Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package selinux-policy for openSUSE:Factory checked in at 2026-06-25 10:50:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old) and /work/SRC/openSUSE:Factory/.selinux-policy.new.2088 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy" Thu Jun 25 10:50:07 2026 rev:164 rq:1361460 version:20260618 Changes: -------- --- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes 2026-06-19 17:22:49.881078348 +0200 +++ /work/SRC/openSUSE:Factory/.selinux-policy.new.2088/selinux-policy.changes 2026-06-25 10:52:12.130981936 +0200 @@ -1,0 +2,20 @@ +Tue Jun 23 06:55:58 UTC 2026 - Zdenek Kubala <[email protected]> + +- fixed text output during package instalation (bnc#1268009) +- enhance migration marker cleanup in /etc/selinux to properly + delete markers when removing selinux-policy-FLAVOUR package + +------------------------------------------------------------------- +Fri Jun 19 07:22:48 UTC 2026 - Jan Engelhardt <[email protected]> + +- Mark all bash-using sections as requiring bash +- Delete old %defattr, it's the default now anyway +- Reduce %if BUILD_xxx to span just %files and triggers, + that's all it needs + +------------------------------------------------------------------- +Thu Jun 19 07:11:40 UTC 2026 - Enrico Belleri <[email protected]> + +- Fix syntax in scriptlets + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ selinux-policy.spec ++++++ --- /var/tmp/diff_new_pack.V6wrZt/_old 2026-06-25 10:52:13.883042612 +0200 +++ /var/tmp/diff_new_pack.V6wrZt/_new 2026-06-25 10:52:13.887042750 +0200 @@ -1,7 +1,7 @@ # # spec file for package selinux-policy # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -16,6 +16,7 @@ # +%define _buildshell /bin/bash # There are almost no SUSE specific modifications available in the policy, so we utilize the # ones used by redhat and include also the SUSE specific ones (distro_suse_to_distro_redhat.patch) %define distro redhat @@ -122,8 +123,8 @@ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install \ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} install-appconfig \ make %common_params UNK_PERMS=%3 NAME=%1 TYPE=%2 DESTDIR=%{buildroot} SEMODULE="%{_sbindir}/semodule -p %{buildroot} -X 100 " load \ -%{__mkdir} -p %{buildroot}%{_sysconfdir}/selinux/%1/logins \ -%{__mkdir} -p %{buildroot}%{_sysconfdir}/selinux/%1/active/modules/{1,2,4}00 \ +mkdir -p %{buildroot}%{_sysconfdir}/selinux/%1/logins \ +mkdir -p %{buildroot}%{_sysconfdir}/selinux/%1/active/modules/{1,2,4}00 \ touch %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files/file_contexts.subs \ install -m0644 ./config/file_contexts.subs_dist %{buildroot}%{_sysconfdir}/selinux/%1/contexts/files \ install -m0644 ./dist/%1/setrans.conf %{buildroot}%{_sysconfdir}/selinux/%1/setrans.conf \ @@ -140,7 +141,6 @@ %nil %define fileList() \ -%defattr(-,root,root) \ %dir %{_sysconfdir}/selinux/%1 \ %config(noreplace) %{_sysconfdir}/selinux/%1/setrans.conf \ %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/selinux/%1/seusers \ @@ -222,11 +222,12 @@ fi; %define preMigration() \ +# [This fragment needs bash.] \ # PED-12492 (bsc#1221342): Snapper rollbacks can cause snapshots to still require the old /var/lib/selinux location. \ # This part checks the state of the system and creates marker files for the rest of the migration. \ # If necessary, it will create a backup of /var/lib/selinux. \ previous_selinux_modules_dir="/var/lib/selinux"; \ -if [ %1 -ne 1 ] || [[ "$(ls -A ${previous_selinux_modules_dir} 2>/dev/null)" ]]; then \ +if [ %1 -ne 1 ] || [[ "$(ls -A ${previous_selinux_modules_dir} 2>/dev/null)" ]] || [ -f %{_sysconfdir}/selinux/var_lib_selinux_deleted ]; then \ check_tmpfiles=(%{_sysconfdir}/selinux/{temp_selinux_modules_dir_created,selinux_modules_migrated-%2,var_lib_selinux_deleted}); \ check_btrfs_snapshot_etc=0; \ is_btrfs=0; \ @@ -242,8 +243,8 @@ elif [ -f "${check_tmpfiles[1]}" ]; then \ echo "--- If your system has non-snapshotted subvolume \\`/etc\\`, you need to reinstall selinux-policy packages after rollback."; \ elif [ -f "${check_tmpfiles[2]}" ]; then \ - echo "--- INFO: SELinux policy modules are stored in \\`/etc/selinux\\`. ---"; \ - echo "--- and \\`/var/lib/selinux\\` removed. No interaction needed. ---"; \ + echo "--- INFO: SELinux policy modules are stored in \\`/etc/selinux\\`; ---"; \ + echo "--- \\`/var/lib/selinux\\` removed. No action required. ---"; \ fi; \ fi; \ else \ @@ -252,8 +253,8 @@ echo "--- Migration will continue but in case of selinux-policy downgrade - manual intervention might be needed. ---"; \ echo "--- \\`/var/lib/selinux\\` will be deleted one month after migration ---"; \ elif [ -f "${check_tmpfiles[2]}" ]; then \ - echo "--- INFO: SELinux policy modules are stored in \\`/etc/selinux\\`. ---"; \ - echo "--- and \\`/var/lib/selinux\\` removed. No interaction needed. ---"; \ + echo "--- INFO: SELinux policy modules are stored in \\`/etc/selinux\\`; ---"; \ + echo "--- \\`/var/lib/selinux\\` removed. No action required. ---"; \ fi ; \ fi; \ #------\ @@ -290,8 +291,8 @@ echo "--- \\`/var/lib/selinux\\` will be automaticaly DELETED once there are no snapshots with old path. ---"; \ fi; \ if [ -f "${check_tmpfiles[2]}" ]; then \ - echo "INFO: SELinux policy modules are stored in \\`/etc/selinux\\`."; \ - echo " and \\`/var/lib/selinux\\` removed. No interaction needed."; \ + echo "INFO: SELinux policy modules are stored in \\`/etc/selinux\\`;"; \ + echo " \\`/var/lib/selinux\\` removed. No action required."; \ fi; \ fi; \ else \ @@ -305,6 +306,7 @@ %nil %define postMigration() \ +# [This fragment needs bash.] \ # PED-12492 (bsc#1221342): Snapper rollbacks can cause snapshots to still require the old /var/lib/selinux location. \ # This part copies the custom local SELinux changes to /etc/selinux. \ current_selinux_modules_dir="%{_sysconfdir}/selinux"; \ @@ -364,11 +366,11 @@ %nil %define postunMigration() \ +# [This fragment needs bash.] \ # PED-12492 (bsc#1221342): Snapper rollbacks can cause snapshots to still require the old /var/lib/selinux location. \ # This part delete marker files per flavor. \ if [ "$1" = 0 ]; then \ - check_tmpfiles=(%{_sysconfdir}/selinux/{temp_selinux_modules_dir_created,selinux_migration_pending-%2,selinux_modules_migrated-%2,var_lib_selinux_deleted}); \ - current_selinux_modules_dir="%{_sysconfdir}/selinux"; \ + check_tmpfiles=(%{_sysconfdir}/selinux/{selinux_migration_pending-%2,selinux_modules_migrated-%2}); \ for i in "${check_tmpfiles[@]}"; do \ [ -f "${i}" ] && rm --preserve-root=all "${i}" \ done \ @@ -473,7 +475,6 @@ of systems and used as the basis for creating other policies. %files -%defattr(-,root,root,-) %license COPYING %dir %{_datadir}/selinux %dir %{_datadir}/selinux/packages @@ -602,7 +603,6 @@ %fdupes -s %{buildroot}%{_sysconfdir}/selinux/targeted/contexts %fdupes -s %{buildroot}%{_sysconfdir}/selinux/minimum/contexts - # PED-12492 (bsc#1221342): install service file and script to check old snaphsots. sed "s|@LIBEXECDIR@|%{_libexecdir}|g" %{_sourcedir}/cleanoldsepoldir.service.in > cleanoldsepoldir.service install -D -m 644 cleanoldsepoldir.service %{buildroot}%{_unitdir}/cleanoldsepoldir.service @@ -688,7 +688,7 @@ %preun %service_del_preun cleanoldsepoldir.service -%postun +%postun -p /bin/bash if [ "$1" = 0 ]; then %{_sbindir}/setenforce 0 2> /dev/null if [ -s %{_sysconfdir}/selinux/config ]; then @@ -696,10 +696,9 @@ fi # PED-12492 (bsc#1221342): cleanup of marker_files in /etc/selinux" - check_tmpfiles=(%{_sysconfdir}/selinux/{temp_selinux_modules_dir_created,selinux_modules_migrated-minimum, selinux_modules_migrated-mls, selinux_modules_migrated-targeted,var_lib_selinux_deleted}) - current_selinux_modules_dir="%{_sysconfdir}/selinux" - for i in $check_tmpfiles; do - [[ -f "${current_selinux_modules_dir}/${i}" ]] && rm --preserve-root=all ${current_selinux_modules_dir}/{i} + check_tmpfiles=(%{_sysconfdir}/selinux/{temp_selinux_modules_dir_created,selinux_modules_migrated-minimum,selinux_modules_migrated-mls,selinux_modules_migrated-targeted,var_lib_selinux_deleted}) + for i in "${check_tmpfiles[@]}"; do + [[ -f "${i}" ]] && rm --preserve-root=all "${i}" done fi @@ -720,7 +719,6 @@ SELinux policy development package %files devel -%defattr(-,root,root,-) %dir %{_datadir}/selinux/devel %dir %{_datadir}/selinux/devel/html/ %doc %{_datadir}/selinux/devel/html/* @@ -745,13 +743,11 @@ SELinux policy documentation and man page package %files doc -%defattr(-,root,root,-) %doc %{_datadir}/doc/%{name} %doc %{_datadir}/man/ru/man8/* %doc %{_datadir}/man/man8/* %{_datadir}/selinux/devel/policy.* -%if %{BUILD_TARGETED} %package targeted Summary: SELinux targeted base policy Group: System/Management @@ -763,23 +759,24 @@ %description targeted SELinux policy targeted base module. -%pre targeted +%pre targeted -p /bin/bash %preInstall targeted %preMigration $1 targeted # move from %posttrans to %post fixes boo#1264463 -%post targeted +%post targeted -p /bin/bash %postMigration $1 targeted %posttrans targeted %postInstall $1 targeted exit 0 -%postun targeted +%postun targeted -p /bin/bash %postunMigration $1 targeted %post_un $1 targeted exit 0 +%if %{BUILD_TARGETED} %triggerin -- libpcre2-8-0 %{_sbindir}/selinuxenabled && %{_sbindir}/semodule -nB 2> /dev/null exit 0 @@ -790,7 +787,6 @@ %fileList targeted %endif -%if %{BUILD_MINIMUM} %package minimum Summary: SELinux minimum base policy Group: System/Management @@ -805,27 +801,27 @@ %description minimum SELinux policy minimum base module. -%pre minimum +%pre minimum -p /bin/bash %preInstall minimum %preMigration $1 minimum if [ "$1" -ne 1 ]; then %{_sbindir}/semodule -s minimum --list-modules=full | awk '{ if ($4 != "disabled") print $2; }' > %{_datadir}/selinux/minimum/instmodules.lst fi - # move from %posttrans to %post fixes boo#1264463 -%post minimum +%post minimum -p /bin/bash %postMigration $1 minimum %posttrans minimum %postInstallMinimum $1 exit 0 -%postun minimum +%postun minimum -p /bin/bash %postunMigration $1 minimum %post_un $1 minimum exit 0 +%if %{BUILD_MINIMUM} %files minimum -f %{buildroot}%{_datadir}/selinux/minimum/nonbasemodules.lst %config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/unconfined_u %config(noreplace) %{_sysconfdir}/selinux/minimum/contexts/users/sysadm_u @@ -833,7 +829,6 @@ %fileList minimum %endif -%if %{BUILD_MLS} %package mls Summary: SELinux mls base policy Group: System/Management @@ -848,22 +843,23 @@ %description mls SELinux policy mls base module. -%pre mls +%pre mls -p /bin/bash %preInstall mls %preMigration $1 mls # move from %posttrans to %post fixes boo#1264463 -%post mls +%post mls -p /bin/bash %postMigration $1 mls %posttrans mls %postInstall $1 mls -%postun mls +%postun mls -p /bin/bash %postunMigration $1 mls %post_un $1 mls exit 0 +%if %{BUILD_MLS} %files mls -f %{buildroot}%{_datadir}/selinux/mls/nonbasemodules.lst %config(noreplace) %{_sysconfdir}/selinux/mls/contexts/users/unconfined_u %fileList mls
