Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package selinux-policy for openSUSE:Factory checked in at 2026-08-27 18:50:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/selinux-policy (Old) and /work/SRC/openSUSE:Factory/.selinux-policy.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "selinux-policy" Thu Aug 27 18:50:19 2026 rev:173 rq:1373761 version:20260826 Changes: -------- --- /work/SRC/openSUSE:Factory/selinux-policy/selinux-policy.changes 2026-08-21 16:50:59.049975643 +0200 +++ /work/SRC/openSUSE:Factory/.selinux-policy.new.1265/selinux-policy.changes 2026-08-27 18:50:35.868944490 +0200 @@ -1,0 +2,11 @@ +Wed Aug 26 07:51:38 UTC 2026 - Cathy Hu <[email protected]> + +- Update to version 20260826: + * Fix NFS mount with xprtsec=tls / xprtsec=mtls (bsc#1275783) + * named filetrans for netconfig (bsc#1275219) + * Revert "Apply fix_unconfined.patch" (bsc#1275219) + * sshd_session_t needs to access kanidm sshkeys (bsc#1275492) + * Fix broken kanidm_sshkeys_t security context (bsc#1275492) + * Initial policy for xrdp (bsc#1262291) + +------------------------------------------------------------------- Old: ---- selinux-policy-20260820.tar.xz New: ---- selinux-policy-20260826.tar.xz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ selinux-policy.spec ++++++ --- /var/tmp/diff_new_pack.E6oOOv/_old 2026-08-27 18:50:38.100021529 +0200 +++ /var/tmp/diff_new_pack.E6oOOv/_new 2026-08-27 18:50:38.105021701 +0200 @@ -37,7 +37,7 @@ License: GPL-2.0-or-later Group: System/Management Name: selinux-policy -Version: 20260820 +Version: 20260826 Release: 0 Source0: %{name}-%{version}.tar.xz Source1: container.fc ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.E6oOOv/_old 2026-08-27 18:50:38.328029402 +0200 +++ /var/tmp/diff_new_pack.E6oOOv/_new 2026-08-27 18:50:38.336029678 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.suse.de/selinux/selinux-policy.git</param> - <param name="changesrevision">1af6028db1f0b2231b137e3052868a83e37170a3</param></service></servicedata> + <param name="changesrevision">492b478c74c8a9f9105f41c5f13317405b968902</param></service></servicedata> (No newline at EOF) ++++++ selinux-policy-20260820.tar.xz -> selinux-policy-20260826.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/dist/targeted/modules.conf new/selinux-policy-20260826/dist/targeted/modules.conf --- old/selinux-policy-20260820/dist/targeted/modules.conf 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/dist/targeted/modules.conf 2026-08-26 09:29:43.000000000 +0200 @@ -3112,6 +3112,13 @@ # go_fdo_server = module +# Module: xrdp +# +# Policy for xrdp +# +# +xrdp = module + # SUSE specific modules # Layer: contrib diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/kanidm_unixd.te new/selinux-policy-20260826/policy/modules/contrib/kanidm_unixd.te --- old/selinux-policy-20260820/policy/modules/contrib/kanidm_unixd.te 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/contrib/kanidm_unixd.te 2026-08-26 09:29:43.000000000 +0200 @@ -39,6 +39,8 @@ type kanidm_sshkeys_t; domain_type(kanidm_sshkeys_t) +role system_r types kanidm_sshkeys_t; + type kanidm_sshkeys_direct_t; domain_type(kanidm_sshkeys_direct_t) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/ktls.te new/selinux-policy-20260826/policy/modules/contrib/ktls.te --- old/selinux-policy-20260820/policy/modules/contrib/ktls.te 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/contrib/ktls.te 2026-08-26 09:29:43.000000000 +0200 @@ -19,6 +19,7 @@ kernel_read_net_sysctls(ktlshd_t) kernel_read_network_state_symlinks(ktlshd_t) kernel_read_proc_files(ktlshd_t) +kernel_request_load_module(ktlshd_t) kernel_rw_key(ktlshd_t) domain_read_view_all_domains_keyrings(ktlshd_t) @@ -39,6 +40,10 @@ ') optional_policy(` + rpc_tcp_rw_nfs_sockets(ktlshd_t) +') + +optional_policy(` sysnet_read_config(ktlshd_t) ') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/rpc.if new/selinux-policy-20260826/policy/modules/contrib/rpc.if --- old/selinux-policy-20260820/policy/modules/contrib/rpc.if 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/contrib/rpc.if 2026-08-26 09:29:43.000000000 +0200 @@ -336,6 +336,24 @@ ######################################## ## <summary> +## Allow domain to read and write to an NFS TCP socket. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`rpc_tcp_rw_nfs_sockets',` + gen_require(` + type nfsd_t; + ') + + allow $1 nfsd_t:tcp_socket rw_socket_perms; +') + +######################################## +## <summary> ## Allow domain to read and write to an NFS UDP socket. ## </summary> ## <param name="domain"> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/tigervnc.if new/selinux-policy-20260826/policy/modules/contrib/tigervnc.if --- old/selinux-policy-20260820/policy/modules/contrib/tigervnc.if 1970-01-01 01:00:00.000000000 +0100 +++ new/selinux-policy-20260826/policy/modules/contrib/tigervnc.if 2026-08-26 09:29:43.000000000 +0200 @@ -0,0 +1,21 @@ +## <summary>policy for tigervnc</summary> + +########################################### +## <summary> +## Manage vnc home files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +ifndef(`vnc_manage_vnc_home_files',` + interface(`vnc_manage_vnc_home_files',` + gen_require(` + type vnc_home_t; + ') + + manage_files_pattern($1, vnc_home_t, vnc_home_t) + ') +') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/xrdp.fc new/selinux-policy-20260826/policy/modules/contrib/xrdp.fc --- old/selinux-policy-20260820/policy/modules/contrib/xrdp.fc 1970-01-01 01:00:00.000000000 +0100 +++ new/selinux-policy-20260826/policy/modules/contrib/xrdp.fc 2026-08-26 09:29:43.000000000 +0200 @@ -0,0 +1,13 @@ +/usr/bin/xrdp-sesman -- gen_context(system_u:object_r:xrdp_sesman_exec_t,s0) +/usr/bin/xrdp -- gen_context(system_u:object_r:xrdp_exec_t,s0) + +/etc/xrdp(/.*)? gen_context(system_u:object_r:xrdp_etc_t,s0) + +/run/xrdp(/.*)? gen_context(system_u:object_r:xrdp_var_run_t,s0) + +/run/xrdp/[0-9]+(/.*)? gen_context(system_u:object_r:xrdp_sesman_var_run_t,s0) +/run/xrdp/sesman\.socket -s gen_context(system_u:object_r:xrdp_sesman_var_run_t,s0) +/run/xrdp/\.sesman\.socket\.lock -- gen_context(system_u:object_r:xrdp_sesman_var_run_t,s0) + +/var/log/xrdp-sesman.log -- gen_context(system_u:object_r:xrdp_sesman_var_log_t,s0) +/var/log/xrdp.log -- gen_context(system_u:object_r:xrdp_var_log_t,s0) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/xrdp.if new/selinux-policy-20260826/policy/modules/contrib/xrdp.if --- old/selinux-policy-20260820/policy/modules/contrib/xrdp.if 1970-01-01 01:00:00.000000000 +0100 +++ new/selinux-policy-20260826/policy/modules/contrib/xrdp.if 2026-08-26 09:29:43.000000000 +0200 @@ -0,0 +1 @@ +## <summary>xrdp</summary> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/contrib/xrdp.te new/selinux-policy-20260826/policy/modules/contrib/xrdp.te --- old/selinux-policy-20260820/policy/modules/contrib/xrdp.te 1970-01-01 01:00:00.000000000 +0100 +++ new/selinux-policy-20260826/policy/modules/contrib/xrdp.te 2026-08-26 09:29:43.000000000 +0200 @@ -0,0 +1,121 @@ +policy_module(xrdp, 0.0.1) + +######################################## +# +# Declarations +# + +type xrdp_t; +type xrdp_exec_t; +init_daemon_domain(xrdp_t, xrdp_exec_t) + +type xrdp_etc_t; +files_config_file(xrdp_etc_t) + +type xrdp_var_log_t; +logging_log_file(xrdp_var_log_t) + +type xrdp_var_run_t; +files_pid_file(xrdp_var_run_t) + +type xrdp_sesman_t; +type xrdp_sesman_exec_t; +init_daemon_domain(xrdp_sesman_t, xrdp_sesman_exec_t) + +type xrdp_sesman_var_log_t; +logging_log_file(xrdp_sesman_var_log_t) + +type xrdp_sesman_var_run_t; +files_pid_file(xrdp_sesman_var_run_t) + +######################################## +# +# xrdp local policy +# + +allow xrdp_t self:tcp_socket create_stream_socket_perms; + +# .ini files will be written to +allow xrdp_t xrdp_etc_t:file write_file_perms; + +read_files_pattern(xrdp_t, xrdp_etc_t, xrdp_etc_t) + +manage_files_pattern(xrdp_t, xrdp_var_log_t, xrdp_var_log_t) +logging_log_filetrans(xrdp_t, xrdp_var_log_t, file, "xrdp.log") + +manage_files_pattern(xrdp_t, xrdp_var_run_t, xrdp_var_run_t) +manage_sock_files_pattern(xrdp_t, xrdp_var_run_t, xrdp_var_run_t) +files_pid_filetrans(xrdp_t, xrdp_var_run_t, {file dir}) + +kernel_request_load_module(xrdp_t) + +corenet_tcp_bind_generic_node(xrdp_t) +corenet_tcp_bind_gnome_remote_desktop_port(xrdp_t) + +# port 6100 +corenet_tcp_connect_unreserved_ports(xrdp_t) + +stream_connect_pattern(xrdp_t, xrdp_sesman_var_run_t, xrdp_sesman_var_run_t, xrdp_sesman_t) + +unconfined_stream_connect(xrdp_t) + +miscfiles_read_generic_certs(xrdp_t) +miscfiles_search_generic_cert_dirs(xrdp_t) + +permissive xrdp_t; + +######################################## +# +# xrdp-sesman local policy +# + +allow xrdp_sesman_t self:capability { chown fowner dac_read_search setgid setuid }; +allow xrdp_sesman_t self:process { setexec setpgid }; + +allow xrdp_sesman_t xrdp_etc_t:file read_file_perms; +allow xrdp_sesman_t xrdp_etc_t:dir search_dir_perms; +allow xrdp_sesman_t self:tcp_socket server_stream_socket_perms; + +manage_files_pattern(xrdp_sesman_t, xrdp_sesman_var_log_t, xrdp_sesman_var_log_t) +logging_log_filetrans(xrdp_sesman_t, xrdp_sesman_var_log_t, file, "xrdp-sesman.log") + +manage_files_pattern(xrdp_sesman_t, xrdp_sesman_var_run_t, xrdp_sesman_var_run_t) +manage_sock_files_pattern(xrdp_sesman_t, xrdp_sesman_var_run_t, xrdp_sesman_var_run_t) +create_dirs_pattern(xrdp_sesman_t, xrdp_sesman_var_run_t, xrdp_sesman_var_run_t) +files_pid_filetrans(xrdp_sesman_t, xrdp_var_run_t, dir) +filetrans_pattern(xrdp_sesman_t, xrdp_var_run_t, xrdp_sesman_var_run_t, {file dir sock_file}) +setattr_dirs_pattern(xrdp_sesman_t, xrdp_sesman_var_run_t, xrdp_sesman_var_run_t) + +create_dirs_pattern(xrdp_sesman_t, xrdp_var_run_t, xrdp_var_run_t) +setattr_dirs_pattern(xrdp_sesman_t, xrdp_var_run_t, xrdp_var_run_t) + +corenet_tcp_bind_generic_port(xrdp_sesman_t) + +fs_getattr_pidfs(xrdp_sesman_t) + +auth_login_pgm_domain(xrdp_sesman_t) + +optional_policy(` + systemd_userdbd_stream_connect(xrdp_sesman_t) +') + +optional_policy(` + vnc_manage_vnc_home_files(xrdp_sesman_t) +') + +optional_policy(` + unconfined_shell_domtrans(xrdp_sesman_t) +') + +optional_policy(` + # pam_kwallet5 runs in this domain during login: reads the wallet salt + # from ~/.local/share/kwalletd and creates /run/user/UID/kwallet5.socket + userdom_read_user_home_content_files(xrdp_sesman_t) + userdom_manage_user_tmp_sockets(xrdp_sesman_t) +') + +optional_policy(` + xserver_domtrans(xrdp_sesman_t) +') + +permissive xrdp_sesman_t; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/services/ssh.te new/selinux-policy-20260826/policy/modules/services/ssh.te --- old/selinux-policy-20260820/policy/modules/services/ssh.te 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/services/ssh.te 2026-08-26 09:29:43.000000000 +0200 @@ -533,8 +533,8 @@ ') optional_policy(` - kandim_kanidm_sshkeys_transition(sshd_t) - kandim_kanidm_sshkeys_exec(sshd_t) + kandim_kanidm_sshkeys_transition(sshd_session_t) + kandim_kanidm_sshkeys_exec(sshd_session_t) ') optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/system/sysnetwork.if new/selinux-policy-20260826/policy/modules/system/sysnetwork.if --- old/selinux-policy-20260820/policy/modules/system/sysnetwork.if 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/system/sysnetwork.if 2026-08-26 09:29:43.000000000 +0200 @@ -1195,6 +1195,7 @@ files_etc_filetrans($1, net_conf_t, file, "ethers") files_etc_filetrans($1, net_conf_t, file, "yp.conf") files_etc_filetrans($1, net_conf_t, file, "ntp.conf") + files_pid_filetrans($1, net_conf_t, dir, "netconfig") init_pid_filetrans($1, net_conf_t, dir, "network") optional_policy(` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/selinux-policy-20260820/policy/modules/system/unconfined.te new/selinux-policy-20260826/policy/modules/system/unconfined.te --- old/selinux-policy-20260820/policy/modules/system/unconfined.te 2026-08-20 13:34:22.000000000 +0200 +++ new/selinux-policy-20260826/policy/modules/system/unconfined.te 2026-08-26 09:29:43.000000000 +0200 @@ -1,10 +1,5 @@ policy_module(unconfined, 3.5.0) -require { - type var_run_t; - type net_conf_t; -} - ######################################## # # Declarations @@ -35,8 +30,6 @@ init_use_notify(unconfined_service_t) usermanage_run_passwd(unconfined_service_t, system_r) -filetrans_pattern(unconfined_service_t, var_run_t, net_conf_t, dir) - optional_policy(` rpm_transition_script(unconfined_service_t, system_r) ')
