} The %{name}-doc package contains documentation files for %{name}. %prep -%autosetup -Sgit -n %{name}-%{version} - -# this is a bug now, here is the issue: -# https://github.com/containers/container-selinux/issues/203 +%autosetup -n %{name}-%{version} -p1 sed -i '/user_namespace/d' container.te %build -make +%make_build %install # install policy modules %_format MODULES $x.pp.bz2 -install -d %{buildroot}%{_datadir}/selinux/packages -install -d -p %{buildroot}%{_datadir}/selinux/devel/include/services -install -p -m 644 container.if %{buildroot}%{_datadir}/selinux/devel/include/services +mkdir -p %{buildroot}%{_datadir}/selinux/packages install -m 0644 $MODULES %{buildroot}%{_datadir}/selinux/packages -install -d %{buildroot}/%{_datadir}/containers/selinux +mkdir -p %{buildroot}%{_datadir}/selinux/devel/include/services +install -p -m 644 container.if %{buildroot}%{_datadir}/selinux/devel/include/services +mkdir -p %{buildroot}/%{_datadir}/containers/selinux install -m 644 container_contexts %{buildroot}/%{_datadir}/containers/selinux/contexts -install -d %{buildroot}%{_datadir}/udica/templates +mkdir -p %{buildroot}%{_datadir}/udica/templates install -m 0644 udica-templates/*.cil %{buildroot}%{_datadir}/udica/templates %check %pre -%selinux_relabel_pre -s %{selinuxtype} +%selinux_relabel_pre -s %{selinux_type} %post -# Install all modules in a single transaction if [ $1 -eq 1 ]; then %{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1 fi %_format MODULES %{_datadir}/selinux/packages/$x.pp.bz2 -%{_sbindir}/semodule -n -s %{selinuxtype} -r container 2> /dev/null -%{_sbindir}/semodule -n -s %{selinuxtype} -d docker 2> /dev/null -%{_sbindir}/semodule -n -s %{selinuxtype} -d gear 2> /dev/null -%selinux_modules_install -s %{selinuxtype} $MODULES +for file in container docker gear; do + if [ $file == "container" ]; then + %{_sbindir}/semodule -n -s %{selinux_type} -r $file 2> /dev/null + else + %{_sbindir}/semodule -n -s %{selinux_type} -d $file 2> /dev/null + fi +done +%selinux_modules_install -s %{selinux_type} $MODULES . %{_sysconfdir}/selinux/config -sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/${SELINUXTYPE}/contexts/customizable_types +sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i /etc/selinux/%{selinux_type}/contexts/customizable_types matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedir}/containers &> /dev/null || : %postun if [ $1 -eq 0 ]; then - %selinux_modules_uninstall -s %{selinuxtype} %{modulenames} docker + %selinux_modules_uninstall -s %{selinux_type} %{module_names} docker fi %posttrans -%selinux_relabel_post -s %{selinuxtype} - -#define license tag if not already defined -%{!?_licensedir:%global license %doc} +%selinux_relabel_post -s %{selinux_type} %files -%{_datadir}/selinux/* %dir %{_datadir}/containers/selinux %{_datadir}/containers/selinux/contexts %dir %{_datadir}/udica/templates/ %{_datadir}/udica/templates/* -# Currently shipped in selinux-policy-doc -#%%{_datadir}/man/man8/container_selinux.8.gz +%{_datadir}/selinux/* %triggerpostun -- container-selinux < 2:2.162.1-3 if %{_sbindir}/selinuxenabled ; then @@ -118,9 +104,13 @@ if %{_sbindir}/selinuxenabled ; then fi %files doc -%doc README.md CODE-OF-CONDUCT.md SECURITY.md +%doc CODE-OF-CONDUCT.md README.md SECURITY.md %changelog +* Mon Apr 10 2023 yuanhui - 2.210.0-1 +- Optimize the spec file +- Update to v2.210.0 + * Tue Feb 28 2023 yuanhui - 2.201.0-1 - update to v2.201.0 diff --git a/v2.201.0.tar.gz b/v2.201.0.tar.gz deleted file mode 100644 index f5f94719e5bcdf26d4b82cbad656f5e91f5bf878..0000000000000000000000000000000000000000 Binary files a/v2.201.0.tar.gz and /dev/null differ diff --git a/v2.210.0.tar.gz b/v2.210.0.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..de6a5d493e29cabce46cc450e2fb50aed53b1128 Binary files /dev/null and b/v2.210.0.tar.gz differ