Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package selinux-policy for openSUSE:Factory checked in at 2026-07-29 18:58:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old) and /work/SRC/openSUSE:Factory/.selinux-policy.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy" Wed Jul 29 18:58:26 2026 rev:169 rq:1367954 version:20260727 Changes: -------- --- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes 2026-07-23 23:09:47.423123763 +0200 +++ /work/SRC/openSUSE:Factory/.selinux-policy.new.2004/selinux-policy.changes 2026-07-29 18:58:43.584563348 +0200 @@ -1,0 +2,10 @@ +Mon Jul 27 08:50:17 UTC 2026 - Cathy Hu <[email protected]> + +- Update to version 20260727: + * pwaccessd_t uses nsswitch and newidmapd connects to pwaccessd_t socket (bsc#1271860) + * adjust amavis spool path regex for openSUSE (bsc#1268627) + * Allow cupsd_t to communicate with fprintd via dbus (bsc#1268366) + * Support vfs_snapper to work with samba_share_t (bsc#1265400) + * vfs_samba uses dbus to communicate with snapper (bsc#1265400) + +------------------------------------------------------------------- Old: ---- selinux-policy-20260715.tar.xz New: ---- selinux-policy-20260727.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ selinux-policy.spec ++++++ --- /var/tmp/diff_new_pack.n3Y5OO/_old 2026-07-29 18:58:44.568597288 +0200 +++ /var/tmp/diff_new_pack.n3Y5OO/_new 2026-07-29 18:58:44.568597288 +0200 @@ -37,7 +37,7 @@ License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20260715 +Version: 20260727 Release: 0 Source0: %{name}-%{version}.tar.xz Source1: container.fc ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.n3Y5OO/_old 2026-07-29 18:58:44.676601014 +0200 +++ /var/tmp/diff_new_pack.n3Y5OO/_new 2026-07-29 18:58:44.684601289 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param> - <param name="changesrevision">2ad83e90ae484ee791fe586787273f52deb5dd4c</param></service></servicedata> + <param name="changesrevision">0befca7b7a306691c4ee32243fd640e29ea6dd4b</param></service></servicedata> (No newline at EOF) ++++++ selinux-policy-20260715.tar.xz -> selinux-policy-20260727.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/account-utils.te new/selinux-policy-20260727/policy/modules/contrib/account-utils.te --- old/selinux-policy-20260715/policy/modules/contrib/account-utils.te 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/account-utils.te 2026-07-27 10:49:08.000000000 +0200 @@ -43,6 +43,8 @@ allow newidmapd_t self:unix_dgram_socket { create getopt setopt write }; +accountutils_pwaccessd_varlink_socket_connect(newidmapd_t) + kernel_dgram_send(newidmapd_t) auth_read_passwd_file(newidmapd_t) @@ -73,8 +75,8 @@ kernel_dgram_send(pwaccessd_t) -auth_read_passwd_file(pwaccessd_t) auth_read_shadow(pwaccessd_t) +auth_use_nsswitch(pwaccessd_t) create_dirs_pattern(pwaccessd_t, accountutils_var_run_t, accountutils_var_run_t) rw_dirs_pattern(pwaccessd_t, accountutils_var_run_t, accountutils_var_run_t) @@ -86,11 +88,6 @@ logging_read_syslog_pid(pwaccessd_t) logging_write_syslog_pid_socket(pwaccessd_t) - -optional_policy(` - systemd_userdbd_stream_connect(pwaccessd_t) -') - permissive pwaccessd_t; ######################################## diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/amavis.fc new/selinux-policy-20260727/policy/modules/contrib/amavis.fc --- old/selinux-policy-20260715/policy/modules/contrib/amavis.fc 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/amavis.fc 2026-07-27 10:49:08.000000000 +0200 @@ -21,6 +21,6 @@ /run/amavis(d)?(/.*)? gen_context(system_u:object_r:amavis_var_run_t,s0) /run/amavisd-snmp-subagent\.pid -- gen_context(system_u:object_r:amavis_var_run_t,s0) -/var/spool/amavisd(/.*)? gen_context(system_u:object_r:amavis_spool_t,s0) +/var/spool/amavis(d)?(/.*)? gen_context(system_u:object_r:amavis_spool_t,s0) /var/virusmails(/.*)? gen_context(system_u:object_r:amavis_quarantine_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/fprintd.te new/selinux-policy-20260727/policy/modules/contrib/fprintd.te --- old/selinux-policy-20260715/policy/modules/contrib/fprintd.te 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/fprintd.te 2026-07-27 10:49:08.000000000 +0200 @@ -54,6 +54,10 @@ userdom_read_all_users_state(fprintd_t) optional_policy(` + cups_dbus_chat(fprintd_t) +') + +optional_policy(` dbus_system_domain(fprintd_t, fprintd_exec_t) optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/samba.if new/selinux-policy-20260727/policy/modules/contrib/samba.if --- old/selinux-policy-20260715/policy/modules/contrib/samba.if 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/samba.if 2026-07-27 10:49:08.000000000 +0200 @@ -458,6 +458,42 @@ ######################################## ## <summary> +## Allow the specified domain to manage samba's share files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`samba_manage_share_dirs',` + gen_require(` + type samba_share_t; + ') + + manage_dirs_pattern($1, samba_share_t, samba_share_t) +') + +######################################## +## <summary> +## Allow the specified domain to manage samba's share files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`samba_manage_share_files',` + gen_require(` + type samba_share_t; + ') + + manage_files_pattern($1, samba_share_t, samba_share_t) +') + +######################################## +## <summary> ## Allow the specified domain to read samba's shares ## </summary> ## <param name="domain"> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/samba.te new/selinux-policy-20260727/policy/modules/contrib/samba.te --- old/selinux-policy-20260715/policy/modules/contrib/samba.te 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/samba.te 2026-07-27 10:49:08.000000000 +0200 @@ -653,6 +653,10 @@ ') optional_policy(` + snapper_dbus_chat(smbd_t) +') + +optional_policy(` seutil_sigchld_newrole(smbd_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260715/policy/modules/contrib/snapper.te new/selinux-policy-20260727/policy/modules/contrib/snapper.te --- old/selinux-policy-20260715/policy/modules/contrib/snapper.te 2026-07-15 16:38:00.000000000 +0200 +++ new/selinux-policy-20260727/policy/modules/contrib/snapper.te 2026-07-27 10:49:08.000000000 +0200 @@ -109,6 +109,12 @@ lvm_domtrans(snapperd_t) ') +# support for vfs_snapper + samba share labelled as samba_share_t +optional_policy(` + samba_manage_share_dirs(snapperd_t) + samba_manage_share_files(snapperd_t) +') + optional_policy(` snapper_relabel_snapshots(snapperd_t) ')
